create-meith 0.23.3 → 0.24.0

package/dist/bin.mjs

@@ -323,6 +323,7 @@ function envExample(name, target) {
 }
 var SELF_HOST_DEPLOY_KIT = [
   ".dockerignore",
+  ".github/dependabot.yml",
   ".github/workflows/build.yml",
   "Dockerfile",
   "docker-compose.yaml",
@@ -511,6 +512,23 @@ export function installedPluginDefinitions() {
 .env*.local
 *.log
 .DS_Store
+`
+  );
+  files.set(
+    ".github/dependabot.yml",
+    `# Keeps this board's GitHub Actions current: one weekly pull request that
+# bumps the actions pinned in .github/workflows. Upgrading Meith itself is
+# separate and deliberate \u2014 see README.md, "Upgrading" \u2014 because the board's
+# \`next\` pin has to move together with \`@meith/web\` rather than on its own.
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      actions:
+        patterns: ['*']
 `
   );
   files.set(
@@ -960,6 +978,13 @@ while everything reading \`package.json\` sees the other. Reading the version
 out of the freshly installed \`@meith/web\` is what keeps the two the same
 without anybody having to know the number.
 
+This upgrade is deliberate and manual for that reason: \`next\` and
+\`@meith/web\` move together or not at all. What *is* kept current for you is
+this repository's own GitHub Actions \u2014 \`.github/dependabot.yml\` opens a
+weekly pull request bumping the actions pinned in
+\`.github/workflows/build.yml\`, which is a safe, independent update the two
+commands above never touch.
+
 That \`package.json\` change is the whole pin: \`Dockerfile\`'s own
 \`FROM\` line takes the version as a build argument, and
 \`.github/workflows/build.yml\` reads it straight out of \`package.json\`'s
@@ -1865,7 +1890,7 @@ async function run(argv, version) {
 }
 
 // src/bin.ts
-var result = await run(process.argv.slice(2), "0.23.3");
+var result = await run(process.argv.slice(2), "0.24.0");
 for (const line of result.lines) {
   if (result.code === 0) console.log(line);
   else console.error(line);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-meith",
-  "version": "0.23.3",
+  "version": "0.24.0",
   "description": "Scaffold a Meith board, plugin or theme — npx create-meith <name> writes a deployable board workspace; --plugin and --theme write extension workspaces built on the published kits.",
   "license": "MIT",
   "repository": {

package/src/bin.ts

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { run } from './cli'
 
-const result = await run(process.argv.slice(2), '0.23.3')
+const result = await run(process.argv.slice(2), '0.24.0')
 for (const line of result.lines) {
   if (result.code === 0) console.log(line)
   else console.error(line)

package/src/scaffold.ts

@@ -350,6 +350,7 @@ function envExample(name: string, target: ScaffoldTarget): string {
 
 const SELF_HOST_DEPLOY_KIT = [
   '.dockerignore',
+  '.github/dependabot.yml',
   '.github/workflows/build.yml',
   'Dockerfile',
   'docker-compose.yaml',
@@ -552,6 +553,24 @@ export function installedPluginDefinitions() {
 `,
   )
 
+  files.set(
+    '.github/dependabot.yml',
+    `# Keeps this board's GitHub Actions current: one weekly pull request that
+# bumps the actions pinned in .github/workflows. Upgrading Meith itself is
+# separate and deliberate — see README.md, "Upgrading" — because the board's
+# \`next\` pin has to move together with \`@meith/web\` rather than on its own.
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      actions:
+        patterns: ['*']
+`,
+  )
+
   files.set(
     'Dockerfile',
     `# syntax=docker/dockerfile:1.7-labs
@@ -1005,6 +1024,13 @@ while everything reading \`package.json\` sees the other. Reading the version
 out of the freshly installed \`@meith/web\` is what keeps the two the same
 without anybody having to know the number.
 
+This upgrade is deliberate and manual for that reason: \`next\` and
+\`@meith/web\` move together or not at all. What *is* kept current for you is
+this repository's own GitHub Actions — \`.github/dependabot.yml\` opens a
+weekly pull request bumping the actions pinned in
+\`.github/workflows/build.yml\`, which is a safe, independent update the two
+commands above never touch.
+
 That \`package.json\` change is the whole pin: \`Dockerfile\`'s own
 \`FROM\` line takes the version as a build argument, and
 \`.github/workflows/build.yml\` reads it straight out of \`package.json\`'s