fix(ci): group dependabot updates and harden release workflow

Group Dependabot version updates by ecosystem so related bumps land in one PR: github-actions and devcontainers each group all patterns, while npm groups non-breaking (minor and patch) updates and keeps the existing pnpm release cooldown. Pin the weekly schedule explicitly to monday across all three ecosystems.

Move the release-please config and manifest into .github (dropping the leading dot from the manifest) and point the action at them via config-file and manifest-file. Add a reattribute job that rewrites the release-PR commit author to github-actions[bot] since the action commits as the PAT owner, and mark it continue-on-error because the PR branch may already be deleted when it runs. Switch the release-please and dependabot auto-merge approval tokens to the GH_PAT so the bot can trigger workflows and its approval counts, and skip the greetings job for dependabot[bot].

Relocate CODEOWNERS into .github and add the Dependabot-managed paths (package manifest, workflows, devcontainer) co-owned by @iwf-web/ci so the bot's auto-approval satisfies the code-owner requirement. Add a devcontainer-lock.json pinning feature digests. Align the AGENTS.md intro wording and note that CLAUDE.md imports it via @AGENTS.md. Extend the LICENSE copyright to 2025-2026, add the Keep a Changelog header, and bump the pinned pnpm to 11.9.0.

Author: D3strukt0r

.devcontainer/devcontainer-lock.json

@@ -0,0 +1,29 @@
+{
+  "features": {
+    "ghcr.io/devcontainers-extra/features/act:1": {
+      "version": "1.0.15",
+      "resolved": "ghcr.io/devcontainers-extra/features/act@sha256:db4a2194930d1f7ec62822d4f600dd2fa4aff3c33b98cdb0b578b64ffb10924c",
+      "integrity": "sha256:db4a2194930d1f7ec62822d4f600dd2fa4aff3c33b98cdb0b578b64ffb10924c"
+    },
+    "ghcr.io/devcontainers/features/common-utils:2": {
+      "version": "2.5.9",
+      "resolved": "ghcr.io/devcontainers/features/common-utils@sha256:cb0c4d3c276f157eed17935747e364178d75fee17f55c4e129966f64633deb3a",
+      "integrity": "sha256:cb0c4d3c276f157eed17935747e364178d75fee17f55c4e129966f64633deb3a"
+    },
+    "ghcr.io/devcontainers/features/docker-outside-of-docker:1": {
+      "version": "1.10.0",
+      "resolved": "ghcr.io/devcontainers/features/docker-outside-of-docker@sha256:c2c2cf829505ead8e4892c88c31b6594ae94a2bbb209e16e1fac456c1a3a624e",
+      "integrity": "sha256:c2c2cf829505ead8e4892c88c31b6594ae94a2bbb209e16e1fac456c1a3a624e"
+    },
+    "ghcr.io/devcontainers/features/github-cli:1": {
+      "version": "1.1.0",
+      "resolved": "ghcr.io/devcontainers/features/github-cli@sha256:d22f50b70ed75339b4eed1ba9ecde3a1791f90e88d37936517e3bace0bbad671",
+      "integrity": "sha256:d22f50b70ed75339b4eed1ba9ecde3a1791f90e88d37936517e3bace0bbad671"
+    },
+    "ghcr.io/devcontainers/features/node:2": {
+      "version": "2.1.0",
+      "resolved": "ghcr.io/devcontainers/features/node@sha256:586c9a6f7dd40bd3ba2cd41e7f2f88dcc31fbe5d1442afcbf07ffbc66b686857",
+      "integrity": "sha256:586c9a6f7dd40bd3ba2cd41e7f2f88dcc31fbe5d1442afcbf07ffbc66b686857"
+    }
+  }
+}

.github/CODEOWNERS

@@ -0,0 +1,14 @@
+# https://docs.github.com/en/github/creating-cloning-and-archiving-repositories/about-code-owners
+# Last matching pattern wins. Only ONE listed owner needs to approve, not all.
+
+# Default owner for everything.
+* @D3strukt0r
+
+# Files Dependabot manages — @iwf-web/CI (incl. the bot user) can also review,
+# so the bot's auto-approval satisfies the code-owner requirement on these paths.
+# npm
+/package.json @D3strukt0r @iwf-web/CI
+# github-actions
+/.github/workflows/ @D3strukt0r @iwf-web/CI
+# devcontainers
+/.devcontainer/ @D3strukt0r @iwf-web/CI

.github/dependabot.yml

@@ -13,9 +13,14 @@ updates:
     labels:
       - "dependabot :robot:"
     schedule:
-      interval: weekly # on monday
+      interval: weekly
+      day: monday
       time: '09:30'
       timezone: Europe/Zurich
+    groups:
+      github-actions:
+        patterns:
+          - "*"
 
   - package-ecosystem: devcontainers
     directory: /
@@ -24,8 +29,13 @@ updates:
       - "dependabot :robot:"
     schedule:
       interval: weekly
+      day: monday
       time: '09:30'
       timezone: Europe/Zurich
+    groups:
+      devcontainers:
+        patterns:
+          - "*"
 
   - package-ecosystem: npm # pnpm
     directory: /
@@ -34,7 +44,13 @@ updates:
       - "dependabot :robot:"
     schedule:
       interval: weekly
+      day: monday
       time: '09:30'
       timezone: Europe/Zurich
     cooldown:
       default-days: 1 # Match pnpm 11 default minimumReleaseAge (1440 min = 1 day)
+    groups:
+      npm-non-breaking:
+        update-types:
+          - minor
+          - patch

release-please-config.json .github/release-please-config.jsonrelease-please-config.json renamed to .github/release-please-config.json

@@ -29,7 +29,7 @@ jobs:
         if: steps.metadata.outputs.update-type == 'version-update:semver-minor' || steps.metadata.outputs.update-type == 'version-update:semver-patch'
         env:
           PR_URL: ${{ github.event.pull_request.html_url }}
-          GITHUB_TOKEN: ${{ github.token }}
+          GITHUB_TOKEN: ${{ secrets.GH_PAT }}
         run: |
           gh pr checkout "$PR_URL" # sets the upstream metadata for `gh pr status`
           if [ "$(gh pr status --json reviewDecision -q .currentBranch.reviewDecision)" != "APPROVED" ]; then

.release-please-manifest.json .github/release-please-manifest.json.release-please-manifest.json renamed to .github/release-please-manifest.json

@@ -16,6 +16,7 @@ jobs:
   greeting:
     name: Greet First-Time Contributors
     runs-on: ubuntu-latest
+    if: github.actor != 'dependabot[bot]'
 
     steps:
       - name: Greet First-Time Contributors

.github/workflows/dependabot-automerge.yml

@@ -14,10 +14,60 @@ jobs:
       pull-requests: write
     outputs:
       release_created: ${{ steps.release.outputs.release_created }}
+      # Non-empty JSON when release-please created or updated a release PR
+      # this run. Used by `reattribute` below to decide whether to amend.
+      pr: ${{ steps.release.outputs.pr }}
     steps:
       - name: Create Release PR
-        uses: googleapis/release-please-action@v5
         id: release
+        uses: googleapis/release-please-action@v5
+        with:
+          config-file: .github/release-please-config.json
+          manifest-file: .github/release-please-manifest.json
+          # Bot PAT with access to Workflows
+          # The built-in GITHUB_TOKEN has cannot trigger other workflows
+          token: ${{ secrets.GH_PAT }}
+
+  # release-please-action commits the release PR's contents as the PAT
+  # owner (the action has no input to override the commit author). Re-attribute
+  # to github-actions[bot] so the PR shows the bot as author instead of the
+  # person the PAT belongs to.
+  reattribute:
+    needs: release-please
+    if: ${{ needs.release-please.outputs.pr != '' }}
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    # Cosmetic best-effort: rewrites the release-PR commit author to the bot. If
+    # the release PR is merged before this runs, its branch is deleted and the
+    # checkout below can't fetch it — don't fail the release workflow over that.
+    continue-on-error: true
+    env:
+      # release-please's branch name varies by config (`release-please--branches--<base>`
+      # for single-package, with extra `--components--<name>` segments for component mode).
+      # The action emits the PR object as JSON — pull `headBranchName` from it instead of
+      # guessing the pattern.
+      PR_BRANCH: ${{ fromJSON(needs.release-please.outputs.pr).headBranchName }}
+    steps:
+      - name: Checkout release-please branch
+        uses: actions/checkout@v7
+        with:
+          token: ${{ secrets.GH_PAT }}
+          ref: ${{ env.PR_BRANCH }}
+          fetch-depth: 2
+
+      - name: Configure git
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+
+      - name: Amend release commit as github-actions[bot]
+        run: |
+          set -euo pipefail
+          # --reset-author rewrites both author and committer to the configured
+          # identity; --no-edit keeps the existing commit message verbatim.
+          git commit --amend --reset-author --no-edit
+          git push origin "$PR_BRANCH" --force-with-lease
 
   publish:
     needs: release-please

.github/workflows/greetings.yml

@@ -1,6 +1,6 @@
 # AGENTS.md
 
-This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
+This file provides guidance to coding agents (Claude Code, etc.) when working with code in this repository. `CLAUDE.md` simply imports this file via `@AGENTS.md`.
 
 ## Project Overview
 

.github/workflows/release.yml

@@ -1,5 +1,10 @@
 # Changelog
 
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
 ## [1.1.0](https://github.com/iwf-web/eslint-coding-standard/compare/1.0.0...1.1.0) (2026-03-25)