🧹 Clean Up

.github/dependabot.yml

@@ -1,26 +1,26 @@
 version: 2
 updates:
-    - package-ecosystem: "bundler"
-      directory: "/"
-      schedule:
-        interval: "weekly"
-        day: "monday"
-        time: "09:00"
-        timezone: "UTC"
-      open-pull-requests-limit: 10
-      groups:
-        # only minor/patch updates
-        all:
-          patterns:
-            - "*"
-          update-types:
-            - "minor"
-            - "patch"
-      # Ignore any breaking changes
-      ignore:
-        - dependency-name: "*"
-          update-types:
-            - "version-update:semver-major"
+  - package-ecosystem: "bundler"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "09:00"
+      timezone: "UTC"
+    open-pull-requests-limit: 10
+    groups:
+      # only minor/patch updates
+      all:
+        patterns:
+          - "*"
+        update-types:
+          - "minor"
+          - "patch"
+    # Ignore any breaking changes
+    ignore:
+      - dependency-name: "*"
+        update-types:
+          - "version-update:semver-major"
 
   # CI
   - package-ecosystem: "github-actions"

.github/workflows/automerge.yml

@@ -1,18 +1,70 @@
 name: Dependabot auto-merge
-
 on: pull_request_target
 
-permissions:
-  contents: write
-  pull-requests: write
-
 jobs:
-  automerge:
+  build:
+    runs-on: ubuntu-24.04
+    if: github.actor == 'dependabot[bot]'
+    permissions:
+      contents: read
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+
+      - name: Set up Ruby
+        uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: '3.3'
+          bundler-cache: true
+
+      # fails on build errors
+      - name: Build site
+        run: |
+          bundle exec jekyll build \
+          --strict_front_matter \
+          --future \
+          --destination _site \
+          --baseurl "${{ steps.pages.outputs.base_path }}"
+        env:
+          JEKYLL_ENV: production
+
+  scan:
     runs-on: ubuntu-24.04
     if: github.actor == 'dependabot[bot]'
+    permissions:
+      contents: read
+      security-events: write
+      actions: read
     steps:
-      - uses: fastify/github-action-merge-dependabot@v3
+      - name: Check out repository
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+
+      - name: Scan using grype
+        id: scan
+        uses: anchore/scan-action@v7.4.0
+        with:
+          path: "."
+          by-cve: true
+          output-format: sarif
+
+      - name: Upload SARIF report
+        if: always()
+        uses: github/codeql-action/upload-sarif@v4
         with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-          target: minor
-          use-github-auto-merge: true
+          sarif_file: ${{ steps.scan.outputs.sarif }}
+
+  automerge:
+    runs-on: ubuntu-24.04
+    if: github.actor == 'dependabot[bot]'
+    needs:
+      - build
+      - scan
+    permissions:
+      contents: write
+      pull-requests: write
+    steps:
+      - uses: fastify/github-action-merge-dependabot@v3

.github/workflows/deploy.yml

@@ -0,0 +1,68 @@
+name: Build and Deploy Website
+
+on:
+  push:
+    branches: [ master ]
+  pull_request:
+    branches: [ master ]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  pages: write
+  id-token: write
+
+concurrency:
+  group: "pages"
+  cancel-in-progress: true
+
+jobs:
+  build:
+    # don't run if dependabot - handled in own workflow
+    if: github.actor != 'dependabot[bot]'
+    runs-on: ubuntu-24.04
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Set up Ruby
+        uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: '3.3'
+          bundler-cache: true
+
+      # only configure on push to master
+      - uses: actions/configure-pages@v5
+        id: pages
+        if: github.event_name == 'push' && github.ref == 'refs/heads/master'
+
+      # fails on build errors
+      - name: Build site
+        run: |
+          bundle exec jekyll build \
+          --strict_front_matter \
+          --future \
+          --destination _site \
+          --baseurl "${{ steps.pages.outputs.base_path }}"
+        env:
+          JEKYLL_ENV: production
+
+
+      - name: Upload artifact
+        uses: actions/upload-pages-artifact@v3
+        if: github.event_name == 'push' && github.ref == 'refs/heads/master'
+        with:
+          path: _site
+
+  deploy:
+    needs: build
+    # only deploy on master
+    if: github.event_name == 'push' && github.ref == 'refs/heads/master'
+    runs-on: ubuntu-24.04
+    environment:
+      name: documentation
+      url: ${{ steps.deployment.outputs.page_url }}
+    steps:
+      - id: deployment
+        uses: actions/deploy-pages@v4

.github/workflows/security.yml

@@ -2,16 +2,17 @@ name: Security
 
 on:
   push:
-  pull_request:
   schedule:
     - cron: '0 9 * * 1'
 
 permissions:
   contents: read
   security-events: write
+  actions: read
 
 jobs:
   scan:
+    if: github.actor != 'dependabot[bot]'
     runs-on: ubuntu-24.04
     steps:
       - name: Check out repository
@@ -26,6 +27,7 @@ jobs:
           output-format: sarif
 
       - name: Upload SARIF report
+        if: always()
         uses: github/codeql-action/upload-sarif@v4
         with:
-          sarif_file: ${{ steps.scan.outputs.sarif }}
+          sarif_file: ${{ steps.scan.outputs.sarif }}

.gitignore

@@ -1,6 +1,27 @@
+# jekyll
+_site/
+.sass-cache/
+.jekyll-cache/
+.jekyll-metadata
+# Ignore folders generated by Bundler
+.bundle/
+vendor/
+
+
+# jetbrains
 *.iml
-.idea
+.idea/
+
+# vscode
+.vscode
+
+# mac
 .DS_Store
-node_modules
+
+# node
+node_modules/
+
+# secrets
 settings.production.json
-.env
+*.env
+*.memo

Dockerfile

@@ -0,0 +1,17 @@
+FROM ruby:3.3-alpine3.24 AS builder
+WORKDIR /app
+ARG BUNDLER_VERSION="4.0.18"
+# install build deps
+RUN apk --no-cache add build-base ruby-dev && gem install bundler -v $BUNDLER_VERSION
+COPY Gemfile Gemfile.lock /app/
+RUN bundle install
+
+FROM ruby:3.3-alpine3.24 AS runtime
+WORKDIR /app
+# install runtime deps
+RUN apk add --no-cache libstdc++
+# copy deps
+COPY --from=builder /usr/local/bundle /usr/local/bundle
+# launch server
+EXPOSE 4000
+ENTRYPOINT ["bundle", "exec", "jekyll", "serve", "--livereload", "--host", "0.0.0.0"]

Gemfile

@@ -7,27 +7,28 @@ source "https://rubygems.org"
 #
 # This will help ensure the proper Jekyll version is running.
 # Happy Jekylling!
-gem "jekyll", "~> 4.3.3"
+gem "jekyll", "~> 4.4.1"
 # This is the default theme for new Jekyll sites. You may change this to anything you like.
 gem "minima", "~> 2.5"
-gem 'jekyll-sitemap'
 # If you want to use GitHub Pages, remove the "gem "jekyll"" above and
 # uncomment the line below. To upgrade, run `bundle update github-pages`.
 # gem "github-pages", group: :jekyll_plugins
 # If you have any plugins, put them here!
 group :jekyll_plugins do
   gem "jekyll-feed", "~> 0.12"
+  gem "jekyll-sitemap", "~> 1.4"
 end
 
 # Windows and JRuby does not include zoneinfo files, so bundle the tzinfo-data gem
 # and associated library.
-platforms :mingw, :x64_mingw, :mswin, :jruby do
-  gem "tzinfo", "~> 1.2"
+platforms :windows, :jruby do
+  gem "tzinfo", ">= 1", "< 3"
   gem "tzinfo-data"
 end
 
 # Performance-booster for watching directories on Windows
-gem "wdm", "~> 0.1.1", :platforms => [:mingw, :x64_mingw, :mswin]
+gem "wdm", "~> 0.1", :platforms => [:windows]
 
-
-gem "webrick", "~> 1.8"
+# Lock `http_parser.rb` gem to `v0.6.x` on JRuby builds since newer versions of the gem
+# do not have a Java counterpart.
+gem "http_parser.rb", "~> 0.6.0", :platforms => [:jruby]