ci: consolidate Haec gates, repair K9 envelopes and FFI validation

.github/dependabot.yml

@@ -1,57 +1,17 @@
 # SPDX-License-Identifier: MPL-2.0
-# Dependabot configuration for RSR-compliant repositories
-# Covers common ecosystems - remove unused ones for your project
+# Dependabot configuration for Haec's current dependency surface.
 
 version: 2
 updates:
-  # GitHub Actions - always include
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
       interval: "weekly"
+      day: "wednesday"
+      time: "13:37"
+      timezone: "Europe/London"
+    open-pull-requests-limit: 1
     groups:
       actions:
         patterns:
           - "*"
-
-  # Rust/Cargo
-  #
-  # `open-pull-requests-limit: 0` suppresses routine version-update PRs
-  # (no weekly patch-bump noise) while leaving Dependabot SECURITY PRs
-  # flowing. Under GitHub's current Dependabot behaviour (2024+), using
-  # an `ignore:` rule with `version-update:semver-patch` would ALSO
-  # silence security PRs that happen to be patch-level — historically
-  # the cause of estate-wide vulns sitting un-PR'd for weeks.
-  # `open-pull-requests-limit: 0` is the GitHub-endorsed way to say
-  # "security only, not routine bumps". Pair with the
-  # dependabot-automerge.yml workflow for low-touch security
-  # maintenance.
-  - package-ecosystem: "cargo"
-    directory: "/"
-    schedule:
-      interval: "weekly"
-    open-pull-requests-limit: 0
-
-  # Elixir/Mix
-  - package-ecosystem: "mix"
-    directory: "/"
-    schedule:
-      interval: "weekly"
-
-  # Node.js/npm
-  - package-ecosystem: "npm"
-    directory: "/"
-    schedule:
-      interval: "weekly"
-
-  # Python/pip
-  - package-ecosystem: "pip"
-    directory: "/"
-    schedule:
-      interval: "weekly"
-
-  # Nix flakes
-  - package-ecosystem: "nix"
-    directory: "/"
-    schedule:
-      interval: "weekly"

.github/workflows/ci.yml

@@ -0,0 +1,65 @@
+# SPDX-License-Identifier: MPL-2.0
+name: "CI / required"
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  required:
+    name: "CI / required"
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    container:
+      # Idris 2 0.7.0, pinned by immutable image digest.
+      image: ghcr.io/stefan-hoeck/idris2-pack@sha256:de9781906050dc44704ec6de0108c86f899ef17b2642932b79e00245d613b8ad
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Set up Zig
+        uses: goto-bus-stop/setup-zig@abea47f85e598557f500fa1fd2ab7464fcb39406 # v2.2.1
+        with:
+          version: 0.15.2
+
+      - name: Typecheck the Idris2 ABI
+        shell: bash
+        run: |
+          set -euo pipefail
+          idris2 --version | grep -Fx 'Idris 2, version 0.7.0'
+          idris2 --typecheck abi.ipkg
+
+      - name: Compile and test the Zig FFI
+        shell: bash
+        run: |
+          set -euo pipefail
+          test "$(zig version)" = '0.15.2'
+          zig fmt --check \
+            src/interface/ffi/build.zig \
+            src/interface/ffi/src/main.zig \
+            src/interface/ffi/test/integration_test.zig
+          (
+            cd src/interface/ffi
+            zig build --summary all
+            zig build test --summary all
+          )
+
+      - name: Validate repository contracts
+        shell: bash
+        run: |
+          set -euo pipefail
+          find tests scripts -type f -name '*.sh' -print0 \
+            | xargs -0 -r bash -n
+          bash tests/check-examples.sh
+          bash tests/aspect_tests.sh
+          bash scripts/check-root-shape.sh .
+          bash tests/workflows/validate_workflows_test.sh

.github/workflows/codeql.yml

@@ -9,6 +9,9 @@ on:
     - cron: '0 6 * * 1'
 permissions:
   contents: read
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
 jobs:
   analyze:
     runs-on: ubuntu-latest