From efe68bb72000cf25ddfc6e7358414050d596a376 Mon Sep 17 00:00:00 2001
From: Typogalaxy <136544101+Typogalaxy@users.noreply.github.com>
Date: Wed, 13 May 2026 12:26:43 +1000
Subject: [PATCH 1/8] Pin uv project dependencies exactly

---
 .github/dependabot.yml           |  2 +-
 apps/backend/pyproject.toml      | 29 ++++++++++++++++-------------
 apps/backend/uv.lock             | 26 +++++++++++++-------------
 docs/alienmark/pyproject.toml    |  9 ++++++---
 docs/alienmark/uv.lock           |  6 +++---
 docs/contributors/pyproject.toml |  9 ++++++---
 docs/contributors/uv.lock        |  6 +++---
 docs/users/pyproject.toml        |  9 ++++++---
 docs/users/uv.lock               |  6 +++---
 9 files changed, 57 insertions(+), 45 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 61b164e2..a02a1ccb 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -15,7 +15,7 @@ updates:
         patterns:
           - "*"
 
-  - package-ecosystem: "pip"
+  - package-ecosystem: "uv"
     directories:
       - "/apps/backend"
       - "/docs/users"
diff --git a/apps/backend/pyproject.toml b/apps/backend/pyproject.toml
index ceccd39c..9217bef1 100644
--- a/apps/backend/pyproject.toml
+++ b/apps/backend/pyproject.toml
@@ -3,22 +3,25 @@ name = "alien-commons-backend"
 version = "0.2.0"
 requires-python = ">=3.14"
 dependencies = [
-    "channels[daphne]>=4.3.2",
+    "channels[daphne]==4.3.2",
     "django==6.0.5",
-    "django-cors-headers>=4.9.0",
-    "django-filter>=25.2",
-    "django-redis>=6.0.0",
-    "django-storages[s3]>=1.14.6",
-    "django-tasks-rq>=0.12.0",
-    "djangorestframework>=3.17.1",
-    "environs>=15.0.1",
-    "pillow>=12.2.0",
-    "psycopg[binary]>=3.3.2",
-    "requests>=2.33.1",
-    "user-agents>=2.2.0",
+    "django-cors-headers==4.9.0",
+    "django-filter==25.2",
+    "django-redis==6.0.0",
+    "django-storages[s3]==1.14.6",
+    "django-tasks-rq==0.12.0",
+    "djangorestframework==3.17.1",
+    "environs==15.0.1",
+    "pillow==12.2.0",
+    "psycopg[binary]==3.3.4",
+    "requests==2.33.1",
+    "user-agents==2.2.0",
 ]
 
 [dependency-groups]
 dev = [
-    "ruff>=0.15.11",
+    "ruff==0.15.11",
 ]
+
+[tool.uv]
+add-bounds = "exact"
diff --git a/apps/backend/uv.lock b/apps/backend/uv.lock
index bddcc300..5af7b505 100644
--- a/apps/backend/uv.lock
+++ b/apps/backend/uv.lock
@@ -29,23 +29,23 @@ dev = [
 
 [package.metadata]
 requires-dist = [
-    { name = "channels", extras = ["daphne"], specifier = ">=4.3.2" },
+    { name = "channels", extras = ["daphne"], specifier = "==4.3.2" },
     { name = "django", specifier = "==6.0.5" },
-    { name = "django-cors-headers", specifier = ">=4.9.0" },
-    { name = "django-filter", specifier = ">=25.2" },
-    { name = "django-redis", specifier = ">=6.0.0" },
-    { name = "django-storages", extras = ["s3"], specifier = ">=1.14.6" },
-    { name = "django-tasks-rq", specifier = ">=0.12.0" },
-    { name = "djangorestframework", specifier = ">=3.17.1" },
-    { name = "environs", specifier = ">=15.0.1" },
-    { name = "pillow", specifier = ">=12.2.0" },
-    { name = "psycopg", extras = ["binary"], specifier = ">=3.3.2" },
-    { name = "requests", specifier = ">=2.33.1" },
-    { name = "user-agents", specifier = ">=2.2.0" },
+    { name = "django-cors-headers", specifier = "==4.9.0" },
+    { name = "django-filter", specifier = "==25.2" },
+    { name = "django-redis", specifier = "==6.0.0" },
+    { name = "django-storages", extras = ["s3"], specifier = "==1.14.6" },
+    { name = "django-tasks-rq", specifier = "==0.12.0" },
+    { name = "djangorestframework", specifier = "==3.17.1" },
+    { name = "environs", specifier = "==15.0.1" },
+    { name = "pillow", specifier = "==12.2.0" },
+    { name = "psycopg", extras = ["binary"], specifier = "==3.3.4" },
+    { name = "requests", specifier = "==2.33.1" },
+    { name = "user-agents", specifier = "==2.2.0" },
 ]
 
 [package.metadata.requires-dev]
-dev = [{ name = "ruff", specifier = ">=0.15.11" }]
+dev = [{ name = "ruff", specifier = "==0.15.11" }]
 
 [[package]]
 name = "asgiref"
diff --git a/docs/alienmark/pyproject.toml b/docs/alienmark/pyproject.toml
index a6e4e7a4..fc85882c 100644
--- a/docs/alienmark/pyproject.toml
+++ b/docs/alienmark/pyproject.toml
@@ -3,7 +3,10 @@ name = "alienmark-docs"
 version = "0.1.0"
 requires-python = ">=3.14"
 dependencies = [
-    "mkdocs>=1.6.1",
-    "mkdocs-material>=9.7.6",
-    "mkdocs-static-i18n>=1.3.1",
+    "mkdocs==1.6.1",
+    "mkdocs-material==9.7.6",
+    "mkdocs-static-i18n==1.3.1",
 ]
+
+[tool.uv]
+add-bounds = "exact"
diff --git a/docs/alienmark/uv.lock b/docs/alienmark/uv.lock
index 799c9278..91e88685 100644
--- a/docs/alienmark/uv.lock
+++ b/docs/alienmark/uv.lock
@@ -14,9 +14,9 @@ dependencies = [
 
 [package.metadata]
 requires-dist = [
-    { name = "mkdocs", specifier = ">=1.6.1" },
-    { name = "mkdocs-material", specifier = ">=9.7.6" },
-    { name = "mkdocs-static-i18n", specifier = ">=1.3.1" },
+    { name = "mkdocs", specifier = "==1.6.1" },
+    { name = "mkdocs-material", specifier = "==9.7.6" },
+    { name = "mkdocs-static-i18n", specifier = "==1.3.1" },
 ]
 
 [[package]]
diff --git a/docs/contributors/pyproject.toml b/docs/contributors/pyproject.toml
index da6b3a91..42994585 100644
--- a/docs/contributors/pyproject.toml
+++ b/docs/contributors/pyproject.toml
@@ -3,7 +3,10 @@ name = "alien-commons-contributor-docs"
 version = "0.0.1"
 requires-python = ">=3.14"
 dependencies = [
-    "mkdocs>=1.6.1",
-    "mkdocs-material>=9.7.6",
-    "mkdocs-static-i18n>=1.3.1",
+    "mkdocs==1.6.1",
+    "mkdocs-material==9.7.6",
+    "mkdocs-static-i18n==1.3.1",
 ]
+
+[tool.uv]
+add-bounds = "exact"
diff --git a/docs/contributors/uv.lock b/docs/contributors/uv.lock
index e744aa5d..e6b5f42f 100644
--- a/docs/contributors/uv.lock
+++ b/docs/contributors/uv.lock
@@ -14,9 +14,9 @@ dependencies = [
 
 [package.metadata]
 requires-dist = [
-    { name = "mkdocs", specifier = ">=1.6.1" },
-    { name = "mkdocs-material", specifier = ">=9.7.6" },
-    { name = "mkdocs-static-i18n", specifier = ">=1.3.1" },
+    { name = "mkdocs", specifier = "==1.6.1" },
+    { name = "mkdocs-material", specifier = "==9.7.6" },
+    { name = "mkdocs-static-i18n", specifier = "==1.3.1" },
 ]
 
 [[package]]
diff --git a/docs/users/pyproject.toml b/docs/users/pyproject.toml
index 95a172db..3c80441a 100644
--- a/docs/users/pyproject.toml
+++ b/docs/users/pyproject.toml
@@ -3,7 +3,10 @@ name = "alien-commons-user-guide"
 version = "0.1.0"
 requires-python = ">=3.14"
 dependencies = [
-    "mkdocs>=1.6.1",
-    "mkdocs-material>=9.7.6",
-    "mkdocs-static-i18n>=1.3.1",
+    "mkdocs==1.6.1",
+    "mkdocs-material==9.7.6",
+    "mkdocs-static-i18n==1.3.1",
 ]
+
+[tool.uv]
+add-bounds = "exact"
diff --git a/docs/users/uv.lock b/docs/users/uv.lock
index 28980e66..363c9fd0 100644
--- a/docs/users/uv.lock
+++ b/docs/users/uv.lock
@@ -14,9 +14,9 @@ dependencies = [
 
 [package.metadata]
 requires-dist = [
-    { name = "mkdocs", specifier = ">=1.6.1" },
-    { name = "mkdocs-material", specifier = ">=9.7.6" },
-    { name = "mkdocs-static-i18n", specifier = ">=1.3.1" },
+    { name = "mkdocs", specifier = "==1.6.1" },
+    { name = "mkdocs-material", specifier = "==9.7.6" },
+    { name = "mkdocs-static-i18n", specifier = "==1.3.1" },
 ]
 
 [[package]]

From f76a5453cfc88270e46283f1c57b747d05b9d755 Mon Sep 17 00:00:00 2001
From: Typogalaxy <136544101+Typogalaxy@users.noreply.github.com>
Date: Wed, 13 May 2026 12:37:12 +1000
Subject: [PATCH 2/8] chore: add chore to labeler.yml

---
 .github/labeler.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/labeler.yml b/.github/labeler.yml
index ff3421d1..def2a961 100644
--- a/.github/labeler.yml
+++ b/.github/labeler.yml
@@ -36,5 +36,8 @@ feature:
 refactor:
  - head-branch: ['^refactor', 'refactor']
 
+chore:
+ - head-branch: ['^chore', 'chore']
+
 release:
  - base-branch: 'main'

From 451603559ba0d66e8b4c2fda187eb9523f4874d3 Mon Sep 17 00:00:00 2001
From: Typogalaxy <136544101+Typogalaxy@users.noreply.github.com>
Date: Wed, 13 May 2026 16:13:58 +1000
Subject: [PATCH 3/8] chore: consolidate validation workflows into CI

---
 .github/workflows/alienmark-ci.yml  |  50 ------
 .github/workflows/backend-lint.yml  |  52 ------
 .github/workflows/backend-tests.yml |  42 -----
 .github/workflows/ci.yml            | 262 ++++++++++++++++++++++++++++
 .github/workflows/docs-validate.yml | 130 --------------
 5 files changed, 262 insertions(+), 274 deletions(-)
 delete mode 100644 .github/workflows/alienmark-ci.yml
 delete mode 100644 .github/workflows/backend-lint.yml
 delete mode 100644 .github/workflows/backend-tests.yml
 create mode 100644 .github/workflows/ci.yml
 delete mode 100644 .github/workflows/docs-validate.yml

diff --git a/.github/workflows/alienmark-ci.yml b/.github/workflows/alienmark-ci.yml
deleted file mode 100644
index 68a2e977..00000000
--- a/.github/workflows/alienmark-ci.yml
+++ /dev/null
@@ -1,50 +0,0 @@
-name: "AlienMark: CI"
-
-on:
-  pull_request:
-    paths:
-      - "packages/alienmark/**"
-      - "apps/frontend/package.json"
-      - "package.json"
-      - "pnpm-lock.yaml"
-      - "pnpm-workspace.yaml"
-      - "make/node.mk"
-      - ".github/workflows/alienmark-ci.yml"
-
-permissions:
-  contents: read
-
-jobs:
-  alienmark:
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v6
-
-      - name: Set up pnpm
-        uses: pnpm/action-setup@v6
-        with:
-          run_install: false
-
-      - name: Set up Node.js
-        uses: actions/setup-node@v6
-        with:
-          node-version: "24"
-          cache: "pnpm"
-          cache-dependency-path: pnpm-lock.yaml
-
-      - name: Enable Corepack
-        run: corepack enable
-
-      - name: Install workspace dependencies
-        run: pnpm install --frozen-lockfile
-
-      - name: Run Alienmark type check
-        run: pnpm --filter alienmark check
-
-      - name: Run Alienmark tests
-        run: pnpm --filter alienmark test
-
-      - name: Build Alienmark
-        run: pnpm --filter alienmark build
diff --git a/.github/workflows/backend-lint.yml b/.github/workflows/backend-lint.yml
deleted file mode 100644
index db38c1c4..00000000
--- a/.github/workflows/backend-lint.yml
+++ /dev/null
@@ -1,52 +0,0 @@
-name: "Backend: Lint"
-
-on:
-  pull_request:
-    paths:
-      - "apps/backend/**"
-      - ".github/workflows/backend-lint.yml"
-
-permissions:
-  contents: read
-
-jobs:
-  lint:
-    runs-on: ubuntu-latest
-
-    defaults:
-      run:
-        working-directory: apps/backend
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v6
-
-      - name: Set up Python
-        uses: actions/setup-python@v6
-        with:
-          python-version: "3.14"
-
-      - name: Install uv
-        uses: astral-sh/setup-uv@v7
-        with:
-          enable-cache: true
-          working-directory: apps/backend
-          cache-suffix: backend-lint
-
-      - name: Install lint dependencies
-        run: uv sync --locked --dev
-
-      - name: Run Ruff
-        run: >
-          uv run ruff check
-          articles
-          bookmarks
-          comments
-          backend
-          core
-          logs
-          reactions
-          reports
-          tasks
-          users
-          manage.py
diff --git a/.github/workflows/backend-tests.yml b/.github/workflows/backend-tests.yml
deleted file mode 100644
index 79d4c64b..00000000
--- a/.github/workflows/backend-tests.yml
+++ /dev/null
@@ -1,42 +0,0 @@
-name: "Backend: Tests"
-
-on:
-  pull_request:
-    paths:
-      - "apps/backend/**"
-      - ".github/workflows/backend-tests.yml"
-
-permissions:
-  contents: read
-
-jobs:
-  test:
-    runs-on: ubuntu-latest
-
-    defaults:
-      run:
-        working-directory: apps/backend
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v6
-
-      - name: Set up Python
-        uses: actions/setup-python@v6
-        with:
-          python-version: "3.14"
-
-      - name: Install uv
-        uses: astral-sh/setup-uv@v7
-        with:
-          enable-cache: true
-          working-directory: apps/backend
-          cache-suffix: backend-tests
-
-      - name: Install backend dependencies
-        run: uv sync --locked --dev
-
-      - name: Run Backend tests
-        env:
-          DJANGO_SETTINGS_MODULE: backend.settings.test
-        run: uv run python manage.py test
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 00000000..2716d530
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,262 @@
+name: CI
+
+on:
+  pull_request:
+    paths:
+      - "apps/backend/**"
+      - "docs/contributors/**"
+      - "docs/alienmark/**"
+      - "docs/users/**"
+      - "packages/alienmark/**"
+      - "apps/frontend/package.json"
+      - "package.json"
+      - "pnpm-lock.yaml"
+      - "pnpm-workspace.yaml"
+      - "make/node.mk"
+      - ".github/workflows/ci.yml"
+
+permissions:
+  contents: read
+
+jobs:
+  changes:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: read
+    outputs:
+      backend: ${{ steps.filter.outputs.backend }}
+      docs-contributors: ${{ steps.filter.outputs.docs-contributors }}
+      docs-alienmark: ${{ steps.filter.outputs.docs-alienmark }}
+      docs-users: ${{ steps.filter.outputs.docs-users }}
+      alienmark: ${{ steps.filter.outputs.alienmark }}
+      workflow: ${{ steps.filter.outputs.workflow }}
+
+    steps:
+      - name: Detect changed CI areas
+        id: filter
+        uses: dorny/paths-filter@v4
+        with:
+          filters: |
+            backend:
+              - 'apps/backend/**'
+            docs-contributors:
+              - 'docs/contributors/**'
+            docs-alienmark:
+              - 'docs/alienmark/**'
+            docs-users:
+              - 'docs/users/**'
+            alienmark:
+              - 'packages/alienmark/**'
+              - 'apps/frontend/package.json'
+              - 'package.json'
+              - 'pnpm-lock.yaml'
+              - 'pnpm-workspace.yaml'
+              - 'make/node.mk'
+            workflow:
+              - '.github/workflows/ci.yml'
+
+  backend-lint:
+    runs-on: ubuntu-latest
+    needs: changes
+    if: needs.changes.outputs.backend == 'true' || needs.changes.outputs.workflow == 'true'
+
+    defaults:
+      run:
+        working-directory: apps/backend
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      - name: Set up Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.14"
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v7
+        with:
+          enable-cache: true
+          working-directory: apps/backend
+          cache-suffix: backend-lint
+
+      - name: Install lint dependencies
+        run: uv sync --locked --dev
+
+      - name: Run Ruff
+        run: >
+          uv run ruff check
+          articles
+          bookmarks
+          comments
+          backend
+          core
+          logs
+          reactions
+          reports
+          tasks
+          users
+          manage.py
+
+  backend-tests:
+    runs-on: ubuntu-latest
+    needs: changes
+    if: needs.changes.outputs.backend == 'true' || needs.changes.outputs.workflow == 'true'
+
+    defaults:
+      run:
+        working-directory: apps/backend
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      - name: Set up Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.14"
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v7
+        with:
+          enable-cache: true
+          working-directory: apps/backend
+          cache-suffix: backend-tests
+
+      - name: Install backend dependencies
+        run: uv sync --locked --dev
+
+      - name: Run Backend tests
+        env:
+          DJANGO_SETTINGS_MODULE: backend.settings.test
+        run: uv run python manage.py test
+
+  alienmark:
+    runs-on: ubuntu-latest
+    needs: changes
+    if: needs.changes.outputs.alienmark == 'true' || needs.changes.outputs.workflow == 'true'
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      - name: Set up pnpm
+        uses: pnpm/action-setup@v6
+        with:
+          run_install: false
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version: "24"
+          cache: "pnpm"
+          cache-dependency-path: pnpm-lock.yaml
+
+      - name: Enable Corepack
+        run: corepack enable
+
+      - name: Install workspace dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Run Alienmark type check
+        run: pnpm --filter alienmark check
+
+      - name: Run Alienmark tests
+        run: pnpm --filter alienmark test
+
+      - name: Build Alienmark
+        run: pnpm --filter alienmark build
+
+  docs-contributors:
+    runs-on: ubuntu-latest
+    needs: changes
+    if: needs.changes.outputs.docs-contributors == 'true' || needs.changes.outputs.workflow == 'true'
+
+    defaults:
+      run:
+        working-directory: docs/contributors
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      - name: Set up Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.14"
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v7
+        with:
+          enable-cache: true
+          working-directory: docs/contributors
+          cache-suffix: docs-validate-contributors
+
+      - name: Install documentation dependencies
+        run: uv sync --locked
+
+      - name: Build and validate MkDocs site
+        run: uv run mkdocs build --strict
+
+  docs-alienmark:
+    runs-on: ubuntu-latest
+    needs: changes
+    if: needs.changes.outputs.docs-alienmark == 'true' || needs.changes.outputs.workflow == 'true'
+
+    defaults:
+      run:
+        working-directory: docs/alienmark
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      - name: Set up Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.14"
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v7
+        with:
+          enable-cache: true
+          working-directory: docs/alienmark
+          cache-suffix: docs-validate-alienmark
+
+      - name: Install documentation dependencies
+        run: uv sync --locked
+
+      - name: Build and validate MkDocs site
+        run: uv run mkdocs build --strict
+
+  docs-users:
+    runs-on: ubuntu-latest
+    needs: changes
+    if: needs.changes.outputs.docs-users == 'true' || needs.changes.outputs.workflow == 'true'
+
+    defaults:
+      run:
+        working-directory: docs/users
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      - name: Set up Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.14"
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v7
+        with:
+          enable-cache: true
+          working-directory: docs/users
+          cache-suffix: docs-validate-users
+
+      - name: Install documentation dependencies
+        run: uv sync --locked
+
+      - name: Build and validate MkDocs site
+        run: uv run mkdocs build --strict
diff --git a/.github/workflows/docs-validate.yml b/.github/workflows/docs-validate.yml
deleted file mode 100644
index e2c35c0f..00000000
--- a/.github/workflows/docs-validate.yml
+++ /dev/null
@@ -1,130 +0,0 @@
-name: "Docs: Validate"
-
-on:
-  pull_request:
-    paths:
-      - "docs/contributors/**"
-      - "docs/alienmark/**"
-      - "docs/users/**"
-      - ".github/workflows/docs-validate.yml"
-
-permissions:
-  contents: read
-  pull-requests: read
-
-jobs:
-  detect-changes:
-    runs-on: ubuntu-latest
-    outputs:
-      contributors: ${{ steps.filter.outputs.contributors }}
-      alienmark: ${{ steps.filter.outputs.alienmark }}
-      users: ${{ steps.filter.outputs.users }}
-      workflow: ${{ steps.filter.outputs.workflow }}
-
-    steps:
-      - name: Detect changed docs projects
-        id: filter
-        uses: dorny/paths-filter@v4
-        with:
-          filters: |
-            contributors:
-              - 'docs/contributors/**'
-            alienmark:
-              - 'docs/alienmark/**'
-            users:
-              - 'docs/users/**'
-            workflow:
-              - '.github/workflows/docs-validate.yml'
-
-  validate-contributors:
-    runs-on: ubuntu-latest
-    needs: detect-changes
-    if: needs.detect-changes.outputs.contributors == 'true' || needs.detect-changes.outputs.workflow == 'true'
-
-    defaults:
-      run:
-        working-directory: docs/contributors
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v6
-
-      - name: Set up Python
-        uses: actions/setup-python@v6
-        with:
-          python-version: "3.14"
-
-      - name: Install uv
-        uses: astral-sh/setup-uv@v7
-        with:
-          enable-cache: true
-          working-directory: docs/contributors
-          cache-suffix: docs-validate-contributors
-
-      - name: Install documentation dependencies
-        run: uv sync --locked
-
-      - name: Build and validate MkDocs site
-        run: uv run mkdocs build --strict
-
-  validate-alienmark:
-    runs-on: ubuntu-latest
-    needs: detect-changes
-    if: needs.detect-changes.outputs.alienmark == 'true' || needs.detect-changes.outputs.workflow == 'true'
-
-    defaults:
-      run:
-        working-directory: docs/alienmark
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v6
-
-      - name: Set up Python
-        uses: actions/setup-python@v6
-        with:
-          python-version: "3.14"
-
-      - name: Install uv
-        uses: astral-sh/setup-uv@v7
-        with:
-          enable-cache: true
-          working-directory: docs/alienmark
-          cache-suffix: docs-validate-alienmark
-
-      - name: Install documentation dependencies
-        run: uv sync --locked
-
-      - name: Build and validate MkDocs site
-        run: uv run mkdocs build --strict
-
-  validate-users:
-    runs-on: ubuntu-latest
-    needs: detect-changes
-    if: needs.detect-changes.outputs.users == 'true' || needs.detect-changes.outputs.workflow == 'true'
-
-    defaults:
-      run:
-        working-directory: docs/users
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v6
-
-      - name: Set up Python
-        uses: actions/setup-python@v6
-        with:
-          python-version: "3.14"
-
-      - name: Install uv
-        uses: astral-sh/setup-uv@v7
-        with:
-          enable-cache: true
-          working-directory: docs/users
-          cache-suffix: docs-validate-users
-
-      - name: Install documentation dependencies
-        run: uv sync --locked
-
-      - name: Build and validate MkDocs site
-        run: uv run mkdocs build --strict

From cf6558144a4c923e86fc25efbb5ef068418dc50a Mon Sep 17 00:00:00 2001
From: Typogalaxy <136544101+Typogalaxy@users.noreply.github.com>
Date: Wed, 13 May 2026 16:18:41 +1000
Subject: [PATCH 4/8] Update urllib3 to 2.7.0

---
 apps/backend/uv.lock      | 6 +++---
 docs/alienmark/uv.lock    | 6 +++---
 docs/contributors/uv.lock | 6 +++---
 docs/users/uv.lock        | 6 +++---
 4 files changed, 12 insertions(+), 12 deletions(-)

diff --git a/apps/backend/uv.lock b/apps/backend/uv.lock
index 5af7b505..62453c5d 100644
--- a/apps/backend/uv.lock
+++ b/apps/backend/uv.lock
@@ -986,11 +986,11 @@ wheels = [
 
 [[package]]
 name = "urllib3"
-version = "2.6.3"
+version = "2.7.0"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/c7/24/5f1b3bdffd70275f6661c76461e25f024d5a38a46f04aaca912426a2b1d3/urllib3-2.6.3.tar.gz", hash = "sha256:1b62b6884944a57dbe321509ab94fd4d3b307075e0c2eae991ac71ee15ad38ed", size = 435556, upload-time = "2026-01-07T16:24:43.925Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/53/0c/06f8b233b8fd13b9e5ee11424ef85419ba0d8ba0b3138bf360be2ff56953/urllib3-2.7.0.tar.gz", hash = "sha256:231e0ec3b63ceb14667c67be60f2f2c40a518cb38b03af60abc813da26505f4c", size = 433602, upload-time = "2026-05-07T16:13:18.596Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/39/08/aaaad47bc4e9dc8c725e68f9d04865dbcb2052843ff09c97b08904852d84/urllib3-2.6.3-py3-none-any.whl", hash = "sha256:bf272323e553dfb2e87d9bfd225ca7b0f467b919d7bbd355436d3fd37cb0acd4", size = 131584, upload-time = "2026-01-07T16:24:42.685Z" },
+    { url = "https://files.pythonhosted.org/packages/7f/3e/5db95bcf282c52709639744ca2a8b149baccf648e39c8cc87553df9eae0c/urllib3-2.7.0-py3-none-any.whl", hash = "sha256:9fb4c81ebbb1ce9531cce37674bbc6f1360472bc18ca9a553ede278ef7276897", size = 131087, upload-time = "2026-05-07T16:13:17.151Z" },
 ]
 
 [[package]]
diff --git a/docs/alienmark/uv.lock b/docs/alienmark/uv.lock
index 91e88685..fb858549 100644
--- a/docs/alienmark/uv.lock
+++ b/docs/alienmark/uv.lock
@@ -409,11 +409,11 @@ wheels = [
 
 [[package]]
 name = "urllib3"
-version = "2.6.3"
+version = "2.7.0"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/c7/24/5f1b3bdffd70275f6661c76461e25f024d5a38a46f04aaca912426a2b1d3/urllib3-2.6.3.tar.gz", hash = "sha256:1b62b6884944a57dbe321509ab94fd4d3b307075e0c2eae991ac71ee15ad38ed", size = 435556, upload-time = "2026-01-07T16:24:43.925Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/53/0c/06f8b233b8fd13b9e5ee11424ef85419ba0d8ba0b3138bf360be2ff56953/urllib3-2.7.0.tar.gz", hash = "sha256:231e0ec3b63ceb14667c67be60f2f2c40a518cb38b03af60abc813da26505f4c", size = 433602, upload-time = "2026-05-07T16:13:18.596Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/39/08/aaaad47bc4e9dc8c725e68f9d04865dbcb2052843ff09c97b08904852d84/urllib3-2.6.3-py3-none-any.whl", hash = "sha256:bf272323e553dfb2e87d9bfd225ca7b0f467b919d7bbd355436d3fd37cb0acd4", size = 131584, upload-time = "2026-01-07T16:24:42.685Z" },
+    { url = "https://files.pythonhosted.org/packages/7f/3e/5db95bcf282c52709639744ca2a8b149baccf648e39c8cc87553df9eae0c/urllib3-2.7.0-py3-none-any.whl", hash = "sha256:9fb4c81ebbb1ce9531cce37674bbc6f1360472bc18ca9a553ede278ef7276897", size = 131087, upload-time = "2026-05-07T16:13:17.151Z" },
 ]
 
 [[package]]
diff --git a/docs/contributors/uv.lock b/docs/contributors/uv.lock
index e6b5f42f..7f9b1a34 100644
--- a/docs/contributors/uv.lock
+++ b/docs/contributors/uv.lock
@@ -409,11 +409,11 @@ wheels = [
 
 [[package]]
 name = "urllib3"
-version = "2.6.3"
+version = "2.7.0"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/c7/24/5f1b3bdffd70275f6661c76461e25f024d5a38a46f04aaca912426a2b1d3/urllib3-2.6.3.tar.gz", hash = "sha256:1b62b6884944a57dbe321509ab94fd4d3b307075e0c2eae991ac71ee15ad38ed", size = 435556, upload-time = "2026-01-07T16:24:43.925Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/53/0c/06f8b233b8fd13b9e5ee11424ef85419ba0d8ba0b3138bf360be2ff56953/urllib3-2.7.0.tar.gz", hash = "sha256:231e0ec3b63ceb14667c67be60f2f2c40a518cb38b03af60abc813da26505f4c", size = 433602, upload-time = "2026-05-07T16:13:18.596Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/39/08/aaaad47bc4e9dc8c725e68f9d04865dbcb2052843ff09c97b08904852d84/urllib3-2.6.3-py3-none-any.whl", hash = "sha256:bf272323e553dfb2e87d9bfd225ca7b0f467b919d7bbd355436d3fd37cb0acd4", size = 131584, upload-time = "2026-01-07T16:24:42.685Z" },
+    { url = "https://files.pythonhosted.org/packages/7f/3e/5db95bcf282c52709639744ca2a8b149baccf648e39c8cc87553df9eae0c/urllib3-2.7.0-py3-none-any.whl", hash = "sha256:9fb4c81ebbb1ce9531cce37674bbc6f1360472bc18ca9a553ede278ef7276897", size = 131087, upload-time = "2026-05-07T16:13:17.151Z" },
 ]
 
 [[package]]
diff --git a/docs/users/uv.lock b/docs/users/uv.lock
index 363c9fd0..899aebf9 100644
--- a/docs/users/uv.lock
+++ b/docs/users/uv.lock
@@ -409,11 +409,11 @@ wheels = [
 
 [[package]]
 name = "urllib3"
-version = "2.6.3"
+version = "2.7.0"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/c7/24/5f1b3bdffd70275f6661c76461e25f024d5a38a46f04aaca912426a2b1d3/urllib3-2.6.3.tar.gz", hash = "sha256:1b62b6884944a57dbe321509ab94fd4d3b307075e0c2eae991ac71ee15ad38ed", size = 435556, upload-time = "2026-01-07T16:24:43.925Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/53/0c/06f8b233b8fd13b9e5ee11424ef85419ba0d8ba0b3138bf360be2ff56953/urllib3-2.7.0.tar.gz", hash = "sha256:231e0ec3b63ceb14667c67be60f2f2c40a518cb38b03af60abc813da26505f4c", size = 433602, upload-time = "2026-05-07T16:13:18.596Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/39/08/aaaad47bc4e9dc8c725e68f9d04865dbcb2052843ff09c97b08904852d84/urllib3-2.6.3-py3-none-any.whl", hash = "sha256:bf272323e553dfb2e87d9bfd225ca7b0f467b919d7bbd355436d3fd37cb0acd4", size = 131584, upload-time = "2026-01-07T16:24:42.685Z" },
+    { url = "https://files.pythonhosted.org/packages/7f/3e/5db95bcf282c52709639744ca2a8b149baccf648e39c8cc87553df9eae0c/urllib3-2.7.0-py3-none-any.whl", hash = "sha256:9fb4c81ebbb1ce9531cce37674bbc6f1360472bc18ca9a553ede278ef7276897", size = 131087, upload-time = "2026-05-07T16:13:17.151Z" },
 ]
 
 [[package]]

From 53a2090ad9d01ab2388c20c1a3f2c17084f07c33 Mon Sep 17 00:00:00 2001
From: Typogalaxy <136544101+Typogalaxy@users.noreply.github.com>
Date: Wed, 13 May 2026 16:26:41 +1000
Subject: [PATCH 5/8] Track GitHub Actions with Dependabot

---
 .github/dependabot.yml | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index a02a1ccb..52b05455 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -28,3 +28,13 @@ updates:
       time: "09:00"
       timezone: "UTC"
     open-pull-requests-limit: 10
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    target-branch: "develop"
+    schedule:
+      interval: "weekly"
+      day: "wednesday"
+      time: "09:00"
+      timezone: "UTC"
+    open-pull-requests-limit: 10

From e143e62ca23299f632dc0fe50b6504fe223de93e Mon Sep 17 00:00:00 2001
From: Typogalaxy <136544101+Typogalaxy@users.noreply.github.com>
Date: Wed, 13 May 2026 16:36:31 +1000
Subject: [PATCH 6/8] Update Twisted to 26.4.0

---
 apps/backend/uv.lock | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/apps/backend/uv.lock b/apps/backend/uv.lock
index 62453c5d..7984f484 100644
--- a/apps/backend/uv.lock
+++ b/apps/backend/uv.lock
@@ -875,7 +875,7 @@ wheels = [
 
 [[package]]
 name = "twisted"
-version = "25.5.0"
+version = "26.4.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "attrs" },
@@ -886,9 +886,9 @@ dependencies = [
     { name = "typing-extensions" },
     { name = "zope-interface" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/13/0f/82716ed849bf7ea4984c21385597c949944f0f9b428b5710f79d0afc084d/twisted-25.5.0.tar.gz", hash = "sha256:1deb272358cb6be1e3e8fc6f9c8b36f78eb0fa7c2233d2dbe11ec6fee04ea316", size = 3545725, upload-time = "2025-06-07T09:52:24.858Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/db/97/6e9beb1e78247ae6dc34114f27d538cf2cb183c4afcd3609dfdf2b0439c8/twisted-26.4.0.tar.gz", hash = "sha256:dbfd0fe1ee409d0243fdd7a6a6ff14f4948cec1fd78e0376291f805e1501fae9", size = 3575095, upload-time = "2026-05-11T11:24:51.861Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/eb/66/ab7efd8941f0bc7b2bd555b0f0471bff77df4c88e0cc31120c82737fec77/twisted-25.5.0-py3-none-any.whl", hash = "sha256:8559f654d01a54a8c3efe66d533d43f383531ebf8d81d9f9ab4769d91ca15df7", size = 3204767, upload-time = "2025-06-07T09:52:21.428Z" },
+    { url = "https://files.pythonhosted.org/packages/a6/57/bcf4e2370dd218c9aa68a9140a65d86729c73f1d529f7e94786c2766fc72/twisted-26.4.0-py3-none-any.whl", hash = "sha256:dc25ea0ebf6511c24f03232ee9f4afa54b291c5d897990e3a39cc4d14a1ef4c0", size = 3230362, upload-time = "2026-05-11T11:24:49.5Z" },
 ]
 
 [package.optional-dependencies]

From fe938f8222d76b642a84222b667cab390e22d8cb Mon Sep 17 00:00:00 2001
From: Typogalaxy <136544101+Typogalaxy@users.noreply.github.com>
Date: Wed, 13 May 2026 16:44:12 +1000
Subject: [PATCH 7/8] Update fast-uri to 3.1.2

---
 pnpm-lock.yaml | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 33a54161..9054224a 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -3091,8 +3091,8 @@ packages:
   fast-string-width@3.0.2:
     resolution: {integrity: sha512-gX8LrtNEI5hq8DVUfRQMbr5lpaS4nMIWV+7XEbXk2b8kiQIizgnlr12B4dA3ZEx3308ze0O4Q1R+cHts8kyUJg==}
 
-  fast-uri@3.1.0:
-    resolution: {integrity: sha512-iPeeDKJSWf4IEOasVVrknXpaBV0IApz/gp7S2bb7Z4Lljbl2MGJRqInZiUrQwV16cpzw/D3S5j5Julj/gT52AA==}
+  fast-uri@3.1.2:
+    resolution: {integrity: sha512-rVjf7ArG3LTk+FS6Yw81V1DLuZl1bRbNrev6Tmd/9RaroeeRRJhAt7jg/6YFxbvAQXUCavSoZhPPj6oOx+5KjQ==}
 
   fast-wrap-ansi@0.1.6:
     resolution: {integrity: sha512-HlUwET7a5gqjURj70D5jl7aC3Zmy4weA1SHUfM0JFI0Ptq987NH2TwbBFLoERhfwk+E+eaq4EK3jXoT+R3yp3w==}
@@ -5651,7 +5651,7 @@ snapshots:
     dependencies:
       ajv: 8.20.0
       ajv-formats: 3.0.1(ajv@8.20.0)
-      fast-uri: 3.1.0
+      fast-uri: 3.1.2
 
   '@fastify/error@4.2.0': {}
 
@@ -7206,7 +7206,7 @@ snapshots:
   ajv@8.20.0:
     dependencies:
       fast-deep-equal: 3.1.3
-      fast-uri: 3.1.0
+      fast-uri: 3.1.2
       json-schema-traverse: 1.0.0
       require-from-string: 2.0.2
 
@@ -8010,7 +8010,7 @@ snapshots:
       '@fastify/merge-json-schemas': 0.2.1
       ajv: 8.20.0
       ajv-formats: 3.0.1(ajv@8.20.0)
-      fast-uri: 3.1.0
+      fast-uri: 3.1.2
       json-schema-ref-resolver: 3.0.0
       rfdc: 1.4.1
 
@@ -8034,7 +8034,7 @@ snapshots:
     dependencies:
       fast-string-truncated-width: 3.0.3
 
-  fast-uri@3.1.0: {}
+  fast-uri@3.1.2: {}
 
   fast-wrap-ansi@0.1.6:
     dependencies:

From a006768cf0301223607f735d087d3282323a8141 Mon Sep 17 00:00:00 2001
From: Typogalaxy <136544101+Typogalaxy@users.noreply.github.com>
Date: Wed, 13 May 2026 16:51:56 +1000
Subject: [PATCH 8/8] chore: update AGENTS.md

---
 apps/backend/AGENTS.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/apps/backend/AGENTS.md b/apps/backend/AGENTS.md
index 166416e6..d7bea296 100644
--- a/apps/backend/AGENTS.md
+++ b/apps/backend/AGENTS.md
@@ -38,7 +38,7 @@ This directory contains the Django backend for AlienCommons. Keep backend change
   ```
 
 - If local dependencies or services make a check impossible, say exactly what was not run and why.
-- After any backend change, inspect the backend GitHub workflows under `.github/workflows/` and decide whether they need updates. In particular, check backend lint, backend tests, and backend API docs workflows when dependencies, commands, settings modules, app names, generated schema behavior, or verification steps change.
+- After any backend change, inspect `.github/workflows/ci.yml` and decide whether the backend lint/test jobs need updates. Also inspect deployment or documentation workflows when dependencies, commands, settings modules, app names, generated schema behavior, or verification steps change.
 
 ## Settings And Environments