Use the locked Komizo project recipe

.github/dependency-policy.json

@@ -5,14 +5,13 @@
   "required_checks": [
     "Test"
   ],
-  "integration_job": "check",
-  "dispatch_workflow": "cd.yml",
+  "integration_job": "ci",
+  "dispatch_workflow": "ci.yml",
   "max_group_size": 10,
   "managed_dependencies": [
-    "nicodes/tools/*",
-    "nicodes/cicd/*",
+    "aviorstudio/gdam-actions/*",
     "nicodes/komizo-actions/*",
-    "aviorstudio/gdam-actions/*"
+    "nicodes/komizo/*"
   ],
   "sensitive_dependencies": [
     "*clerk*",

.github/workflows/ci.yml

@@ -1,36 +1,67 @@
-name: "Build & Test"
-on:
+name: Build & Test
+'on':
   pull_request:
+    types:
+    - opened
+    - synchronize
+    - reopened
+    - ready_for_review
   push:
-    branches: [main]
-  workflow_dispatch:
+    branches:
+    - main
+  workflow_dispatch: null
 permissions:
   contents: read
+  attestations: read
 concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  group: ci-${{ github.ref }}
   cancel-in-progress: true
 jobs:
-  check:
-    name: "Test"
+  ci:
+    name: Test
     runs-on: ubuntu-24.04
-    timeout-minutes: 10
+    timeout-minutes: 30
     steps:
-      - name: "Check out source"
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Record tested integration identity
-        if: github.event_name == 'pull_request'
-        uses: nicodes/tools/integration-identity@247267492cd455647facafcfcc6eed4c63c49c0e # v0.27.2
-        env:
-          EXPECTED_HEAD: ${{ github.event.pull_request.head.sha }}
-      - name: Upload artifacts
-        if: github.event_name == 'pull_request'
-        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
-        with:
-          name: fleet-integration-${{ github.run_id }}-${{ github.run_attempt }}
-          path: .artifacts/fleet-integration.json
-          if-no-files-found: error
-          retention-days: 7
-      - name: "Set up tools"
-        uses: jdx/mise-action@9b200bcecbfd6303e69a4a261b2e09e3757440a7 # v5.2.0
-      - name: "Run project checks"
-        run: make install check
+    - name: Check out source
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+      with:
+        persist-credentials: false
+    - name: Set up locked Komizo
+      uses: nicodes/komizo/setup@c5f5ce398dcae5c7b3f8157e8331e7fcdf0c9e03
+      env:
+        GH_TOKEN: ${{ github.token }}
+      timeout-minutes: 5
+    - name: Record tested integration identity
+      if: github.event_name == 'pull_request'
+      env:
+        EXPECTED_HEAD: ${{ github.event.pull_request.head.sha }}
+      run: 'komizo exec --tools python -- bash -euo pipefail <<''KOMIZO_COMMAND''
+
+        python3 "$CICD_ENGINEERING/helpers/integration-identity.py"
+
+        KOMIZO_COMMAND
+
+        '
+    - name: Upload artifacts
+      if: github.event_name == 'pull_request'
+      uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9
+      with:
+        name: fleet-integration-${{ github.run_id }}-${{ github.run_attempt }}
+        path: .artifacts/fleet-integration.json
+        if-no-files-found: error
+        retention-days: 7
+        include-hidden-files: true
+    - name: Check project
+      uses: nicodes/komizo/run@c5f5ce398dcae5c7b3f8157e8331e7fcdf0c9e03
+      with:
+        target: check
+    - name: Upload artifacts
+      uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9
+      with:
+        name: tested-redirect-${{ github.sha }}
+        path: .artifacts/dist/
+        if-no-files-found: error
+        retention-days: 7
+        include-hidden-files: true
+    env:
+      MISE_GITHUB_TOKEN: ${{ github.token }}

.github/workflows/dependency-policy.yml

@@ -1,13 +1,19 @@
 name: Dependency Policy
-on:
+'on':
   pull_request_target:
-    types: [opened, synchronize, reopened, ready_for_review]
+    types:
+    - opened
+    - synchronize
+    - reopened
+    - ready_for_review
   workflow_run:
-    workflows: ["Build & Test"]
-    types: [completed]
-  workflow_dispatch:
+    workflows:
+    - Build & Test
+    types:
+    - completed
+  workflow_dispatch: null
   schedule:
-    - cron: '58 6 * * *'
+  - cron: 4 6 * * *
 permissions:
   contents: write
   pull-requests: write
@@ -19,12 +25,40 @@ concurrency:
   cancel-in-progress: false
 jobs:
   auto-merge:
-    if: >-
-      (github.event_name != 'workflow_run' && github.event_name != 'pull_request_target') ||
-      (github.event_name == 'pull_request_target' && github.event.pull_request.user.login == 'dependabot[bot]' && github.event.pull_request.draft == false) ||
-      (github.event_name == 'workflow_run' && github.event.workflow_run.event == 'pull_request' && github.event.workflow_run.conclusion == 'success' &&
-       (github.event.workflow_run.actor.login == 'dependabot[bot]' || startsWith(github.event.workflow_run.head_branch, 'dependabot/') || startsWith(github.event.workflow_run.head_branch, 'dependabot-')))
     name: Apply dependency policy
-    uses: nicodes/tools/.github/workflows/dependency-merge.yml@247267492cd455647facafcfcc6eed4c63c49c0e # v0.27.2
-    with:
-      runner: ubuntu-24.04
+    if: github.ref == 'refs/heads/main' && (github.event_name != 'pull_request_target' || (github.event.pull_request.user.login == 'dependabot[bot]'
+      && github.event.pull_request.draft == false))
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    permissions:
+      contents: write
+      pull-requests: write
+      actions: write
+      checks: read
+      statuses: read
+      attestations: read
+    steps:
+    - name: Check out source
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+      with:
+        persist-credentials: false
+        ref: main
+      timeout-minutes: 3
+    - name: Set up locked Komizo
+      uses: nicodes/komizo/setup@c5f5ce398dcae5c7b3f8157e8331e7fcdf0c9e03
+      env:
+        GH_TOKEN: ${{ github.token }}
+      timeout-minutes: 5
+    - name: Reconcile verified dependency updates
+      run: komizo dependencies apply --output "$RUNNER_TEMP/dependency-report.json"
+      env:
+        GH_TOKEN: ${{ github.token }}
+      timeout-minutes: 7
+    - name: Upload artifacts
+      if: always()
+      uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9
+      with:
+        name: dependency-policy-${{ github.run_id }}-${{ github.run_attempt }}
+        path: ${{ runner.temp }}/dependency-report.json
+        if-no-files-found: error
+        retention-days: 14

.gitignore

@@ -1,2 +1,6 @@
 .artifacts/
 __pycache__/
+
+.komizo.mise*.toml
+
+.komizo.mise*.lock

README.md

@@ -0,0 +1,7 @@
+<!-- Generated from private documentation source. Do not edit directly. Source SHA256: 778f3f496a68792647a8a203de3cb55bcf277fb8f640fcc59bb959fb1715a635 -->
+
+# aviorstudio.github.io
+
+Static redirect to [Avior Studio](https://www.avior.studio/).
+
+Install the [Komizo release](https://github.com/nicodes/komizo#install) matching `komizo.lock`, then run `komizo check`. Use `komizo describe` to inspect the applicable stages.

komizo.json

@@ -0,0 +1,43 @@
+{
+  "version": 1,
+  "recipe": "configuration",
+  "repository": "aviorstudio/aviorstudio.github.io",
+  "tools": {
+    "actionlint": "1.7.12"
+  },
+  "artifacts": [
+    ".artifacts/dist"
+  ],
+  "stages": {
+    "lint": [
+      [
+        "python3",
+        "scripts/check.py"
+      ],
+      [
+        "actionlint"
+      ]
+    ],
+    "unit": {
+      "inapplicable": "The redirect invariants are checked by the lint gate"
+    },
+    "build": [
+      [
+        "python3",
+        "scripts/check.py",
+        "--build"
+      ]
+    ]
+  },
+  "validation": {
+    "workflow": {
+      "required": [
+        "ci.yml",
+        "dependency-policy.yml"
+      ],
+      "ci_gates": [
+        "Test"
+      ]
+    }
+  }
+}

komizo.lock

@@ -0,0 +1,8 @@
+{
+  "version": 1,
+  "platform": "0.2.2",
+  "platform_revision": "c5f5ce398dcae5c7b3f8157e8331e7fcdf0c9e03",
+  "manifest_sha256": "f605f9b8126a0fdab262650c7812be90cbba5c472cdb335c8ef527dc2407888e",
+  "runtime_sha256": "467ab4cca4445f549a91ef24e1ae732f0727cfbc3470dfe09fd39c862e18a96c",
+  "recipe_sha256": "33ac62cab7dbea38c303cabc99c60ac1adf33ef21bd0b2b5c62bcb22fcac2235"
+}