From f616e2e05bd5c0feb47ca3e1ff87ff9ee7bff872 Mon Sep 17 00:00:00 2001
From: Doeon Kim <215626042+KIM3310@users.noreply.github.com>
Date: Tue, 11 Aug 2026 00:19:43 +0900
Subject: [PATCH] ci: harden automation and refresh verification evidence

---
 .github/dependabot.yml            | 14 +++++++-------
 .github/workflows/secret-scan.yml |  6 +++---
 site/verification.html            |  2 +-
 3 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 9695122..f84aa03 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -6,8 +6,8 @@ updates:
     directory: "/"
     schedule:
       interval: "weekly"
-      day: "monday"
-      time: "09:00"
+      day: "thursday"
+      time: "10:40"
       timezone: "Asia/Seoul"
     open-pull-requests-limit: 5
     versioning-strategy: increase
@@ -42,8 +42,8 @@ updates:
     directory: "/"
     schedule:
       interval: "weekly"
-      day: "monday"
-      time: "09:00"
+      day: "friday"
+      time: "10:40"
       timezone: "Asia/Seoul"
     open-pull-requests-limit: 5
     groups:
@@ -68,7 +68,7 @@ updates:
     schedule:
       interval: "weekly"
       day: "monday"
-      time: "09:00"
+      time: "10:50"
       timezone: "Asia/Seoul"
     open-pull-requests-limit: 5
     groups:
@@ -93,8 +93,8 @@ updates:
     directory: "/infra/terraform"
     schedule:
       interval: "weekly"
-      day: "monday"
-      time: "09:00"
+      day: "tuesday"
+      time: "10:50"
       timezone: "Asia/Seoul"
     open-pull-requests-limit: 5
     groups:
diff --git a/.github/workflows/secret-scan.yml b/.github/workflows/secret-scan.yml
index 91e44ff..069c95b 100644
--- a/.github/workflows/secret-scan.yml
+++ b/.github/workflows/secret-scan.yml
@@ -5,7 +5,7 @@ on:
   push:
     branches: [main]
   schedule:
-    - cron: "17 3 * * 1"
+    - cron: "23 6 * * 6"
   workflow_dispatch:
 
 permissions:
@@ -32,8 +32,8 @@ jobs:
           base_url="https://github.com/gitleaks/gitleaks/releases/download/v${version}"
           archive="gitleaks_${version}_linux_x64.tar.gz"
           curl -sSfL "${base_url}/${archive}" -o "${archive}"
-          curl -sSfL "${base_url}/gitleaks_${version}_checksums.txt" -o checksums.txt
-          grep " ${archive}$" checksums.txt | sha256sum -c -
+          expected_sha256="551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb"
+          printf '%s  %s\n' "${expected_sha256}" "${archive}" | sha256sum -c -
           tar -xzf "${archive}" gitleaks
           sudo install -m 0755 gitleaks /usr/local/bin/gitleaks
           gitleaks version
diff --git a/site/verification.html b/site/verification.html
index 37e1f75..8436164 100644
--- a/site/verification.html
+++ b/site/verification.html
@@ -91,7 +91,7 @@ <h2>Checked-in evidence inventory</h2>
       <h3>Verification commands</h3>
       <ul><li><code>npm run verify</code></li><li><code>npm run test</code></li><li><code>npm run lint</code></li><li><code>npm run typecheck</code></li><li><code>npm run build</code></li></ul>
       <h3>Test files</h3>
-      <ul><li><code>src/__tests__/core/prompts/hermes-prompt.unit.test.ts</code></li><li><code>src/__tests__/core/prompts/morph-xml-prompt.unit.test.ts</code></li><li><code>src/__tests__/core/prompts/qwen3coder-prompt.unit.test.ts</code></li><li><code>src/__tests__/core/prompts/shared/assistant-tool-calls-to-text.serialization.unit.test.ts</code></li><li><code>src/__tests__/core/prompts/shared/tool-result-normalizer.normalization.unit.test.ts</code></li><li><code>src/__tests__/core/prompts/shared/tool-role-to-user-message.conversion.unit.test.ts</code></li><li><code>src/__tests__/core/prompts/yaml-xml-prompt.unit.test.ts</code></li><li><code>src/__tests__/core/protocols/protocol.factory-guards.test.ts</code></li><li><code>src/__tests__/core/utils/dynamic-tool-schema.unit.test.ts</code></li><li><code>src/__tests__/core/utils/generated-text-json-recovery.unit.test.ts</code></li><li><code>src/__tests__/core/utils/get-potential-start-index.unit.test.ts</code></li><li><code>src/__tests__/core/utils/id.unit.test.ts</code></li><li><code>src/__tests__/core/utils/on-error.unit.test.ts</code></li><li><code>src/__tests__/core/utils/on-event.unit.test.ts</code></li><li><code>src/__tests__/core/utils/streamed-tool-input-delta.unit.test.ts</code></li><li><code>src/__tests__/core/utils/tool-call-coercion.unit.test.ts</code></li><li><code>src/__tests__/core/utils/tool-choice.unit.test.ts</code></li><li><code>src/__tests__/core/utils/tool-input-streaming.unit.test.ts</code></li><li><code>src/__tests__/core/utils/tools.unit.test.ts</code></li><li><code>src/__tests__/core/utils/type-guards.unit.test.ts</code></li></ul>
+      <ul><li><code>experiments/claude-cli-prompt-bfcl-ralph/test_run_claude_cli_prompt_bfcl_ralph.py</code></li><li><code>experiments/gemini-cli-prompt-bfcl-ralph/test_run_gemini_cli_prompt_bfcl_ralph.py</code></li><li><code>experiments/grok-prompt-bfcl-ralph/test_run_grok_prompt_bfcl_ralph.py</code></li><li><code>experiments/kiro-cli-prompt-bfcl-ralph/test_run_kiro_cli_prompt_bfcl_ralph.py</code></li><li><code>experiments/openai-compatible-prompt-bfcl-ralph/test_run_openai_compatible_prompt_bfcl_ralph.py</code></li><li><code>experiments/prompt-bfcl-ralph-matrix/test_run_prompt_bfcl_ralph_matrix.py</code></li><li><code>src/__tests__/core/prompts/hermes-prompt.unit.test.ts</code></li><li><code>src/__tests__/core/prompts/morph-xml-prompt.unit.test.ts</code></li><li><code>src/__tests__/core/prompts/qwen3coder-prompt.unit.test.ts</code></li><li><code>src/__tests__/core/prompts/shared/assistant-tool-calls-to-text.serialization.unit.test.ts</code></li><li><code>src/__tests__/core/prompts/shared/tool-result-normalizer.normalization.unit.test.ts</code></li><li><code>src/__tests__/core/prompts/shared/tool-role-to-user-message.conversion.unit.test.ts</code></li><li><code>src/__tests__/core/prompts/yaml-xml-prompt.unit.test.ts</code></li><li><code>src/__tests__/core/protocols/protocol.factory-guards.test.ts</code></li><li><code>src/__tests__/core/utils/dynamic-tool-schema.unit.test.ts</code></li><li><code>src/__tests__/core/utils/generated-text-json-recovery.unit.test.ts</code></li><li><code>src/__tests__/core/utils/get-potential-start-index.unit.test.ts</code></li><li><code>src/__tests__/core/utils/id.unit.test.ts</code></li><li><code>src/__tests__/core/utils/on-error.unit.test.ts</code></li><li><code>src/__tests__/core/utils/on-event.unit.test.ts</code></li></ul>
       <h3>Continuous integration workflows</h3>
       <ul><li><code>.github/workflows/architecture-blueprint.yml</code></li><li><code>.github/workflows/ci.yml</code></li><li><code>.github/workflows/code-quality.yml</code></li><li><code>.github/workflows/dependency-review.yml</code></li><li><code>.github/workflows/pages-auto-deploy.yml</code></li><li><code>.github/workflows/repository-health.yml</code></li><li><code>.github/workflows/repository-surface.yml</code></li><li><code>.github/workflows/secret-scan.yml</code></li></ul>
       <h2>How to interpret the result</h2>