ci: strengthen quality checks

.github/dependabot.yml

@@ -0,0 +1,10 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: monthly
+    groups:
+      github-actions:
+        patterns:
+          - "*"

.github/workflows/api.yml

@@ -0,0 +1,44 @@
+name: API contract
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - "api/**"
+      - "package.json"
+      - "package-lock.json"
+      - "Makefile"
+      - ".github/workflows/api.yml"
+  pull_request:
+    paths:
+      - "api/**"
+      - "package.json"
+      - "package-lock.json"
+      - "Makefile"
+      - ".github/workflows/api.yml"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  openapi-contract:
+    name: OpenAPI contract
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v5
+      - name: Set up Node.js and npm cache
+        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
+        with:
+          node-version: 24
+          cache: npm
+      - name: Install repository tooling
+        run: npm ci
+      - name: Validate OpenAPI contract
+        run: make lint-api

.github/workflows/backend.yml

@@ -7,13 +7,22 @@ on:
       - "backend/**"
       - "api/**"
       - "Makefile"
+      - "rust-toolchain.toml"
       - ".github/workflows/backend.yml"
   pull_request:
 
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
 jobs:
   rust-changes:
     name: Rust backend change detection
     runs-on: ubuntu-latest
+    timeout-minutes: 5
     outputs:
       relevant: ${{ steps.detect.outputs.relevant }}
 
@@ -29,7 +38,7 @@ jobs:
           EVENT_NAME: ${{ github.event_name }}
           BASE_SHA: ${{ github.event.pull_request.base.sha }}
         run: |
-          if [[ "$EVENT_NAME" == "push" ]] || ! git diff --quiet "$BASE_SHA" HEAD -- backend api Makefile .github/workflows/backend.yml; then
+          if [[ "$EVENT_NAME" == "push" ]] || ! git diff --quiet "$BASE_SHA" HEAD -- backend api Makefile rust-toolchain.toml .github/workflows/backend.yml; then
             echo "relevant=true" >> "$GITHUB_OUTPUT"
           else
             echo "relevant=false" >> "$GITHUB_OUTPUT"
@@ -40,6 +49,7 @@ jobs:
     needs: rust-changes
     if: needs.rust-changes.outputs.relevant == 'true'
     runs-on: ubuntu-latest
+    timeout-minutes: 15
 
     steps:
       - name: Check out repository
@@ -52,6 +62,7 @@ jobs:
     needs: rust-changes
     if: needs.rust-changes.outputs.relevant == 'true'
     runs-on: ubuntu-latest
+    timeout-minutes: 15
 
     steps:
       - name: Check out repository
@@ -64,6 +75,7 @@ jobs:
     needs: rust-changes
     if: needs.rust-changes.outputs.relevant == 'true'
     runs-on: ubuntu-latest
+    timeout-minutes: 15
 
     steps:
       - name: Check out repository
@@ -76,6 +88,7 @@ jobs:
     needs: [rust-changes, rust-format, rust-clippy, rust-tests]
     if: always()
     runs-on: ubuntu-latest
+    timeout-minutes: 5
 
     steps:
       - name: Verify Rust backend jobs

.github/workflows/branch-name.yml

@@ -6,17 +6,22 @@ on:
 
 permissions: {}
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
 jobs:
   branch-name-convention:
     name: Branch name convention
     runs-on: ubuntu-latest
+    timeout-minutes: 5
     env:
       BRANCH_NAME: ${{ github.head_ref }}
 
     steps:
       - name: Require type/lowercase-kebab-case
         run: |
-          if [[ ! "$BRANCH_NAME" =~ ^(feat|fix|chore|docs|refactor|test|ci)/[a-z0-9]+(-[a-z0-9]+)*$ ]]; then
+          if [[ ! "$BRANCH_NAME" =~ ^((feat|fix|chore|docs|refactor|test|ci)/[a-z0-9]+(-[a-z0-9]+)*|dependabot/github_actions/[a-zA-Z0-9._/-]+)$ ]]; then
             echo "::error title=Invalid branch name::$BRANCH_NAME must match type/lowercase-kebab-case"
             exit 1
           fi

.github/workflows/docs.yml

@@ -9,11 +9,9 @@ on:
       - "Makefile"
       - ".github/workflows/docs.yml"
   pull_request:
-    paths:
-      - "docs/**"
-      - "mkdocs.yml"
-      - "Makefile"
-      - ".github/workflows/docs.yml"
+
+permissions:
+  contents: read
 
 concurrency:
   group: documentation-${{ github.event.pull_request.number || github.ref }}
@@ -23,17 +21,18 @@ jobs:
   documentation-build:
     name: Documentation build
     runs-on: ubuntu-latest
+    timeout-minutes: 10
 
     steps:
       - name: Check out repository
         uses: actions/checkout@v5
       - name: Set up uv
-        uses: astral-sh/setup-uv@v8.3.2
+        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
       - name: Build documentation
         run: make docs-build
       - name: Upload documentation
         if: github.event_name == 'push'
-        uses: actions/upload-pages-artifact@v4
+        uses: actions/upload-pages-artifact@7b1f4a764d45c48632c6b24a0339c27f5614fb0b # v4
         with:
           path: site
 
@@ -42,6 +41,7 @@ jobs:
     if: github.event_name == 'push'
     needs: documentation-build
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     permissions:
       pages: write
       id-token: write
@@ -52,4 +52,4 @@ jobs:
     steps:
       - name: Deploy documentation to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4

.github/workflows/frontend.yml

@@ -10,10 +10,18 @@ on:
       - ".github/workflows/frontend.yml"
   pull_request:
 
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
 jobs:
   frontend-changes:
     name: Kotlin frontend change detection
     runs-on: ubuntu-latest
+    timeout-minutes: 5
     outputs:
       relevant: ${{ steps.detect.outputs.relevant }}
 
@@ -35,17 +43,56 @@ jobs:
             echo "relevant=false" >> "$GITHUB_OUTPUT"
           fi
 
+  kotlin-format:
+    name: Kotlin formatting
+    needs: frontend-changes
+    if: needs.frontend-changes.outputs.relevant == 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v5
+      - name: Set up Java and Gradle cache
+        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5
+        with:
+          java-version: "24"
+          distribution: temurin
+          cache: gradle
+      - name: Check Kotlin formatting
+        run: make check-kotlin-format
+
+  kotlin-static-analysis:
+    name: Kotlin static analysis
+    needs: frontend-changes
+    if: needs.frontend-changes.outputs.relevant == 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v5
+      - name: Set up Java and Gradle cache
+        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5
+        with:
+          java-version: "24"
+          distribution: temurin
+          cache: gradle
+      - name: Run Detekt static analysis
+        run: make lint-kotlin-detekt
+
   kotlin-jvm-tests:
     name: Kotlin/JVM tests
     needs: frontend-changes
     if: needs.frontend-changes.outputs.relevant == 'true'
     runs-on: ubuntu-latest
+    timeout-minutes: 20
 
     steps:
       - name: Check out repository
         uses: actions/checkout@v5
       - name: Set up Java and Gradle cache
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5
         with:
           java-version: "24"
           distribution: temurin
@@ -58,12 +105,13 @@ jobs:
     needs: frontend-changes
     if: needs.frontend-changes.outputs.relevant == 'true'
     runs-on: ubuntu-latest
+    timeout-minutes: 20
 
     steps:
       - name: Check out repository
         uses: actions/checkout@v5
       - name: Set up Java and Gradle cache
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5
         with:
           java-version: "24"
           distribution: temurin
@@ -76,12 +124,13 @@ jobs:
     needs: frontend-changes
     if: needs.frontend-changes.outputs.relevant == 'true'
     runs-on: ubuntu-latest
+    timeout-minutes: 20
 
     steps:
       - name: Check out repository
         uses: actions/checkout@v5
       - name: Set up Java and Gradle cache
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5
         with:
           java-version: "24"
           distribution: temurin
@@ -94,12 +143,13 @@ jobs:
     needs: frontend-changes
     if: needs.frontend-changes.outputs.relevant == 'true'
     runs-on: ubuntu-latest
+    timeout-minutes: 20
 
     steps:
       - name: Check out repository
         uses: actions/checkout@v5
       - name: Set up Java and Gradle cache
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5
         with:
           java-version: "24"
           distribution: temurin
@@ -109,15 +159,18 @@ jobs:
 
   kotlin-frontend-gate:
     name: Kotlin frontend all clear
-    needs: [frontend-changes, kotlin-jvm-tests, android-unit-tests, javascript-tests, webassembly-tests]
+    needs: [frontend-changes, kotlin-format, kotlin-static-analysis, kotlin-jvm-tests, android-unit-tests, javascript-tests, webassembly-tests]
     if: always()
     runs-on: ubuntu-latest
+    timeout-minutes: 5
 
     steps:
       - name: Verify Kotlin frontend jobs
         env:
           RELEVANT: ${{ needs.frontend-changes.outputs.relevant }}
           CHANGE_DETECTION: ${{ needs.frontend-changes.result }}
+          KOTLIN_FORMAT: ${{ needs.kotlin-format.result }}
+          KOTLIN_STATIC_ANALYSIS: ${{ needs.kotlin-static-analysis.result }}
           JVM_TESTS: ${{ needs.kotlin-jvm-tests.result }}
           ANDROID_TESTS: ${{ needs.android-unit-tests.result }}
           JAVASCRIPT_TESTS: ${{ needs.javascript-tests.result }}
@@ -135,7 +188,7 @@ jobs:
             echo "::error::Kotlin change detection produced no decision"
             exit 1
           fi
-          for result in "$JVM_TESTS" "$ANDROID_TESTS" "$JAVASCRIPT_TESTS" "$WEBASSEMBLY_TESTS"; do
+          for result in "$KOTLIN_FORMAT" "$KOTLIN_STATIC_ANALYSIS" "$JVM_TESTS" "$ANDROID_TESTS" "$JAVASCRIPT_TESTS" "$WEBASSEMBLY_TESTS"; do
             if [[ "$result" != "$expected" ]]; then
               echo "::error::Expected Kotlin job status $expected, received $result"
               exit 1

.github/workflows/markdown.yml

@@ -5,18 +5,26 @@ on:
     branches: [main]
   pull_request:
 
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
 jobs:
   markdown-lint:
     name: Markdown style
     runs-on: ubuntu-latest
+    timeout-minutes: 10
 
     steps:
       - name: Check out repository
         uses: actions/checkout@v5
       - name: Set up Node.js and npm cache
-        uses: actions/setup-node@v5
+        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
         with:
-          node-version: lts/*
+          node-version: 24
           cache: npm
       - name: Install Markdown tooling
         run: npm ci