From 809a43013264e66e5e9d3f52bb9f703284e7c39a Mon Sep 17 00:00:00 2001
From: merge-check <140916359+agentHits@users.noreply.github.com>
Date: Tue, 6 Oct 2026 15:43:43 -0400
Subject: [PATCH 1/2] ci: run PR checks on AgentHits-Dev and guard dependencies

- Run typecheck, tests and build for PRs into AgentHits-Dev, not only
  main/canary.
- Add a bun audit job (moderate and above). GHSA-vfj7-8cjw-p6xm is
  ignored: braces 3.0.3 has no patched release.
- bunfig.toml: minimumReleaseAge of 3 days for new resolutions.
  Frozen-lockfile installs are unaffected.
- Dependabot: weekly grouped minor/patch PRs against AgentHits-Dev with
  a 3-day cooldown; majors and deliberately held packages are ignored.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .github/dependabot.yml             | 27 +++++++++++++++++++++++++++
 .github/workflows/pull-request.yml | 14 +++++++++++++-
 bunfig.toml                        |  3 +++
 3 files changed, 43 insertions(+), 1 deletion(-)
 create mode 100644 .github/dependabot.yml
 create mode 100644 bunfig.toml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 00000000000..f6a603ae53c
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,27 @@
+version: 2
+updates:
+  - package-ecosystem: "bun"
+    directory: "/"
+    target-branch: "AgentHits-Dev"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    cooldown:
+      default-days: 3
+    open-pull-requests-limit: 5
+    groups:
+      minor-and-patch:
+        update-types: ["minor", "patch"]
+    ignore:
+      # Major bumps are done by hand, one PR each, after a check on dev.
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major"]
+      # Held back on purpose: these break typecheck, change API behavior or need migrations.
+      - dependency-name: "better-auth"
+        update-types: ["version-update:semver-minor"]
+      - dependency-name: "@better-auth/*"
+        update-types: ["version-update:semver-minor"]
+      - dependency-name: "stripe"
+      - dependency-name: "@stepperize/react"
+      - dependency-name: "@dokploy/trpc-openapi"
+      - dependency-name: "ssh2"
diff --git a/.github/workflows/pull-request.yml b/.github/workflows/pull-request.yml
index c4fca46456f..b29fe42a4d0 100644
--- a/.github/workflows/pull-request.yml
+++ b/.github/workflows/pull-request.yml
@@ -2,12 +2,24 @@ name: Pull Request
 
 on:
   pull_request:
-    branches: [main, canary]
+    branches: [main, canary, AgentHits-Dev]
 
 permissions:
   contents: read
 
 jobs:
+  audit:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: 1.4.2
+      # GHSA-vfj7-8cjw-p6xm: braces 3.0.3 (via micromatch) has no patched release yet.
+      - run: bun audit --audit-level=moderate --ignore GHSA-vfj7-8cjw-p6xm
+
   pr-check:
     runs-on: ubuntu-latest
     strategy:
diff --git a/bunfig.toml b/bunfig.toml
new file mode 100644
index 00000000000..b5d11bc61ef
--- /dev/null
+++ b/bunfig.toml
@@ -0,0 +1,3 @@
+[install]
+# Freshly published versions are where hijacked releases live; most get pulled within days.
+minimumReleaseAge = 259200

From 3050d7a249cf4bd6cc1459c85283de279086cba8 Mon Sep 17 00:00:00 2001
From: merge-check <140916359+agentHits@users.noreply.github.com>
Date: Tue, 6 Oct 2026 17:18:21 -0400
Subject: [PATCH 2/2] ci: give the PR build a placeholder postgres password and
 run matrix jobs independently

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .github/workflows/pull-request.yml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.github/workflows/pull-request.yml b/.github/workflows/pull-request.yml
index b29fe42a4d0..2a514b4046f 100644
--- a/.github/workflows/pull-request.yml
+++ b/.github/workflows/pull-request.yml
@@ -23,6 +23,7 @@ jobs:
   pr-check:
     runs-on: ubuntu-latest
     strategy:
+      fail-fast: false
       matrix:
         job: [build, test, typecheck]
     steps:
@@ -64,3 +65,6 @@ jobs:
       - run: bun install --frozen-lockfile
       - run: bun run server:build
       - run: bun run ${{ matrix.job }}
+        env:
+          # The fork's db module throws without a password in production, and the Next build imports it.
+          POSTGRES_PASSWORD: ${{ matrix.job == 'build' && 'build-time-postgres-password' || '' }}