From 6338e38731635ad6990a8ec75a7d3d24dc48f881 Mon Sep 17 00:00:00 2001
From: Steven Maude <git@stevenmaude.co.uk>
Date: Mon, 21 Sep 2026 18:34:42 +0100
Subject: [PATCH 1/5] Set Dependabot cooldowns

---
 .github/dependabot.yml | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index e0ba49e..3ee1470 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -4,8 +4,12 @@ updates:
     directory: "/"
     schedule:
       interval: "daily"
-      
+    cooldown:
+      default-days: 7
+
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
       interval: "daily"
+    cooldown:
+      default-days: 7

From 40f38e0e8357cce8d874ce5ec99144d260dc733f Mon Sep 17 00:00:00 2001
From: Steven Maude <git@stevenmaude.co.uk>
Date: Mon, 21 Sep 2026 18:35:42 +0100
Subject: [PATCH 2/5] Update actions/checkout to v7.0.1

---
 .github/workflows/ci-build.yml   | 2 +-
 .github/workflows/ci-release.yml | 3 ++-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci-build.yml b/.github/workflows/ci-build.yml
index 17a2b0a..a04a391 100644
--- a/.github/workflows/ci-build.yml
+++ b/.github/workflows/ci-build.yml
@@ -12,7 +12,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Build
         run: |
diff --git a/.github/workflows/ci-release.yml b/.github/workflows/ci-release.yml
index 5cbaa8a..29d841a 100644
--- a/.github/workflows/ci-release.yml
+++ b/.github/workflows/ci-release.yml
@@ -11,7 +11,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
       - name: Build project
         run: |
           make && mv https-redirect https-redirect_linux_amd64

From b265d754a8a9200762a9910d7e94f2eb764fef76 Mon Sep 17 00:00:00 2001
From: Steven Maude <git@stevenmaude.co.uk>
Date: Mon, 21 Sep 2026 18:37:23 +0100
Subject: [PATCH 3/5] Set permissions on workflows

---
 .github/workflows/ci-build.yml   | 3 +++
 .github/workflows/ci-release.yml | 3 +++
 2 files changed, 6 insertions(+)

diff --git a/.github/workflows/ci-build.yml b/.github/workflows/ci-build.yml
index a04a391..d88ab39 100644
--- a/.github/workflows/ci-build.yml
+++ b/.github/workflows/ci-build.yml
@@ -5,6 +5,9 @@ on:
       - main
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   build:
     name: Build and Test
diff --git a/.github/workflows/ci-release.yml b/.github/workflows/ci-release.yml
index 29d841a..dc10fde 100644
--- a/.github/workflows/ci-release.yml
+++ b/.github/workflows/ci-release.yml
@@ -5,6 +5,9 @@ on:
 
 name: Upload Release Asset
 
+permissions:
+  contents: write
+
 jobs:
   build:
     name: Upload Release Asset

From e8d3f27f72465abd3e7bb083a27c5bc3045da669 Mon Sep 17 00:00:00 2001
From: Steven Maude <git@stevenmaude.co.uk>
Date: Mon, 21 Sep 2026 18:37:33 +0100
Subject: [PATCH 4/5] Set `persist-credentials` to `false`

---
 .github/workflows/ci-build.yml   | 2 ++
 .github/workflows/ci-release.yml | 2 ++
 2 files changed, 4 insertions(+)

diff --git a/.github/workflows/ci-build.yml b/.github/workflows/ci-build.yml
index d88ab39..038e9fe 100644
--- a/.github/workflows/ci-build.yml
+++ b/.github/workflows/ci-build.yml
@@ -16,6 +16,8 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Build
         run: |
diff --git a/.github/workflows/ci-release.yml b/.github/workflows/ci-release.yml
index dc10fde..67a4b1e 100644
--- a/.github/workflows/ci-release.yml
+++ b/.github/workflows/ci-release.yml
@@ -15,6 +15,8 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Build project
         run: |

From 9d0fd730e64a4ad0331188767060bf7c5904d469 Mon Sep 17 00:00:00 2001
From: Steven Maude <git@stevenmaude.co.uk>
Date: Mon, 21 Sep 2026 18:37:53 +0100
Subject: [PATCH 5/5] Use `gh` CLI for releases

---
 .github/workflows/ci-release.yml | 26 +++++++-------------------
 1 file changed, 7 insertions(+), 19 deletions(-)

diff --git a/.github/workflows/ci-release.yml b/.github/workflows/ci-release.yml
index 67a4b1e..504b7a3 100644
--- a/.github/workflows/ci-release.yml
+++ b/.github/workflows/ci-release.yml
@@ -21,23 +21,11 @@ jobs:
       - name: Build project
         run: |
           make && mv https-redirect https-redirect_linux_amd64
-      - name: Create Release
-        id: create_release
-        uses: actions/create-release@v1
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        with:
-          tag_name: ${{ github.ref }}
-          release_name: ${{ github.ref }}
-          draft: true
-          prerelease: false
-      - name: Upload Release Asset
-        id: upload-release-asset 
-        uses: actions/upload-release-asset@v1
+
+      - name: Create Release and Upload Asset
+        run: |
+          gh release create "${GITHUB_REF_NAME}" ./https-redirect_linux_amd64 \
+            --title "${GITHUB_REF_NAME}" \
+            --draft
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        with:
-          upload_url: ${{ steps.create_release.outputs.upload_url }}
-          asset_path: ./https-redirect_linux_amd64
-          asset_name: https-redirect_linux_amd64
-          asset_content_type: application/octet-stream
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}