Move CI onto the awcodes/.github shared workflows

.github/dependabot.yml

@@ -1,14 +1,42 @@
-# Please see the documentation for all configuration options:
-# https://help.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
-
+# Dependabot config for a package on the shared CI baseline.
+# Copy to .github/dependabot.yml in the package repo.
 version: 2
 updates:
+  # Composer — keeps this package's dev tooling current (pint, phpstan/larastan,
+  # pest + plugins, rector, testbench). Grouped into one weekly PR to cut noise.
+  # The runtime `require` block is constrained loosely on purpose; review those bumps.
+  - package-ecosystem: composer
+    directory: "/"
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+    # Wait for a release to settle before opening a PR — longer for majors.
+    cooldown:
+      default-days: 7
+      semver-major-days: 14
+    groups:
+      dev-dependencies:
+        dependency-type: development
+      production-dependencies:
+        dependency-type: production
 
-  - package-ecosystem: "github-actions"
+  # GitHub Actions — covers any actions the package repo adds (release, changelog, etc.).
+  #
+  # The awcodes/.github caller is excluded on purpose. It tracks the moving major tag
+  # (@v1) so CI fixes reach every package at once (docs/versioning.md). Dependabot has no
+  # concept of a moving major: it reads @v1 as version "1" and offers the newest semver
+  # tag, which pins the package to a snapshot and can even be a downgrade, since v1 moves
+  # ahead of older release tags. Moving to a new major is a deliberate migration, not a
+  # Dependabot bump.
+  - package-ecosystem: github-actions
     directory: "/"
     schedule:
-      interval: "weekly"
+      interval: weekly
     cooldown:
       default-days: 7
-    labels:
-      - "dependencies"
+    ignore:
+      - dependency-name: "awcodes/.github/*"
+    groups:
+      github-actions:
+        patterns:
+          - "*"

.github/workflows/ci.yml

@@ -0,0 +1,118 @@
+name: CI
+
+# Canonical caller for a Filament plugin, on the shared reusable workflows in
+# awcodes/.github (docs/package-migration.md).
+#
+# 4.x is the active branch and serves both supported Filament majors from one branch —
+# composer.json requires "filament/filament": "^4.0|^5.0" — so one caller covers both:
+# the matrix pins filament/filament per row and the shared workflow installs that pin
+# before running the suite. Without the per-row pin every row would resolve Filament 5
+# under prefer-stable and the ^4.0 half of the constraint would never be executed.
+#
+# 1.x / 2.x / 3.x are frozen and keep whatever CI they already have.
+
+on:
+  push:
+    branches:
+      - 4.x
+    paths:
+      - "src/**"
+      - "config/**"
+      - "database/**"
+      - "resources/**"
+      - "routes/**"
+      - "tests/**"
+      - "composer.json"
+      - "package.json"
+      - "package-lock.json"
+      - "vite.config.*"
+      - "phpunit.xml*"
+      - "phpstan.neon*"
+      - "rector.php"
+      - "pint.json"
+      - ".github/workflows/**"
+  pull_request:
+    branches:
+      - 4.x
+    paths:
+      - "src/**"
+      - "config/**"
+      - "database/**"
+      - "resources/**"
+      - "routes/**"
+      - "tests/**"
+      - "composer.json"
+      - "package.json"
+      - "package-lock.json"
+      - "vite.config.*"
+      - "phpunit.xml*"
+      - "phpstan.neon*"
+      - "rector.php"
+      - "pint.json"
+      - ".github/workflows/**"
+
+jobs:
+  ci:
+    uses: awcodes/.github/.github/workflows/filament-plugin.yml@v1
+    with:
+      # Explicit rows, no `exclude`. All seven resolve against this package's transitive
+      # constraints: the F5 rows land filament 5.8.1, the F4 rows filament 4.13.1.
+      matrix: |
+        [
+          {"php":"8.5","laravel":"13.*","filament":"5.*","testbench":"11.*","dependencies":"prefer-stable"},
+          {"php":"8.4","laravel":"13.*","filament":"5.*","testbench":"11.*","dependencies":"prefer-stable"},
+          {"php":"8.5","laravel":"12.*","filament":"5.*","testbench":"10.*","dependencies":"prefer-stable"},
+          {"php":"8.4","laravel":"12.*","filament":"5.*","testbench":"10.*","dependencies":"prefer-stable"},
+          {"php":"8.3","laravel":"12.*","filament":"5.*","testbench":"10.*","dependencies":"prefer-stable"},
+          {"php":"8.4","laravel":"12.*","filament":"4.*","testbench":"10.*","dependencies":"prefer-stable"},
+          {"php":"8.3","laravel":"12.*","filament":"4.*","testbench":"10.*","dependencies":"prefer-stable"}
+        ]
+      # filament-package is left at its default. This is a panel plugin: its runtime
+      # require is filament/filament, so the matrix pins the package it depends on.
+      run-tests: true
+      run-lint: true
+      run-static-analysis: true
+      run-reformat: true
+      # The suite does not need the compiled bundle. StickyHeaderServiceProvider only
+      # hands resources/dist/sticky-header.js to FilamentAsset::register(), which stores
+      # the path — nothing reads the file, and the suite passes with it deleted. So there
+      # is no reason to spend a Node setup and build on every matrix row. Freshness of the
+      # committed bundle is checked once, in the `assets` job below.
+      run-build: false
+
+  # resources/dist is committed and shipped, so a change to resources/js that lands
+  # without a rebuild silently publishes stale assets. The build is deterministic, so
+  # rebuilding and diffing catches that on the PR rather than after a tag is cut.
+  # (The shared workflow's run-build input is a different thing: it builds assets for
+  # suites that need them, and checks nothing.)
+  #
+  # This replaces the old assets.yml, which rebuilt and auto-committed after merge — so
+  # main could hold a stale bundle for as long as it took that job to run, and the diff
+  # was never reviewed.
+  assets:
+    name: Assets
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Setup Node
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: "22"
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Build assets
+        run: npm run build
+
+      - name: Check that dist is current
+        run: |
+          if [ -n "$(git status --porcelain -- resources/dist)" ]; then
+            echo "::error::resources/dist is out of date. Run 'npm run build' and commit the result."
+            git --no-pager diff --stat -- resources/dist
+            git status --porcelain -- resources/dist
+            exit 1
+          fi

.github/workflows/dependabot-auto-merge.yml

@@ -1,32 +1,59 @@
-name: "Dependabot Auto-Merge"
+# Copy to .github/workflows/dependabot-auto-merge.yml
+#
+# Auto-merges low-risk Dependabot PRs once CI has actually passed.
+#
+# IMPORTANT — this workflow only waits if something is blocking the PR. `--auto` means
+# "merge when the blockers clear", not "wait for CI". With no required status check
+# there is nothing to wait for, so `gh pr merge --auto` merges on arrival, seconds
+# after the PR opens. Both of these must be true for it to behave as intended:
+#
+#   1. the repo has "Allow auto-merge" enabled (Settings > General), and
+#   2. the active branch has a ruleset requiring the `ci / All Checks`
+#      status check.
+#
+# See docs/branch-protection.md. Until both are in place, prefer deleting this file
+# over shipping it — an ungated copy merges everything Dependabot sends.
+#
+# Scope is deliberately narrow:
+#   - GitHub Actions bumps — CI config only, so a bad one breaks CI, not consumers.
+#   - the `dev-dependencies` Composer group — test and lint tooling.
+#
+# `production-dependencies` is never auto-merged. These packages commit no
+# composer.lock, so a runtime bump rewrites the `require` constraint in composer.json,
+# which for a library is a published contract change: it narrows what consumers can
+# install. That is a review, not a merge. Majors are excluded from both ecosystems.
+
+name: Dependabot Auto-Merge
+
 on: pull_request_target
 
 permissions:
-  pull-requests: write
   contents: write
+  pull-requests: write
 
 jobs:
   dependabot:
-    runs-on: ubuntu-latest
+    name: Dependabot Auto-Merge
     if: ${{ github.actor == 'dependabot[bot]' }}
+    runs-on: ubuntu-latest
     steps:
-
-      - name: Dependabot metadata
+      # This workflow never checks out the PR branch, so `pull_request_target` does not
+      # expose the elevated token to contributor code.
+      - name: Fetch Dependabot metadata
         id: metadata
         uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0
         with:
-          github-token: "${{ secrets.GITHUB_TOKEN }}"
-
-      - name: Auto-merge Dependabot PRs for semver-minor updates
-        if: ${{steps.metadata.outputs.update-type == 'version-update:semver-minor'}}
-        run: gh pr merge --auto --merge "$PR_URL"
-        env:
-          PR_URL: ${{github.event.pull_request.html_url}}
-          GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
+          github-token: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Auto-merge Dependabot PRs for semver-patch updates
-        if: ${{steps.metadata.outputs.update-type == 'version-update:semver-patch'}}
+      # For a grouped PR, fetch-metadata reports the highest semver bump in the group,
+      # so a group containing a major is skipped as a whole rather than merged.
+      - name: Enable auto-merge
+        if: >-
+          (steps.metadata.outputs.update-type == 'version-update:semver-minor' ||
+           steps.metadata.outputs.update-type == 'version-update:semver-patch') &&
+          (steps.metadata.outputs.package-ecosystem == 'github_actions' ||
+           steps.metadata.outputs.dependency-group == 'dev-dependencies')
         run: gh pr merge --auto --merge "$PR_URL"
         env:
-          PR_URL: ${{github.event.pull_request.html_url}}
-          GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
+          PR_URL: ${{ github.event.pull_request.html_url }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}