studylife-cli 1.9.2__tar.gz → 1.9.4__tar.gz

{studylife_cli-1.9.2 → studylife_cli-1.9.4}/.github/workflows/ci.yml

@@ -10,6 +10,14 @@ concurrency:
   group: ci-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
+env:
+  # uv must never download an interpreter from python-build-standalone: that is an
+  # external fetch on every single run (it started returning 504 Gateway Timeout on
+  # 2026-09-14 and turned CI red at random). The runner's tool cache already ships the
+  # version below, resolved locally by actions/setup-python - and with downloads off a
+  # missing interpreter fails loudly instead of being pulled in over the network.
+  UV_PYTHON_DOWNLOADS: never
+
 # Least-privilege default for GITHUB_TOKEN (CodeQL actions/missing-workflow-permissions):
 # jobs that need more declare it themselves.
 permissions:
@@ -18,26 +26,40 @@ permissions:
 jobs:
   lint:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+        with:
+          egress-policy: audit
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+      - uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
         with:
           version: "0.5.8"
           cache-suffix: "lint"
-      - run: uv python install 3.12
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.12"
       - run: uv sync --frozen
       - run: uv run ruff check .
       - run: uv run ruff format --check .
 
   test:
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+        with:
+          egress-policy: audit
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+      - uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
         with:
           version: "0.5.8"
           cache-suffix: "test"
-      - run: uv python install 3.12
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.12"
       - run: uv sync --frozen
       - run: uv run pytest
 
@@ -50,12 +72,19 @@ jobs:
   # fixed budget per run, enough to catch a crash on the next code change.
   fuzz:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+        with:
+          egress-policy: audit
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+      - uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
         with:
           version: "0.5.8"
-      - run: uv python install 3.12
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.12"
       - run: uv sync --frozen --group fuzz
       - run: uv run python fuzz/fuzz_models_and_callback.py -max_total_time=30 -rss_limit_mb=1024
 
@@ -63,11 +92,16 @@ jobs:
     needs: [lint, test]
     if: (github.event_name == 'push' || github.event_name == 'workflow_dispatch')
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     permissions:
       contents: write
     outputs:
       published: ${{ steps.semrel.outputs.new_release_published }}
     steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+        with:
+          egress-policy: audit
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
@@ -99,14 +133,10 @@ jobs:
           git fetch origin main
           git checkout -B main origin/main
       - id: semrel
-        uses: cycjimmy/semantic-release-action@b12c8f6015dc215fe37bc154d4ad456dd3833c90 # v6.0.0
+        uses: lukislp/ci-workflows/.github/actions/semantic-release@045f17628d155f7e56c2f6ebdbd473b31e247112 # v1.6.0
         with:
-          dry_run: true
-          extra_plugins: |
-            @semantic-release/changelog@7.0.0
-            @semantic-release/git@11.0.1
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          dry-run: true
+          github-token: ${{ secrets.GITHUB_TOKEN }}
       - name: No release needed for this push
         if: steps.semrel.outputs.new_release_published != 'true'
         run: |
@@ -116,11 +146,16 @@ jobs:
     needs: [get-version]
     if: (github.event_name == 'push' || github.event_name == 'workflow_dispatch') && needs.get-version.outputs.published == 'true'
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     permissions:
       contents: write
       issues: write
       pull-requests: write
     steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+        with:
+          egress-policy: audit
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
@@ -148,13 +183,9 @@ jobs:
           git remote set-url origin "git@github.com:${{ github.repository }}.git"
           echo "GIT_SSH_COMMAND=ssh -i ~/.ssh/semantic_release -o IdentitiesOnly=yes" >> "$GITHUB_ENV"
       - id: semrel
-        uses: cycjimmy/semantic-release-action@b12c8f6015dc215fe37bc154d4ad456dd3833c90 # v6.0.0
+        uses: lukislp/ci-workflows/.github/actions/semantic-release@045f17628d155f7e56c2f6ebdbd473b31e247112 # v1.6.0
         with:
-          extra_plugins: |
-            @semantic-release/changelog@7.0.0
-            @semantic-release/git@11.0.1
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}
         continue-on-error: true
       - if: steps.semrel.outcome == 'failure'
         name: "Diagnose before retrying (expected: an out-of-band push landed since checkout)"
@@ -169,13 +200,9 @@ jobs:
           fi
           git checkout -B main origin/main
       - if: steps.semrel.outcome == 'failure'
-        uses: cycjimmy/semantic-release-action@b12c8f6015dc215fe37bc154d4ad456dd3833c90 # v6.0.0
+        uses: lukislp/ci-workflows/.github/actions/semantic-release@045f17628d155f7e56c2f6ebdbd473b31e247112 # v1.6.0
         with:
-          extra_plugins: |
-            @semantic-release/changelog@7.0.0
-            @semantic-release/git@11.0.1
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}
 
   # Runs after semantic-release so the checkout below lands on the freshly tagged commit -
   # hatch-vcs then resolves an exact version (e.g. "1.2.0"), not a "*.dev0+g<hash>" one, which
@@ -184,18 +211,25 @@ jobs:
     needs: [get-version, semantic-release]
     if: (github.event_name == 'push' || github.event_name == 'workflow_dispatch') && needs.get-version.outputs.published == 'true'
     runs-on: ubuntu-latest
+    timeout-minutes: 45
     environment: pypi
     permissions:
       id-token: write # trusted publishing (OIDC) - no PyPI token/secret needed
     steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+        with:
+          egress-policy: audit
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: main
           fetch-depth: 0 # full history + tags, so hatch-vcs can find the tag just created
-      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+      - uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
         with:
           version: "0.5.8"
           cache-suffix: "publish"
-      - run: uv python install 3.12
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.12"
       - run: uv build
       - uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # release/v1

studylife_cli-1.9.4/.github/workflows/dependabot-auto-merge.yml

@@ -0,0 +1,22 @@
+name: Dependabot auto-merge
+
+# Thin caller of the shared implementation in lukislp/ci-workflows (auto-merge of Dependabot
+# patch/minor updates, update-stale for every PR that is behind the tip) - the triggers stay
+# here because a reusable workflow cannot declare them for the caller. Needs the AUTOMERGE_TOKEN
+# repository secret (fine-grained PAT, contents + pull requests write).
+on:
+  pull_request_target:
+    types: [opened, synchronize, reopened, auto_merge_enabled]
+  schedule:
+    - cron: "23 * * * *"
+  push:
+    branches: [main]
+
+permissions:
+  pull-requests: read
+
+jobs:
+  dependabot:
+    uses: lukislp/ci-workflows/.github/workflows/dependabot-auto-merge.yml@045f17628d155f7e56c2f6ebdbd473b31e247112 # v1.6.0
+    secrets:
+      AUTOMERGE_TOKEN: ${{ secrets.AUTOMERGE_TOKEN }}

studylife_cli-1.9.4/.github/workflows/dependabot-lockfiles.yml

@@ -0,0 +1,20 @@
+name: Dependabot lock files
+
+# Thin caller of the shared implementation in lukislp/ci-workflows: regenerates the lock files
+# on Dependabot's own PRs with the CI tool versions and pushes them back onto the PR branch.
+# Plain pull_request on purpose (never pull_request_target); AUTOMERGE_TOKEN is stored as a
+# Dependabot secret, which only Dependabot-triggered runs can read.
+on:
+  pull_request:
+    types: [opened, synchronize, reopened]
+
+permissions:
+  contents: read
+
+jobs:
+  lockfiles:
+    uses: lukislp/ci-workflows/.github/workflows/dependabot-lockfiles.yml@045f17628d155f7e56c2f6ebdbd473b31e247112 # v1.6.0
+    with:
+      uv-version: "0.5.8"
+    secrets:
+      AUTOMERGE_TOKEN: ${{ secrets.AUTOMERGE_TOKEN }}

studylife_cli-1.9.4/.github/workflows/dependency-review.yml

@@ -0,0 +1,27 @@
+name: Dependency review
+
+# Thin caller of the shared implementation in lukislp/ci-workflows - the triggers stay here
+# because a reusable workflow cannot declare them for the caller. Compares the base and head
+# dependency graphs of a pull request and fails it when the PR introduces a dependency with a
+# known advisory, which Dependabot alerts would otherwise only report after the merge. The
+# check name in the branch ruleset is "review / dependency-review".
+on:
+  pull_request:
+    types: [opened, synchronize, reopened]
+
+# One run per PR: a newer push cancels the run it supersedes.
+concurrency:
+  group: dependency-review-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  review:
+    uses: lukislp/ci-workflows/.github/workflows/dependency-review.yml@045f17628d155f7e56c2f6ebdbd473b31e247112 # v1.6.0
+    # pull-requests: write is what the summary comment needs; the called workflow keeps
+    # contents at read.
+    permissions:
+      contents: read
+      pull-requests: write

{studylife_cli-1.9.2 → studylife_cli-1.9.4}/.github/workflows/scorecard.yml

@@ -16,6 +16,7 @@ permissions: read-all
 jobs:
   analysis:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     permissions:
       security-events: write
       id-token: write
@@ -28,6 +29,6 @@ jobs:
           results_file: results.sarif
           results_format: sarif
           publish_results: true
-      - uses: github/codeql-action/upload-sarif@faaca9a8f6edddba5725ffe5adefdab6669a2eca # v3.38.0
+      - uses: github/codeql-action/upload-sarif@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0
         with:
           sarif_file: results.sarif

{studylife_cli-1.9.2 → studylife_cli-1.9.4}/CHANGELOG.md

@@ -1,3 +1,17 @@
+## [1.9.4](https://github.com/lukislp/studylife-cli/compare/v1.9.3...v1.9.4) (2026-09-20)
+
+
+### Bug Fixes
+
+* **ci:** add Harden Runner in audit mode to every job ([#42](https://github.com/lukislp/studylife-cli/issues/42)) ([be13fec](https://github.com/lukislp/studylife-cli/commit/be13fec38dc3418643f6f5a8b05e288df2ebd34f))
+
+## [1.9.3](https://github.com/lukislp/studylife-cli/compare/v1.9.2...v1.9.3) (2026-09-17)
+
+
+### Bug Fixes
+
+* **ci:** bump astral-sh/setup-uv from 10.0.1 to 10.1.0 ([5248a13](https://github.com/lukislp/studylife-cli/commit/5248a133ecbaf6b9a1bb237432dd94e574de174e))
+
 ## [1.9.2](https://github.com/lukislp/studylife-cli/compare/v1.9.1...v1.9.2) (2026-09-12)
 
 

studylife_cli-1.9.4/CODE_OF_CONDUCT.md

@@ -0,0 +1,138 @@
+# Contributor Covenant Code of Conduct
+
+## Our Pledge
+
+We as members, contributors, and leaders pledge to make participation in our
+community a harassment-free experience for everyone, regardless of age, body
+size, visible or invisible disability, ethnicity, sex characteristics, gender
+identity and expression, level of experience, education, socio-economic status,
+nationality, personal appearance, race, caste, color, religion, or sexual
+identity and orientation.
+
+We pledge to act and interact in ways that contribute to an open, welcoming,
+diverse, inclusive, and healthy community.
+
+## Our Standards
+
+Examples of behavior that contributes to a positive environment for our
+community include:
+
+* Demonstrating empathy and kindness toward other people
+* Being respectful of differing opinions, viewpoints, and experiences
+* Giving and gracefully accepting constructive feedback
+* Accepting responsibility and apologizing to those affected by our mistakes,
+  and learning from the experience
+* Focusing on what is best not just for us as individuals, but for the overall
+  community
+
+Examples of unacceptable behavior include:
+
+* The use of sexualized language or imagery, and sexual attention or advances of
+  any kind
+* Trolling, insulting or derogatory comments, and personal or political attacks
+* Public or private harassment
+* Publishing others' private information, such as a physical or email address,
+  without their explicit permission
+* Other conduct which could reasonably be considered inappropriate in a
+  professional setting
+
+## Enforcement Responsibilities
+
+Community leaders are responsible for clarifying and enforcing our standards of
+acceptable behavior and will take appropriate and fair corrective action in
+response to any behavior that they deem inappropriate, threatening, offensive,
+or harmful.
+
+Community leaders have the right and responsibility to remove, edit, or reject
+comments, commits, code, wiki edits, issues, and other contributions that are
+not aligned to this Code of Conduct, and will communicate reasons for moderation
+decisions when appropriate.
+
+## Scope
+
+This Code of Conduct applies within all community spaces, and also applies when
+an individual is officially representing the community in public spaces.
+Examples of representing our community include using an official e-mail address,
+posting via an official social media account, or acting as an appointed
+representative at an online or offline event.
+
+## Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be
+reported to the community leaders responsible for enforcement at
+155678024+lukislp@users.noreply.github.com.
+All complaints will be reviewed and investigated promptly and fairly.
+
+All community leaders are obligated to respect the privacy and security of the
+reporter of any incident.
+
+## Enforcement Guidelines
+
+Community leaders will follow these Community Impact Guidelines in determining
+the consequences for any action they deem in violation of this Code of Conduct:
+
+### 1. Correction
+
+**Community Impact**: Use of inappropriate language or other behavior deemed
+unprofessional or unwelcome in the community.
+
+**Consequence**: A private, written warning from community leaders, providing
+clarity around the nature of the violation and an explanation of why the
+behavior was inappropriate. A public apology may be requested.
+
+### 2. Warning
+
+**Community Impact**: A violation through a single incident or series of
+actions.
+
+**Consequence**: A warning with consequences for continued behavior. No
+interaction with the people involved, including unsolicited interaction with
+those enforcing the Code of Conduct, for a specified period of time. This
+includes avoiding interactions in community spaces as well as external channels
+like social media. Violating these terms may lead to a temporary or permanent
+ban.
+
+### 3. Temporary Ban
+
+**Community Impact**: A serious violation of community standards, including
+sustained inappropriate behavior.
+
+**Consequence**: A temporary ban from any sort of interaction or public
+communication with the community for a specified period of time. No public or
+private interaction with the people involved, including unsolicited interaction
+with those enforcing the Code of Conduct, is allowed during this period.
+Violating these terms may lead to a permanent ban.
+
+### 4. Permanent Ban
+
+**Community Impact**: Demonstrating a pattern of violation of community
+standards, including sustained inappropriate behavior, harassment of an
+individual, or aggression toward or disparagement of classes of individuals.
+
+**Consequence**: A permanent ban from any sort of public interaction within the
+community.
+
+## Attribution
+
+This Code of Conduct is adapted from the [Contributor Covenant][homepage],
+version 2.1, available at
+[https://www.contributor-covenant.org/version/2/1/code_of_conduct.html][v2.1].
+
+Community Impact Guidelines were inspired by
+[Mozilla's code of conduct enforcement ladder][Mozilla CoC].
+
+For answers to common questions about this code of conduct, see the FAQ at
+[https://www.contributor-covenant.org/faq][FAQ]. Translations are available at
+[https://www.contributor-covenant.org/translations][translations].
+
+[homepage]: https://www.contributor-covenant.org
+[v2.1]: https://www.contributor-covenant.org/version/2/1/code_of_conduct.html
+[Mozilla CoC]: https://github.com/mozilla/diversity
+[FAQ]: https://www.contributor-covenant.org/faq
+[translations]: https://www.contributor-covenant.org/translations
+
+## Reporting a security issue
+
+This document covers conduct. A security vulnerability in the code is not a
+conduct matter - report it privately through the process described in
+[SECURITY.md](SECURITY.md) instead of opening a public issue.

studylife_cli-1.9.4/CONTRIBUTING.md

@@ -0,0 +1,65 @@
+# Contributing to StudyLife CLI
+
+Thanks for taking the time. StudyLife CLI is a single-maintainer project, so the process is
+deliberately small - but it is the same for every change, including the maintainer's own.
+
+## How changes get in
+
+1. Open an issue first for anything bigger than a typo or an obvious bug fix, so the direction can
+   be agreed before you spend time on it. Use the templates under `.github/ISSUE_TEMPLATE/`.
+2. Fork the repository (or branch, if you have write access) and make your change on a branch.
+3. Open a pull request against `main`. The pull-request template asks for what changed and why.
+4. `main` is protected: a PR merges only after the test stage of
+   [`.github/workflows/ci.yml`](.github/workflows/ci.yml) is green and the branch is up to date
+   with `main` (enable auto-merge and it lands on its own once that is the case). Nobody pushes to
+   `main` directly, not even the maintainer.
+
+## What a pull request needs
+
+- **Conventional Commits.** The version and the changelog are generated from the commit messages
+  (`feat:` = minor release, `fix:` = patch release, `build:`/`ci:`/`docs:`/`test:` = no release).
+  A released version is published to PyPI, so the commit type decides what users get.
+  Squash-merge keeps the PR title as the commit message, so give the PR a Conventional Commit
+  title.
+- **Green required checks.** `lint`, `test` and `review / dependency-review` are required; a red
+  one blocks the merge.
+- **Tests for new functionality.** New features and bug fixes come with tests in `tests/`
+  (`test_cli.py`, `test_client.py`, `test_login.py`, `test_tui.py`). A PR that adds behaviour
+  without a test is asked to add one.
+- **Lint and formatting.** The `lint` job runs `ruff check .` **and** `ruff format --check .`. Run
+  both before pushing; `ruff check` passing does not mean the formatting is clean.
+- **Lockfile.** CI installs with `uv sync --frozen`, so a dependency change means committing the
+  updated `uv.lock` alongside `pyproject.toml`.
+- **Command surface.** This is a user-facing CLI. A renamed command, flag or output format is a
+  breaking change for anyone scripting against it - call it out in the PR body so the release
+  notes carry it.
+
+## Running things locally
+
+Python 3.12 or newer, with [uv](https://docs.astral.sh/uv/).
+
+```bash
+uv sync
+uv run pytest
+uv run ruff check .
+uv run ruff format --check .
+```
+
+The fuzz target is Linux-only (`atheris` publishes no Windows wheel):
+
+```bash
+uv sync --frozen --group fuzz
+uv run python fuzz/fuzz_models_and_callback.py -max_total_time=30 -rss_limit_mb=1024
+```
+
+## Releases
+
+Merging a `feat:` or `fix:` to `main` cuts a release and publishes the built distributions to PyPI
+via trusted publishing. Users install with `pip install studylife-cli` or
+`pipx install studylife-cli`.
+
+## Security issues
+
+Please do not open a public issue for a vulnerability - use the private reporting path described
+in [SECURITY.md](SECURITY.md). The [Code of Conduct](CODE_OF_CONDUCT.md) applies to every
+interaction in this repository.

{studylife_cli-1.9.2 → studylife_cli-1.9.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: studylife-cli
-Version: 1.9.2
+Version: 1.9.4
 Summary: Command-line client for StudyLife (self-hosted study organizer) - notes, sessions, course goals, and webhooks from your terminal.
 License-File: LICENSE
 Requires-Python: >=3.12

studylife_cli-1.9.4/socket.yml

@@ -0,0 +1,8 @@
+version: 2
+
+githubApp:
+  enabled: true
+  dependencyOverviewEnabled: true
+  pullRequestAlertsEnabled: true
+  projectReportsEnabled: true
+  disableCommentsAndCheckRuns: false

{studylife_cli-1.9.2 → studylife_cli-1.9.4}/src/studylife_cli/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '1.9.2'
-__version_tuple__ = version_tuple = (1, 9, 2)
+__version__ = version = '1.9.4'
+__version_tuple__ = version_tuple = (1, 9, 4)
 
 __commit_id__ = commit_id = None

{studylife_cli-1.9.2 → studylife_cli-1.9.4}/uv.lock

@@ -405,7 +405,7 @@ wheels = [
 
 [[package]]
 name = "studylife-cli"
-version = "1.9.2.dev9+g1002804fa.d20260912"
+version = "1.9.3.dev83+g7ef281223.d20260917"
 source = { editable = "." }
 dependencies = [
     { name = "httpx" },

studylife_cli-1.9.2/.github/workflows/dependabot-auto-merge.yml

@@ -1,77 +0,0 @@
-name: Dependabot auto-merge
-
-# Merges Dependabot patch and minor updates once every required check is green; majors stay
-# manual. Runs on pull_request_target so the base branch's workflow definition and the repo
-# secrets apply (a Dependabot-triggered pull_request run gets neither). Merges with
-# AUTOMERGE_TOKEN, a fine-grained PAT (contents + pull requests: write): a merge performed with
-# GITHUB_TOKEN would never start the release workflow, because GitHub does not run workflows for
-# events caused by GITHUB_TOKEN. Deliberately no checkout - PR code is never executed here.
-on:
-  pull_request_target:
-    # auto_merge_enabled: a PR that is already behind when someone arms auto-merge would
-    # otherwise wait for the next push to be brought up to date.
-    types: [opened, synchronize, reopened, auto_merge_enabled]
-  # Safety net for a PR armed while behind when nothing else is pushed for a while.
-  schedule:
-    - cron: "23 * * * *"
-  # The default branch requires pull requests to be up to date before they merge (ruleset).
-  # Every push to it therefore leaves the open Dependabot PRs "behind"; the update-stale job
-  # below brings them back onto the tip so their auto-merge can proceed without a manual rebase.
-  push:
-    branches: [main]
-
-# GITHUB_TOKEN only reads PR metadata; the merge itself runs with AUTOMERGE_TOKEN (above).
-permissions:
-  pull-requests: read
-
-jobs:
-  auto-merge:
-    if: github.event_name == 'pull_request_target' && github.event.action != 'auto_merge_enabled' && github.actor == 'dependabot[bot]'
-    runs-on: ubuntu-latest
-    env:
-      HAS_TOKEN: ${{ secrets.AUTOMERGE_TOKEN != '' }}
-    steps:
-      - id: meta
-        uses: dependabot/fetch-metadata@21025c705c08248db411dc16f3619e6b5f9ea21a # v2.5.0
-        with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-      - if: env.HAS_TOKEN == 'true' && (steps.meta.outputs.update-type == 'version-update:semver-patch' || steps.meta.outputs.update-type == 'version-update:semver-minor')
-        env:
-          GH_TOKEN: ${{ secrets.AUTOMERGE_TOKEN }}
-        run: gh pr merge --auto --merge "${{ github.event.pull_request.html_url }}"
-      - if: env.HAS_TOKEN != 'true'
-        run: echo "AUTOMERGE_TOKEN is not set - leaving this PR for a manual merge"
-
-  update-stale:
-    if: github.event_name == 'push' || github.event_name == 'schedule' || github.event.action == 'auto_merge_enabled'
-    runs-on: ubuntu-latest
-    env:
-      HAS_TOKEN: ${{ secrets.AUTOMERGE_TOKEN != '' }}
-    steps:
-      - if: env.HAS_TOKEN == 'true'
-        env:
-          GH_TOKEN: ${{ secrets.AUTOMERGE_TOKEN }}
-          REPO: ${{ github.repository }}
-        # The default branch requires PRs to be up to date before they merge, so every push
-        # here leaves the other open PRs "behind". This brings them back onto the tip: every
-        # non-draft PR that has auto-merge enabled or was opened by a person (a Dependabot PR
-        # left for a manual decision, i.e. a major bump, is not rebuilt on every push - whoever
-        # merges it updates it). GitHub computes the merge state lazily after a push, so UNKNOWN
-        # is polled for a while; DIRTY (conflicts) cannot be updated automatically.
-        run: |
-          for n in $(gh pr list --repo "$REPO" --state open --json number --jq '.[].number'); do
-            info="$(gh pr view "$n" --repo "$REPO" --json isDraft,author,autoMergeRequest --jq '"\(.isDraft) \(.author.login) \(.autoMergeRequest != null)"')"
-            set -- $info
-            draft=$1; author=$2; auto=$3
-            [ "$draft" = "true" ] && continue
-            if [ "$auto" != "true" ] && [ "$author" = "app/dependabot" ]; then continue; fi
-            for attempt in 1 2 3 4 5 6; do
-              state="$(gh pr view "$n" --repo "$REPO" --json mergeStateStatus --jq .mergeStateStatus)"
-              [ "$state" != "UNKNOWN" ] && break
-              sleep 10
-            done
-            echo "#$n ($author, auto-merge=$auto): $state"
-            if [ "$state" = "BEHIND" ]; then
-              gh api -X PUT "repos/$REPO/pulls/$n/update-branch" >/dev/null && echo "  updated onto main" || echo "::warning::could not update #$n"
-            fi
-          done

studylife_cli-1.9.2/.github/workflows/dependabot-lockfiles.yml

@@ -1,80 +0,0 @@
-name: Dependabot lock files
-
-# Dependabot regenerates the lock file of the project whose manifest it bumped, but not the
-# lock files of the projects that depend on it (NuGet records a reference's dependencies in
-# the referencing project's packages.lock.json) - and its uv lock output has shipped unparsable
-# files. Locked-mode restores then fail on the PR. This job runs on Dependabot's own PRs,
-# regenerates every lock file with the same tool versions CI uses and pushes the result back
-# onto the PR branch, after which the normal CI run and the auto-merge proceed.
-#
-# Deliberately a plain pull_request run (no pull_request_target): the PR's own restore runs in
-# the untrusted context with a read-only GITHUB_TOKEN, and the only credential involved - the
-# push token - is a Dependabot secret, which GitHub exposes solely to runs Dependabot triggered
-# and only to the single step that pushes. Nothing from the PR ever sees it.
-on:
-  pull_request:
-    types: [opened, synchronize, reopened]
-
-permissions:
-  contents: read
-
-jobs:
-  refresh:
-    if: github.actor == 'dependabot[bot]'
-    runs-on: ubuntu-latest
-    env:
-      HAS_TOKEN: ${{ secrets.AUTOMERGE_TOKEN != '' }}
-      HEAD_REF: ${{ github.head_ref }}
-    steps:
-      - if: env.HAS_TOKEN != 'true'
-        run: echo "AUTOMERGE_TOKEN is not set as a Dependabot secret - lock files are not refreshed automatically"
-      - if: env.HAS_TOKEN == 'true'
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          ref: ${{ github.head_ref }}
-          # Full history so the base branch's uv.lock is available locally (private repos
-          # cannot be fetched anonymously later, and the push token stays out of this step).
-          fetch-depth: 0
-          persist-credentials: false
-      - if: env.HAS_TOKEN == 'true' && hashFiles('**/packages.lock.json') != ''
-        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
-        with:
-          dotnet-version: "10.0.x"
-      - if: env.HAS_TOKEN == 'true' && hashFiles('**/packages.lock.json') != ''
-        name: Regenerate every packages.lock.json
-        run: |
-          set -eu
-          for lock in $(git ls-files '**/packages.lock.json' 'packages.lock.json'); do
-            proj="$(ls "$(dirname "$lock")"/*.csproj | head -1)"
-            echo "restoring $proj"
-            dotnet restore "$proj" --force-evaluate -p:RestoreLockedMode=false
-          done
-      - if: env.HAS_TOKEN == 'true' && hashFiles('uv.lock') != ''
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
-        with:
-          version: "0.5.8"
-      - if: env.HAS_TOKEN == 'true' && hashFiles('uv.lock') != ''
-        name: Regenerate uv.lock
-        env:
-          BASE_REF: ${{ github.base_ref }}
-        run: |
-          # Dependabot's own uv.lock output has been unparsable, and `uv lock` refuses to start
-          # from a broken file - so resolve from the base branch's lock plus the PR's pyproject.
-          git show "origin/$BASE_REF:uv.lock" > uv.lock
-          uv python install 3.12
-          uv lock
-      - if: env.HAS_TOKEN == 'true'
-        name: Push the refreshed lock files back onto the PR
-        env:
-          PUSH_TOKEN: ${{ secrets.AUTOMERGE_TOKEN }}
-        run: |
-          # Only tracked files change here (the lock files); untracked build output stays out.
-          git add -u
-          if git diff --cached --quiet; then
-            echo "lock files already consistent"
-            exit 0
-          fi
-          git config user.name "lukislp"
-          git config user.email "koerber.lukas@t-online.de"
-          git commit -m "chore(deps): refresh the lock files after the Dependabot update"
-          git push "https://x-access-token:${PUSH_TOKEN}@github.com/${GITHUB_REPOSITORY}.git" "HEAD:refs/heads/${HEAD_REF}"