chore: replicate locksmith workflow updates

.github/copilot/mcp.json

@@ -0,0 +1,11 @@
+{
+  "mcpServers": {
+    "github": {
+      "type": "http",
+      "url": "https://api.githubcopilot.com/mcp/",
+      "headers": {
+        "Authorization": "Bearer ${GITHUB_TOKEN}"
+      }
+    }
+  }
+}

.github/workflows/copilot-setup-steps.yml

@@ -0,0 +1,47 @@
+name: "Copilot Setup Steps"
+
+on:
+  workflow_dispatch:
+  push:
+    paths:
+      - .github/workflows/copilot-setup-steps.yml
+  pull_request:
+    paths:
+      - .github/workflows/copilot-setup-steps.yml
+
+permissions:
+  contents: read
+
+jobs:
+  copilot-setup-steps:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Set up Go
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+        with:
+          go-version: "stable"
+          cache: false
+
+      - name: Cache Go modules and build cache
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        with:
+          path: |
+            ~/go/pkg/mod
+            ~/.cache/go-build
+          key: copilot-go-${{ hashFiles('go.sum', 'tools/go.sum') }}
+          restore-keys: copilot-go-
+
+      - name: Download Go module dependencies
+        run: |
+          go mod download
+          go mod download -modfile tools/go.mod
+
+      - name: Install golangci-lint
+        run: make install-lint
+
+      - name: Warm up govulncheck
+        run: go tool -modfile tools/go.mod govulncheck -version

.github/workflows/dependabot-auto-approve.yaml

@@ -42,8 +42,14 @@ jobs:
             gh pr merge --auto -s "$PR_URL"
           fi
 
-      - name: Re-approve after force-update if auto-merge was already configured
-        if: steps.metadata.outcome == 'failure' && github.event.action == 'synchronize'
+      - name: Re-approve after branch update if auto-merge was already configured
+        # Runs on synchronize events where step 4 would be skipped — i.e. when fetch-metadata
+        # either failed (outcome=failure) or returned an empty/unexpected update-type.
+        # The auto-merge check inside the script guards against re-approving major updates.
+        if: >-
+          github.event.action == 'synchronize' &&
+          steps.metadata.outputs.update-type != 'version-update:semver-patch' &&
+          steps.metadata.outputs.update-type != 'version-update:semver-minor'
         env:
           PR_URL: ${{ github.event.pull_request.html_url }}
           GH_TOKEN: ${{ steps.app-token.outputs.token }}

Makefile

@@ -1,3 +1,6 @@
+GOPATH ?= $(shell go env GOPATH)
+GOBIN ?= $(GOPATH)/bin
+
 unittest-json:
 	@mkdir -p build
 	@go test -v -json -coverprofile=build/coverage.out -covermode=atomic ./... -timeout 20s -failfast > build/unit-test-output.json
@@ -14,5 +17,8 @@ vulncheck-sarif:
 	@mkdir -p build
 	@go tool -modfile=./tools/go.mod govulncheck -format sarif ./... > build/govulncheck-report.sarif
 
+install-lint:
+	curl -sSfL https://golangci-lint.run/install.sh | sh -s -- -b $(GOBIN) v2.12.2
+
 build:
 	@go build ./...