From b31ec1bb9cb09186ccf4da18754904be3ec9d1e7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?M=C3=A5ns=20Th=C3=B6rnvik?= <thornvik.mans@gmail.com>
Date: Sat, 23 May 2026 17:55:56 +0200
Subject: [PATCH 1/6] chore: replicate locksmith workflow updates

Replicate recent Copilot setup, MCP, and Dependabot auto-merge workflow changes from locksmith.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 .github/copilot/mcp.json                      | 11 +++++
 .github/workflows/copilot-setup-steps.yml     | 47 +++++++++++++++++++
 .../workflows/dependabot-auto-approve.yaml    | 10 +++-
 3 files changed, 66 insertions(+), 2 deletions(-)
 create mode 100644 .github/copilot/mcp.json
 create mode 100644 .github/workflows/copilot-setup-steps.yml

diff --git a/.github/copilot/mcp.json b/.github/copilot/mcp.json
new file mode 100644
index 0000000..8f71356
--- /dev/null
+++ b/.github/copilot/mcp.json
@@ -0,0 +1,11 @@
+{
+  "mcpServers": {
+    "github": {
+      "type": "http",
+      "url": "https://api.githubcopilot.com/mcp/",
+      "headers": {
+        "Authorization": "Bearer ${GITHUB_TOKEN}"
+      }
+    }
+  }
+}
diff --git a/.github/workflows/copilot-setup-steps.yml b/.github/workflows/copilot-setup-steps.yml
new file mode 100644
index 0000000..da7f258
--- /dev/null
+++ b/.github/workflows/copilot-setup-steps.yml
@@ -0,0 +1,47 @@
+name: "Copilot Setup Steps"
+
+on:
+  workflow_dispatch:
+  push:
+    paths:
+      - .github/workflows/copilot-setup-steps.yml
+  pull_request:
+    paths:
+      - .github/workflows/copilot-setup-steps.yml
+
+jobs:
+  copilot-setup-steps:
+    runs-on: ubuntu-latest
+
+    permissions:
+      contents: read
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Set up Go
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+        with:
+          go-version-file: go.mod
+          cache: false
+
+      - name: Cache Go modules and build cache
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        with:
+          path: |
+            ~/go/pkg/mod
+            ~/.cache/go-build
+          key: copilot-go-${{ hashFiles('go.sum', 'tools/go.sum') }}
+          restore-keys: copilot-go-
+
+      - name: Download Go module dependencies
+        run: |
+          go mod download
+          go mod download -modfile tools/go.mod
+
+      - name: Install golangci-lint
+        run: go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.12.0
+
+      - name: Warm up govulncheck
+        run: go tool -modfile tools/go.mod govulncheck -version
diff --git a/.github/workflows/dependabot-auto-approve.yaml b/.github/workflows/dependabot-auto-approve.yaml
index 34e1d2a..bec94f0 100644
--- a/.github/workflows/dependabot-auto-approve.yaml
+++ b/.github/workflows/dependabot-auto-approve.yaml
@@ -42,8 +42,14 @@ jobs:
             gh pr merge --auto -s "$PR_URL"
           fi
 
-      - name: Re-approve after force-update if auto-merge was already configured
-        if: steps.metadata.outcome == 'failure' && github.event.action == 'synchronize'
+      - name: Re-approve after branch update if auto-merge was already configured
+        # Runs on synchronize events where step 4 would be skipped — i.e. when fetch-metadata
+        # either failed (outcome=failure) or returned an empty/unexpected update-type.
+        # The auto-merge check inside the script guards against re-approving major updates.
+        if: >-
+          github.event.action == 'synchronize' &&
+          steps.metadata.outputs.update-type != 'version-update:semver-patch' &&
+          steps.metadata.outputs.update-type != 'version-update:semver-minor'
         env:
           PR_URL: ${{ github.event.pull_request.html_url }}
           GH_TOKEN: ${{ steps.app-token.outputs.token }}

From fcb6ac646184d56f7378513ab0268ac5a2d2ce76 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?M=C3=A5ns=20Th=C3=B6rnvik?= <thornvik.mans@gmail.com>
Date: Sat, 23 May 2026 17:59:41 +0200
Subject: [PATCH 2/6] use stable go version for copilot

---
 .github/workflows/copilot-setup-steps.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/copilot-setup-steps.yml b/.github/workflows/copilot-setup-steps.yml
index da7f258..8166299 100644
--- a/.github/workflows/copilot-setup-steps.yml
+++ b/.github/workflows/copilot-setup-steps.yml
@@ -23,7 +23,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
-          go-version-file: go.mod
+          go-version: "stable"
           cache: false
 
       - name: Cache Go modules and build cache

From 096dcd358ad005507a13eef5497c6aa22224728c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?M=C3=A5ns=20Th=C3=B6rnvik?= <thornvik.mans@gmail.com>
Date: Sat, 23 May 2026 18:06:31 +0200
Subject: [PATCH 3/6] build: add install-lint make target

Add the kerberos-style make target for installing golangci-lint.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 Makefile | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/Makefile b/Makefile
index b621cd0..4e3fe7e 100644
--- a/Makefile
+++ b/Makefile
@@ -14,5 +14,8 @@ vulncheck-sarif:
 	@mkdir -p build
 	@go tool -modfile=./tools/go.mod govulncheck -format sarif ./... > build/govulncheck-report.sarif
 
+install-lint:
+	curl -sSfL https://golangci-lint.run/install.sh | sh -s -- -b $(go env GOPATH)/bin v2.12.2
+
 build:
 	@go build ./...

From a448af5c533b1bd7a5633bb2909c23dc690b5df7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?M=C3=A5ns=20Th=C3=B6rnvik?= <thornvik.mans@gmail.com>
Date: Sat, 23 May 2026 18:10:25 +0200
Subject: [PATCH 4/6] ci: use Makefile lint install target

Use the repo Makefile target for golangci-lint setup in Copilot workflows, and avoid duplicate Makefile recipes where a target already exists.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 .github/workflows/copilot-setup-steps.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/copilot-setup-steps.yml b/.github/workflows/copilot-setup-steps.yml
index 8166299..c12d5b3 100644
--- a/.github/workflows/copilot-setup-steps.yml
+++ b/.github/workflows/copilot-setup-steps.yml
@@ -41,7 +41,7 @@ jobs:
           go mod download -modfile tools/go.mod
 
       - name: Install golangci-lint
-        run: go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.12.0
+        run: make install-lint
 
       - name: Warm up govulncheck
         run: go tool -modfile tools/go.mod govulncheck -version

From 1a66b184c980926508b2aafe8c8909607643cbd6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?M=C3=A5ns=20Th=C3=B6rnvik?= <thornvik.mans@gmail.com>
Date: Sat, 23 May 2026 18:12:47 +0200
Subject: [PATCH 5/6] ci: normalize copilot workflow permissions

Move Copilot setup workflow permissions to the workflow level and grant packages: read only in repos that build container images.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 .github/workflows/copilot-setup-steps.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/copilot-setup-steps.yml b/.github/workflows/copilot-setup-steps.yml
index c12d5b3..eeb935e 100644
--- a/.github/workflows/copilot-setup-steps.yml
+++ b/.github/workflows/copilot-setup-steps.yml
@@ -9,13 +9,13 @@ on:
     paths:
       - .github/workflows/copilot-setup-steps.yml
 
+permissions:
+  contents: read
+
 jobs:
   copilot-setup-steps:
     runs-on: ubuntu-latest
 
-    permissions:
-      contents: read
-
     steps:
       - name: Checkout code
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

From 3f7c361430da0b9e1bb56e6d13f22da82ad1d1b2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?M=C3=A5ns=20Th=C3=B6rnvik?= <thornvik.mans@gmail.com>
Date: Sat, 23 May 2026 18:16:45 +0200
Subject: [PATCH 6/6] build: derive Go bin path for lint install

Derive GOPATH/GOBIN in the Makefiles so the lint install target works even when GOPATH is not preset in the environment.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 Makefile | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index 4e3fe7e..72005e2 100644
--- a/Makefile
+++ b/Makefile
@@ -1,3 +1,6 @@
+GOPATH ?= $(shell go env GOPATH)
+GOBIN ?= $(GOPATH)/bin
+
 unittest-json:
 	@mkdir -p build
 	@go test -v -json -coverprofile=build/coverage.out -covermode=atomic ./... -timeout 20s -failfast > build/unit-test-output.json
@@ -15,7 +18,7 @@ vulncheck-sarif:
 	@go tool -modfile=./tools/go.mod govulncheck -format sarif ./... > build/govulncheck-report.sarif
 
 install-lint:
-	curl -sSfL https://golangci-lint.run/install.sh | sh -s -- -b $(go env GOPATH)/bin v2.12.2
+	curl -sSfL https://golangci-lint.run/install.sh | sh -s -- -b $(GOBIN) v2.12.2
 
 build:
 	@go build ./...