From 6775f0307f9b5f933049f09a541280b67cf47dd6 Mon Sep 17 00:00:00 2001
From: nerdalytics <97166791+nerdalytics@users.noreply.github.com>
Date: Wed, 22 Apr 2026 22:53:45 +0200
Subject: [PATCH] feat(ci): self-audit with
 nerdalytics/check-action-versions@v1.0.3

Adds a scheduled workflow that runs this same action on this repo.
From now on, action-version bumps in .github/workflows/ci.yml (and in
the new self-audit workflow itself) are opened by the action as
auto-update PRs rather than handled by Dependabot.

Deletes .github/dependabot.yml for the same reason: its github-actions
ecosystem watcher is now redundant with the self-audit workflow, and
running both would produce duplicate PRs on different branches.

Requires the repo to have these secrets configured before the first
scheduled run:
- ACTION_UPDATER_PAT: PAT with repo + workflow scope (for checkout
  with push access, and for gh issue/pr create)
- SSH_SIGNING_KEY: SSH private key for the nerdalytics bot signing
  identity
- SSH_SIGNING_KEY_PASSPHRASE: passphrase on the signing key
---
 .github/dependabot.yml                      | 12 --------
 .github/workflows/check-action-versions.yml | 31 +++++++++++++++++++++
 2 files changed, 31 insertions(+), 12 deletions(-)
 delete mode 100644 .github/dependabot.yml
 create mode 100644 .github/workflows/check-action-versions.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
deleted file mode 100644
index 08b0514..0000000
--- a/.github/dependabot.yml
+++ /dev/null
@@ -1,12 +0,0 @@
-version: 2
-updates:
-  - package-ecosystem: github-actions
-    directory: /
-    schedule:
-      interval: weekly
-      day: monday
-      time: "09:00"
-      timezone: UTC
-    open-pull-requests-limit: 5
-    commit-message:
-      prefix: "build(deps)"
diff --git a/.github/workflows/check-action-versions.yml b/.github/workflows/check-action-versions.yml
new file mode 100644
index 0000000..9a8fd9b
--- /dev/null
+++ b/.github/workflows/check-action-versions.yml
@@ -0,0 +1,31 @@
+name: Check Action Versions
+permissions:
+  contents: write
+  issues: write
+  pull-requests: write
+
+on:
+  schedule:
+    - cron: '0 9 * * 1'   # Monday 09:00 UTC
+  workflow_dispatch:
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          token: ${{ secrets.ACTION_UPDATER_PAT }}
+
+      - uses: nerdalytics/check-action-versions@11a5116015b39e4ef354d6eaa5c8757a338100de # v1.0.3
+        with:
+          committer-name: nerdalytics
+          committer-email: 97166791+nerdalytics@users.noreply.github.com
+          commit-prefix: 'chore(deps):'
+          branch-name: automation/update-github-actions
+          pr-labels: 'security,dependencies'
+          issue-labels: 'security,dependencies'
+          signing-method: ssh
+          gh-pat: ${{ secrets.ACTION_UPDATER_PAT }}
+          signing-key: ${{ secrets.SSH_SIGNING_KEY }}
+          signing-passphrase: ${{ secrets.SSH_SIGNING_KEY_PASSPHRASE }}