ci: address Dependabot updates and workflow maintenance

.github/dependabot.yml

@@ -0,0 +1,12 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: weekly
+      day: monday
+    open-pull-requests-limit: 5
+    groups:
+      actions-minor-and-patch:
+        patterns: ["*"]
+        update-types: [minor, patch]

.github/workflows/continuous-deployment.yml

@@ -9,6 +9,7 @@ permissions:
   pull-requests: write
 jobs:
   release-please:
+    if: github.repository == 'CHIMEFRB/datatrail-cli'
     runs-on: ubuntu-latest
     steps:
       - name: Create release
@@ -23,7 +24,7 @@ jobs:
 
       - name: Install uv
         if: ${{ steps.release-please.outputs.release_created }}
-        uses: astral-sh/setup-uv@v10.0.1
+        uses: astral-sh/setup-uv@v10.2.0
         with:
           enable-cache: false
           python-version: "3.13"

.github/workflows/continuous-integration.yml

@@ -49,7 +49,7 @@ jobs:
       - uses: actions/checkout@v7
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v10.0.1
+        uses: astral-sh/setup-uv@v10.2.0
         with:
           enable-cache: true
           cache-dependency-glob: "uv.lock"
@@ -100,7 +100,7 @@ jobs:
           fail-on-error: false
 
       - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@v3
+        uses: codecov/codecov-action@v7.1.1
         with:
           fail_ci_if_error: false
           token: ${{ secrets.CODECOV_TOKEN }}

.github/workflows/docs.yml

@@ -1,21 +1,44 @@
 name: Documentation
 on:
   push:
-    branches:
-      - main
+    branches: [main]
     paths:
       - "docs/**"
+      - "mkdocs*.yml"
+      - "pyproject.toml"
+      - "uv.lock"
       - ".github/workflows/docs.yml"
+  pull_request:
+    paths:
+      - "docs/**"
+      - "mkdocs*.yml"
+      - "pyproject.toml"
+      - "uv.lock"
+      - ".github/workflows/docs.yml"
+  workflow_dispatch:
 
 permissions:
   contents: read
 
 jobs:
-  mkdocs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: astral-sh/setup-uv@v10.2.0
+        with:
+          python-version: "3.13"
+          enable-cache: true
+      - run: uv sync --locked --group docs
+      - run: uv run --no-sync mkdocs build --strict --config-file mkdocs-site.yml
+
+  handbook:
+    if: github.repository == 'CHIMEFRB/datatrail-cli' && github.event_name == 'push'
+    needs: build
     runs-on: ubuntu-latest
     steps:
-      - name: Build chimefrb/handbook
-        uses: peter-evans/repository-dispatch@v3
+      - name: Build the upstream handbook
+        uses: peter-evans/repository-dispatch@v4.0.1
         with:
           token: ${{ secrets.BUILD_HANDBOOK_TOKEN }}
           repository: chimefrb/handbook

.github/workflows/stale.yml

@@ -11,10 +11,11 @@ permissions:
 
 jobs:
   close_stale_prs:
+    if: github.repository == 'CHIMEFRB/datatrail-cli'
     runs-on: ubuntu-latest
     steps:
       - name: Close stale pull requests
-        uses: actions/stale@v9
+        uses: actions/stale@v11.0.0
         with:
           days-before-stale: 90
           days-before-close: 7