From ef66e1f7b1c77072aa67f9cb7788311e1df0b03d Mon Sep 17 00:00:00 2001
From: alexps9 <23210240262@m.fudan.edu.cn>
Date: Thu, 16 Jul 2026 14:37:11 +0800
Subject: [PATCH 1/2] ci(docs): split build/deploy jobs so PRs don't hit the
 github-pages environment gate

- build job (checkout/setup-node/build/upload-artifact) runs unconditionally, no environment attached
- deploy job (environment: github-pages) only runs on push to main / workflow_dispatch, and needs: build
- this was previously blocking any PR that touched an action pinned in docs.yml (e.g. dependabot version bumps) with an instant, log-less failure due to the github-pages environment's branch policy

Also: dependabot.yml - group github-actions updates into a single PR, and stop suggesting docker python major/minor bumps (needs manual compat review).
Co-authored-by: Cursor <cursoragent@cursor.com>
---
 .github/dependabot.yml     | 16 ++++++++++++++--
 .github/workflows/docs.yml | 26 ++++++++++++++++++--------
 2 files changed, 32 insertions(+), 10 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index e3df1d6..29de3dc 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -42,22 +42,34 @@ updates:
       - "dependencies"
       - "javascript"
 
-  # GitHub Actions workflows
+  # GitHub Actions workflows — grouped into a single PR per update cycle so
+  # a fresh dependabot.yml doesn't open a flood of one-action-per-PR noise.
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
       interval: "weekly"
+    groups:
+      github-actions:
+        patterns:
+          - "*"
     commit-message:
       prefix: "chore(ci)"
     labels:
       - "dependencies"
       - "ci"
 
-  # Docker base images
+  # Docker base images. Major-version bumps (e.g. a new Python minor/major
+  # release like 3.11 -> 3.14) are intentionally excluded: those need a
+  # manual compatibility check (native deps, wheel availability) rather than
+  # an auto-generated PR. Patch/minor updates on the pinned line still flow
+  # through normally.
   - package-ecosystem: "docker"
     directory: "/"
     schedule:
       interval: "weekly"
+    ignore:
+      - dependency-name: "python"
+        update-types: ["version-update:semver-major", "version-update:semver-minor"]
     commit-message:
       prefix: "chore(docker)"
     labels:
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index 60ace9b..e7d091d 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -17,18 +17,15 @@ on:
 
 permissions:
   contents: read
-  pages: write
-  id-token: write
 
 concurrency:
   group: docs-pages
   cancel-in-progress: true
 
 jobs:
-  build-and-publish:
+  build:
+    name: Build
     runs-on: ubuntu-latest
-    environment:
-      name: github-pages
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -50,16 +47,29 @@ jobs:
           NODE_PATH: ${{ github.workspace }}/node_modules
 
       - name: Ensure .nojekyll
-        if: github.ref == 'refs/heads/main' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch')
         run: touch docs/_book/.nojekyll
 
+      # Uploading the Pages artifact does not require the `github-pages`
+      # deployment environment — only the actual deploy step below does.
+      # Keeping this in the build job means PRs get a build/lint signal
+      # without needing environment approval or protected-branch access.
       - name: Upload Pages artifact
-        if: github.ref == 'refs/heads/main' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch')
         uses: actions/upload-pages-artifact@v5
         with:
           path: docs/_book
 
+  deploy:
+    name: Deploy
+    if: github.ref == 'refs/heads/main' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch')
+    needs: build
+    runs-on: ubuntu-latest
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    permissions:
+      pages: write
+      id-token: write
+    steps:
       - name: Deploy to GitHub Pages
-        if: github.ref == 'refs/heads/main' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch')
         id: deployment
         uses: actions/deploy-pages@v4

From f812202c45809edcbbdcacb3fb9cc17de4f4f812 Mon Sep 17 00:00:00 2001
From: alexps9 <23210240262@m.fudan.edu.cn>
Date: Thu, 16 Jul 2026 14:45:07 +0800
Subject: [PATCH 2/2] fix(ci): update first-interaction@v3 input names
 (repo_token/issue_message/pr_message)

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 .github/workflows/greetings.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/greetings.yml b/.github/workflows/greetings.yml
index 53de84b..d0920e2 100644
--- a/.github/workflows/greetings.yml
+++ b/.github/workflows/greetings.yml
@@ -16,14 +16,14 @@ jobs:
     steps:
       - uses: actions/first-interaction@v3
         with:
-          repo-token: ${{ secrets.GITHUB_TOKEN }}
-          issue-message: >
+          repo_token: ${{ secrets.GITHUB_TOKEN }}
+          issue_message: >
             👋 Thanks for opening your first issue in AgentGuard! A maintainer
             will take a look soon. In the meantime, please make sure you've
             included enough detail to reproduce the problem (see the issue
             template checklist) — see [CONTRIBUTING.md](https://github.com/WhitzardAgent/AgentGuard/blob/main/CONTRIBUTING.md)
             for more on how the project is organized.
-          pr-message: >
+          pr_message: >
             🎉 Thanks for your first pull request to AgentGuard! A maintainer
             will review it soon. While you wait, please double-check the PR
             checklist and make sure `ruff check src tests`, `pytest -q`, and