Fix and harden GitHub automation

.github/CODEOWNERS

@@ -0,0 +1,8 @@
+# SPDX-FileCopyrightText: 2026 ByteDance Ltd. and/or its affiliates
+# SPDX-License-Identifier: Apache-2.0
+
+# Route project-wide reviews to the repository maintainers.
+* @jdpraveen @PICO-XR-Dev
+
+# Changes to repository automation and ownership rules require the same owners.
+/.github/ @jdpraveen @PICO-XR-Dev

.github/dependabot.yml

@@ -0,0 +1,14 @@
+# SPDX-FileCopyrightText: 2026 ByteDance Ltd. and/or its affiliates
+# SPDX-License-Identifier: Apache-2.0
+
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      github-actions:
+        patterns:
+          - "*"
+    open-pull-requests-limit: 5

.github/workflows/ci.yml

@@ -85,11 +85,13 @@ jobs:
   vcpkg:
     name: vcpkg overlay package consumer
     runs-on: ubuntu-latest
-    env:
-      VCPKG_ROOT: ${{ runner.temp }}/vcpkg
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
+      - name: Configure vcpkg path
+        shell: bash
+        run: echo "VCPKG_ROOT=${RUNNER_TEMP}/vcpkg" >> "${GITHUB_ENV}"
+
       - name: Bootstrap pinned vcpkg
         run: |
           git clone --depth 1 --branch 2026.07.29 \
@@ -335,3 +337,36 @@ jobs:
       - name: Run pathological input tests explicitly
         shell: bash
         run: ctest --test-dir out/build-debug --output-on-failure -R '^pjson\.pathological_'
+
+  required:
+    name: Required CI checks
+    if: always()
+    needs:
+      - licensing
+      - fuzz
+      - distribution
+      - conan
+      - vcpkg
+      - build-test
+      - msvc
+      - format
+      - tidy
+      - benchmark
+      - benchmark-compare
+      - conformance
+      - lsan
+    runs-on: ubuntu-latest
+    steps:
+      - name: Require every CI job to succeed
+        env:
+          REQUIRED_RESULTS: ${{ toJSON(needs) }}
+        shell: bash
+        run: |
+          if jq -e 'all(.[]; .result == "success")' <<<"${REQUIRED_RESULTS}"; then
+            exit 0
+          fi
+
+          jq -r 'to_entries[] | select(.value.result != "success") |
+            "::error title=Required CI job did not succeed::\(.key): \(.value.result)"' \
+            <<<"${REQUIRED_RESULTS}"
+          exit 1

.github/workflows/codeql.yml

@@ -0,0 +1,38 @@
+# SPDX-License-Identifier: Apache-2.0
+
+name: CodeQL
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+  schedule:
+    - cron: "17 9 * * 1"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  analyze:
+    name: Analyze C++
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      security-events: write
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@486fec2a3ea2626afcd8c7e9208b4f515078dd7e # codeql-bundle-v2.26.4
+        with:
+          languages: c-cpp
+          build-mode: manual
+
+      - name: Build library and tests
+        shell: bash
+        run: ./build.sh --clean --debug-only --auto
+
+      - name: Analyze
+        uses: github/codeql-action/analyze@486fec2a3ea2626afcd8c7e9208b4f515078dd7e # codeql-bundle-v2.26.4

.github/workflows/dependency-review.yml

@@ -0,0 +1,19 @@
+# SPDX-License-Identifier: Apache-2.0
+
+name: Dependency review
+
+on:
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  review:
+    name: Review dependency changes
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Review dependency changes
+        uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0

.github/workflows/docs.yml

@@ -42,15 +42,19 @@ jobs:
           if-no-files-found: error
 
       - name: Prepare GitHub Pages artifact
-        if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'
+        if: >-
+          github.ref == 'refs/heads/main' &&
+          (github.event_name == 'push' || github.event_name == 'workflow_dispatch')
         id: pages-artifact
         uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3.0.1
         with:
           path: out/build-docs/docs/reference/html
 
   pages:
     name: Publish API reference to GitHub Pages
-    if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'
+    if: >-
+      github.ref == 'refs/heads/main' &&
+      (github.event_name == 'push' || github.event_name == 'workflow_dispatch')
     needs: reference
     runs-on: ubuntu-latest
     permissions:

README.md

@@ -6,7 +6,7 @@
 - A single class, `ByteDance::pjson`, represents any JSON value (null, bool,
   number, string, array, or object) and provides an ergonomic
   `obj["key"][i] = value` style API.
-- Licensed under Apache-2.0; please keep credit to the author, Praveen Babu J D.
+- Licensed under Apache-2.0;
 - Current source version: **1.0.0** (`pjson::getVersion()` / the
   `PJSON_VERSION` macro). This version remains unreleased until the
   `release-1.0.0` tag is published.

docs/12-custom-allocators.md

@@ -191,5 +191,7 @@ CountingAllocator storage;
 - The hook covers persistent DOM nodes and wrapper objects, not every allocation
   made by their standard-library internals or temporary algorithms.
 
-Return to the [tutorial index](README.md), or consult the
+Return to the
+[tutorial index](https://github.com/Pico-Developer/pjson/blob/main/docs/README.md),
+or consult the
 [browsable API reference](https://pico-developer.github.io/pjson/).