build(deps-dev): harden dependency maintenance

.github/dependabot.yml

@@ -5,9 +5,24 @@ updates:
     schedule:
       interval: "weekly"
     open-pull-requests-limit: 5
+    cooldown:
+      default-days: 7
+    commit-message:
+      prefix: "build"
+      prefix-development: "build"
+      include: "scope"
     groups:
-      npm-minor-patch:
+      npm-production-minor-patch:
         applies-to: version-updates
+        dependency-type: production
+        patterns:
+          - "*"
+        update-types:
+          - "minor"
+          - "patch"
+      npm-development-minor-patch:
+        applies-to: version-updates
+        dependency-type: development
         patterns:
           - "*"
         update-types:
@@ -17,7 +32,43 @@ updates:
         applies-to: security-updates
         patterns:
           - "*"
+    ignore:
+      # Keep type definitions aligned with the Node 22 runtime used by CI.
+      - dependency-name: "@types/node"
+        update-types:
+          - "version-update:semver-major"
+      # TypeScript 7 is not yet supported by the current Svelte and lint toolchain.
+      - dependency-name: "typescript"
+        update-types:
+          - "version-update:semver-major"
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
       interval: "weekly"
+    cooldown:
+      default-days: 7
+    commit-message:
+      prefix: "ci"
+      include: "scope"
+  - package-ecosystem: "pip"
+    directory: "/docs"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+    cooldown:
+      default-days: 7
+    commit-message:
+      prefix: "docs"
+      include: "scope"
+    groups:
+      pip-minor-patch:
+        applies-to: version-updates
+        patterns:
+          - "*"
+        update-types:
+          - "minor"
+          - "patch"
+      pip-security:
+        applies-to: security-updates
+        patterns:
+          - "*"

.github/workflows/documentation.yml

@@ -1,13 +1,18 @@
 name: Documentation
 on:
   workflow_dispatch:
+  pull_request:
+    paths:
+      - "docs/**"
+      - ".github/workflows/documentation.yml"
+      - "wrangler.jsonc"
   push:
     branches:
-      - 'master'
+      - "master"
     paths:
-      - 'docs/**'
-      - '.github/workflows/documentation.yml'
-      - 'wrangler.jsonc'
+      - "docs/**"
+      - ".github/workflows/documentation.yml"
+      - "wrangler.jsonc"
 
 permissions:
   contents: read
@@ -21,6 +26,8 @@ jobs:
       - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with:
           python-version: 3.x
+          cache: "pip"
+          cache-dependency-path: "docs/requirements.txt"
 
       - name: Install documentation dependencies
         run: python -m pip install -r docs/requirements.txt

.github/workflows/release.yml

@@ -24,9 +24,6 @@ jobs:
       pull-requests: write # semantic-release PR comments
       id-token: write # mint the OIDC token used to sign artifact attestations
       attestations: write # publish build provenance attestations for the assets
-    strategy:
-      matrix:
-        node-version: [22]
     outputs:
       released: ${{ steps.release.outputs.released }}
       version: ${{ steps.extract-version.outputs.version }}
@@ -40,7 +37,7 @@ jobs:
       - name: Setup Node
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version: ${{ matrix.node-version }}
+          node-version-file: ".nvmrc"
           cache: npm
 
       - name: Validate trigger
@@ -54,7 +51,7 @@ jobs:
 
       - name: Install dependencies
         if: steps.validate.outputs.valid == 'true'
-        run: npm install
+        run: npm ci
 
       - name: Build
         if: steps.validate.outputs.valid == 'true'
@@ -69,7 +66,6 @@ jobs:
         if: steps.validate.outputs.valid == 'true'
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
           DRY_RUN: ${{ github.event.inputs.dryRun || 'false' }}
         run: |
           node - <<'NODE'

.github/workflows/test.yml

@@ -1,5 +1,9 @@
 name: Test
-on: push
+on:
+  pull_request:
+  push:
+    branches:
+      - "master"
 
 permissions:
   contents: read
@@ -16,10 +20,10 @@ jobs:
       - name: Setup Node
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version: 22
-          cache: 'npm'
+          node-version-file: ".nvmrc"
+          cache: "npm"
       - name: Install dependencies
-        run: npm install
+        run: npm ci
       - name: Lint
         run: npm run lint
       - name: Format check