ci: add security dependency bumps

.github/workflows/landing-bump.yml

@@ -0,0 +1,96 @@
+name: Landing security bump
+
+on:
+  schedule:
+    - cron: '23 2 * * 1'
+  workflow_dispatch:
+  # External signature-verifying relay required; no receiver is installed here.
+  repository_dispatch:
+    types: [dependabot_alert]
+  workflow_run:
+    workflows: [Main]
+    types: [completed]
+
+permissions:
+  contents: write
+  issues: write
+  pull-requests: write
+  actions: write
+  vulnerability-alerts: read
+
+jobs:
+  bump:
+    if: >-
+      vars.LANDING_MODEL != '' &&
+      (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' ||
+       github.event_name == 'repository_dispatch' ||
+       (github.event_name == 'workflow_run' &&
+        github.event.workflow_run.conclusion == 'failure' &&
+        github.event.workflow_run.head_repository.full_name == github.repository &&
+        (github.event.workflow_run.event == 'pull_request' ||
+         (github.event.workflow_run.event == 'workflow_dispatch' &&
+          github.event.workflow_run.head_branch != github.event.repository.default_branch)) &&
+        vars.LANDING_BUMP_ON_FAILURE != 'false'))
+    concurrency:
+      group: landing-security-bump-${{ github.repository_id }}
+      cancel-in-progress: false
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    env:
+      GH_ADMISSION_TOKEN: ${{ secrets.LANDING_ADMISSION_TOKEN || github.token }}
+      GH_TOKEN: ${{ secrets.LANDING_GITHUB_TOKEN || github.token }}
+      GIT_AUTHOR_NAME: ${{ vars.LANDING_GIT_NAME || 'github-actions[bot]' }}
+      GIT_AUTHOR_EMAIL: ${{ vars.LANDING_GIT_EMAIL || '41898282+github-actions[bot]@users.noreply.github.com' }}
+      GIT_COMMITTER_NAME: ${{ vars.LANDING_GIT_NAME || 'github-actions[bot]' }}
+      GIT_COMMITTER_EMAIL: ${{ vars.LANDING_GIT_EMAIL || '41898282+github-actions[bot]@users.noreply.github.com' }}
+    steps:
+      - name: Check out trusted default branch
+        uses: actions/checkout@v6
+        with:
+          ref: ${{ github.event.repository.default_branch }}
+          fetch-depth: 0
+          persist-credentials: false
+      - name: Set up Python dependencies
+        uses: ./.github/actions/setup-python-env
+        with:
+          python-version: '3.12'
+      - uses: pnpm/action-setup@v6
+        with:
+          package_json_file: website/package.json
+      - uses: actions/setup-node@v6
+        with:
+          node-version-file: website/.node-version
+      - name: Prepare website dependencies and Git authentication
+        run: |
+          pnpm --dir website install --frozen-lockfile
+          gh auth setup-git
+      - name: Identify Landing dependency PR publisher
+        if: github.event_name == 'workflow_run' && startsWith(github.event.workflow_run.head_branch, 'deps/landing-')
+        run: echo "LANDING_PUBLISHING_ACTOR=$(gh api graphql -f query='{viewer{login}}' --jq .data.viewer.login)" >> "$GITHUB_ENV"
+      - name: Remediate vulnerable dependencies
+        uses: bubbuild/landing@main
+        env:
+          LANDING_MODEL: ${{ vars.LANDING_MODEL }}
+          LANDING_API_KEY: ${{ secrets.LANDING_API_KEY }}
+          LANDING_API_BASE: ${{ vars.LANDING_API_BASE }}
+          LANDING_COMPLETION_ARGS: ${{ vars.LANDING_COMPLETION_ARGS || '{}' }}
+        with:
+          command: bump
+          upstream-workflow: Main
+          bump-on-failure: ${{ vars.LANDING_BUMP_ON_FAILURE || 'true' }}
+          dependency-update-actors: |
+            dependabot[bot]
+            renovate[bot]
+            ${{ env.LANDING_PUBLISHING_ACTOR }}
+            ${{ vars.LANDING_DEPENDENCY_UPDATE_ACTORS }}
+          checked-revision: ''
+          checks: |
+            make check
+            make test
+          instruction: >-
+            Security remediation only: inspect open Dependabot alerts; skip routine upgrades and stop if alert access fails. Closed alerts only reconcile tracked remediation.
+            For failed CI, verify the supplied security dependency PR's current head and failed checks; make only necessary repairs on its existing branch, without force-push.
+            Follow AGENTS.md: use uv/pnpm, preserve constraints and hatch-vcs version policy, and keep manifest/lock changes scoped to the security fix.
+            Reuse matching PRs; publish new candidates as English drafts on deps/landing-* branches with Conventional Commit titles and advisory/version/check evidence.
+            After each candidate push, run gh workflow run main.yml --ref <candidate-branch> and verify the run's head_sha matches; report dispatch failures without weakening checks.
+            Maintainers decide merges, releases and alert dismissal; no general review or triage is authorized.

.github/workflows/main.yml

@@ -1,6 +1,7 @@
 name: Main
 
 on:
+  workflow_dispatch:
   push:
     branches:
       - main