Release

.devcontainer/devcontainer-lock.json

@@ -0,0 +1,9 @@
+{
+  "features": {
+    "ghcr.io/devcontainers/features/common-utils:2": {
+      "version": "2.5.9",
+      "resolved": "ghcr.io/devcontainers/features/common-utils@sha256:cb0c4d3c276f157eed17935747e364178d75fee17f55c4e129966f64633deb3a",
+      "integrity": "sha256:cb0c4d3c276f157eed17935747e364178d75fee17f55c4e129966f64633deb3a"
+    }
+  }
+}

.devcontainer/devcontainer.json

@@ -5,6 +5,12 @@
   // develop it here and rust-analyzer/cargo target x86_64-unknown-linux-gnu.
   "image": "mcr.microsoft.com/devcontainers/rust:1-bookworm",
 
+  "features": {
+    "ghcr.io/devcontainers/features/common-utils:2": {
+      "configureZshAsDefaultShell": true
+    }
+  },
+
   // Pre-fetch crate deps so the first rust-analyzer/cargo run is fast.
   "postCreateCommand": "cargo fetch",
 

.github/CODEOWNERS

@@ -0,0 +1,18 @@
+# https://docs.github.com/en/github/creating-cloning-and-archiving-repositories/about-code-owners
+# Last matching pattern wins. Only ONE listed owner needs to approve, not all.
+
+# Default owner for everything.
+* @D3strukt0r
+
+# Files Dependabot manages — @Team-MaRo/CI (incl. the bot user) can also review,
+# so the bot's auto-approval satisfies the code-owner requirement on these paths.
+# cargo
+/Cargo.toml @D3strukt0r @Team-MaRo/CI
+/Cargo.lock @D3strukt0r @Team-MaRo/CI
+# github-actions
+/.github/workflows/ @D3strukt0r @Team-MaRo/CI
+# nix
+/flake.nix @D3strukt0r @Team-MaRo/CI
+/flake.lock @D3strukt0r @Team-MaRo/CI
+# devcontainers
+/.devcontainer/ @D3strukt0r @Team-MaRo/CI

.github/dependabot.yml

@@ -14,15 +14,15 @@ updates:
       - "dependabot :robot:"
     schedule:
       interval: weekly
-      day: monday # required: weekly does NOT default to Monday (GitHub keeps a random slot — here Saturday). Do not remove.
+      day: monday
       time: '09:30'
       timezone: Europe/Zurich
     groups:
       github-actions:
         patterns:
           - "*"
 
-  - package-ecosystem: cargo
+  - package-ecosystem: devcontainers
     directory: /
     target-branch: develop
     labels:
@@ -33,10 +33,9 @@ updates:
       time: '09:30'
       timezone: Europe/Zurich
     groups:
-      cargo-minor-patch:
-        update-types:
-          - minor
-          - patch
+      devcontainers:
+        patterns:
+          - "*"
 
   - package-ecosystem: nix
     directory: /
@@ -54,3 +53,19 @@ updates:
       flake:
         patterns:
           - "*"
+
+  - package-ecosystem: cargo
+    directory: /
+    target-branch: develop
+    labels:
+      - "dependabot :robot:"
+    schedule:
+      interval: weekly
+      day: monday
+      time: '09:30'
+      timezone: Europe/Zurich
+    groups:
+      cargo-non-breaking:
+        update-types:
+          - minor
+          - patch

.github/workflows/dependabot-automerge.yml

@@ -29,7 +29,7 @@ jobs:
         if: steps.metadata.outputs.update-type == 'version-update:semver-minor' || steps.metadata.outputs.update-type == 'version-update:semver-patch'
         env:
           PR_URL: ${{ github.event.pull_request.html_url }}
-          GITHUB_TOKEN: ${{ github.token }}
+          GITHUB_TOKEN: ${{ secrets.GH_PAT }}
         run: |
           gh pr checkout "$PR_URL" # sets the upstream metadata for `gh pr status`
           if [ "$(gh pr status --json reviewDecision -q .currentBranch.reviewDecision)" != "APPROVED" ]; then

.github/workflows/greetings.yml

@@ -16,6 +16,7 @@ jobs:
   greeting:
     name: Greet First-Time Contributors
     runs-on: ubuntu-latest
+    if: github.actor != 'dependabot[bot]'
 
     steps:
       - name: Greet First-Time Contributors

.github/workflows/release.yml

@@ -7,8 +7,6 @@ name: Release
 # on merge cuts a GitHub Release + git tag. The tag push fires build.yml (which
 # triggers on `tags: ['*.*.*']`) to build the per-arch binaries and attach them
 # to the release.
-#
-# Config: release-please-config.json + .release-please-manifest.json.
 
 on:
   push:
@@ -31,6 +29,8 @@ jobs:
         id: release
         uses: googleapis/release-please-action@v5
         with:
+          config-file: .github/release-please-config.json
+          manifest-file: .github/release-please-manifest.json
           # PAT instead of GITHUB_TOKEN: GitHub suppresses workflow triggers for
           # tags created via GITHUB_TOKEN, which would prevent build.yml from
           # firing on the release tag to attach the binaries.

AGENTS.md

@@ -96,7 +96,7 @@ releases attach:
 ## Releases
 
 Conventional commits → release-please (`release-type: rust`, configured in
-`release-please-config.json` + `.release-please-manifest.json`) opens a release PR
+`.github/release-please-config.json` + `.github/release-please-manifest.json`) opens a release PR
 bumping `Cargo.toml`/`Cargo.lock` and `flake.nix` (the `x-release-please-version`
 marker). Merging cuts a tag + GitHub Release; the tag fires `build.yml` to attach
 the binaries. Needs the `GH_PAT` secret and "Allow Actions to create PRs".