chore: Change dependabot configuration and action versions (also add DCO)

Signed-off-by: Austin Ziegler <austin@zieglers.ca>

Author: halostatue

.github/dependabot.yml

@@ -4,15 +4,31 @@ updates:
   - package-ecosystem: github-actions
     directory: /
     schedule:
-      interval: weekly
+      interval: monthly
     commit-message:
       prefix: 'deps'
+    cooldown:
+      default-days: 7
+    groups:
+      actions:
+        applies-to: version-updates
+        update-types:
+          - minor
+          - patch
 
   - package-ecosystem: bundler
     directory: /
     schedule:
-      interval: weekly
+      interval: monthly
     commit-message:
       prefix: 'deps'
+    cooldown:
+      default-days: 7
+    groups:
+      bundler:
+        applies-to: version-updates
+        update-types:
+          - minor
+          - patch
     ignore:
       - dependency-name: mime-types-data

.github/workflows/ci.yml

@@ -37,7 +37,7 @@ jobs:
         with:
           persist-credentials: false
 
-      - uses: ruby/setup-ruby@0481980f17b760ef6bca5e8c55809102a0af1e5a # v1.263.0
+      - uses: ruby/setup-ruby@ab177d40ee5483edb974554986f56b33477e21d0 # v1.265.0
         with:
           ruby-version: '3.4'
           rubygems: latest
@@ -73,7 +73,7 @@ jobs:
         with:
           persist-credentials: false
 
-      - uses: ruby/setup-ruby@0481980f17b760ef6bca5e8c55809102a0af1e5a # v1.263.0
+      - uses: ruby/setup-ruby@ab177d40ee5483edb974554986f56b33477e21d0 # v1.265.0
         with:
           ruby-version: '3.4'
           rubygems: latest
@@ -129,7 +129,7 @@ jobs:
         with:
           persist-credentials: false
 
-      - uses: ruby/setup-ruby@0481980f17b760ef6bca5e8c55809102a0af1e5a # v1.263.0
+      - uses: ruby/setup-ruby@ab177d40ee5483edb974554986f56b33477e21d0 # v1.265.0
         with:
           ruby-version: ${{ matrix.ruby }}
           rubygems: latest
@@ -148,9 +148,9 @@ jobs:
       fail-fast: false
       matrix:
         os:
-          - macos-13
           - macos-14
           - macos-15
+          - macos-26
         ruby:
           - '2.6'
           - '2.7'
@@ -178,7 +178,7 @@ jobs:
         with:
           persist-credentials: false
 
-      - uses: ruby/setup-ruby@0481980f17b760ef6bca5e8c55809102a0af1e5a # v1.263.0
+      - uses: ruby/setup-ruby@ab177d40ee5483edb974554986f56b33477e21d0 # v1.265.0
         with:
           ruby-version: ${{ matrix.ruby }}
           rubygems: latest
@@ -230,7 +230,7 @@ jobs:
         with:
           persist-credentials: false
 
-      - uses: ruby/setup-ruby@0481980f17b760ef6bca5e8c55809102a0af1e5a # v1.263.0
+      - uses: ruby/setup-ruby@ab177d40ee5483edb974554986f56b33477e21d0 # v1.265.0
         with:
           ruby-version: ${{ matrix.ruby }}
           rubygems: latest
@@ -276,7 +276,7 @@ jobs:
         with:
           persist-credentials: false
 
-      - uses: ruby/setup-ruby@0481980f17b760ef6bca5e8c55809102a0af1e5a # v1.263.0
+      - uses: ruby/setup-ruby@ab177d40ee5483edb974554986f56b33477e21d0 # v1.265.0
         with:
           ruby-version: ${{ matrix.ruby }}
           rubygems: latest
@@ -322,7 +322,7 @@ jobs:
         with:
           persist-credentials: false
 
-      - uses: ruby/setup-ruby@0481980f17b760ef6bca5e8c55809102a0af1e5a # v1.263.0
+      - uses: ruby/setup-ruby@ab177d40ee5483edb974554986f56b33477e21d0 # v1.265.0
         with:
           ruby-version: ${{ matrix.ruby }}
           rubygems: latest

.github/workflows/dco-check.yml

@@ -0,0 +1,26 @@
+name: Check DCO
+
+on:
+  pull_request:
+
+permissions: {}
+
+jobs:
+  check-dco:
+    name: Check DCO
+    runs-on: ubuntu-latest
+
+    permissions:
+      contents: read
+
+    steps:
+      - name: Harden the runner
+        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+        with:
+          egress-policy: block
+          disable-sudo: true
+          allowed-endpoints: >
+            api.github.com:443
+            github.com:443
+
+      - uses: KineticCafe/actions-dco@1c23966ecce077f76671a61caabeb13eefc72a51 # v1.3.8

.github/workflows/dependency-review.yml

@@ -38,4 +38,4 @@ jobs:
           persist-credentials: false
 
       - name: 'Dependency Review'
-        uses: actions/dependency-review-action@56339e523c0409420f6c2c9a2f4292bbb3c07dd3 # v4.8.0
+        uses: actions/dependency-review-action@40c09b7dc99638e5ddb0bfd91c1673effc064d8a # v4.8.1

.github/workflows/publish-docs.yml

@@ -0,0 +1,63 @@
+name: Publish docs
+
+on:
+  workflow_dispatch:
+
+  workflow_call:
+
+permissions: {}
+
+concurrency:
+  group: publish-docs-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  publish_docs:
+    name: Publish docs from main
+    runs-on: ubuntu-latest
+    environment: release
+
+    permissions:
+      contents: read
+      pages: write    # Publish documentation to pages
+      id-token: write # Publish documentation to pages
+
+    steps:
+      - name: Harden the runner
+        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+        with:
+          egress-policy: audit
+
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          persist-credentials: false
+
+      - id: rubygems
+        run: |
+          ruby -e \
+            'print "version=", Gem::Specification.load(ARGV[0]).rubygems_version, "\n"' \
+            mime-types.gemspec >>"${GITHUB_OUTPUT}"
+
+      - uses: ruby/setup-ruby@ab177d40ee5483edb974554986f56b33477e21d0 # v1.265.0
+        with:
+          bundler-cache: false
+          ruby-version: ruby
+
+      - name: Install dependencies
+        run: |
+          gem update --system="${RUBYGEMS_VERSION}"
+          bundle install --jobs 4 --retry 3
+        env:
+          RUBYGEMS_VERSION: ${{ steps.rubygems.outputs.version }}
+
+      - name: Build documentation
+        run: |
+          rake docs
+
+      - name: Upload documentation artifact
+        uses: actions/upload-pages-artifact@7b1f4a764d45c48632c6b24a0339c27f5614fb0b # v4.0.0
+        with:
+          path: doc
+
+      - name: Deploy documentation
+        uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4.0.5

.github/workflows/publish-gem.yml

@@ -35,8 +35,8 @@ jobs:
       rubygems_release_gem: true
 
     permissions:
-      contents: write
-      id-token: write
+      contents: write # Create a new tag
+      id-token: write # Authenticate for gem publishing
 
     steps:
       - name: Harden the runner
@@ -64,7 +64,7 @@ jobs:
             'print "version=", Gem::Specification.load(ARGV[0]).rubygems_version, "\n"' \
             mime-types.gemspec >>"${GITHUB_OUTPUT}"
 
-      - uses: ruby/setup-ruby@0481980f17b760ef6bca5e8c55809102a0af1e5a # v1.263.0
+      - uses: ruby/setup-ruby@ab177d40ee5483edb974554986f56b33477e21d0 # v1.265.0
         with:
           bundler-cache: false
           ruby-version: ruby
@@ -77,3 +77,17 @@ jobs:
           RUBYGEMS_VERSION: ${{ steps.rubygems.outputs.version }}
 
       - uses: rubygems/release-gem@a25424ba2ba8b387abc8ef40807c2c85b96cbe32 # v1.1.1
+
+      - name: Show the status if release failed
+        if: failure()
+        run: |
+          git status
+          git diff
+
+  publish_docs:
+    needs: release
+    permissions:
+      contents: read
+      pages: write    # Publish documentation
+      id-token: write # Authenticate for gem publishing
+    uses: ./.github/workflows/publish-docs.yml

.github/workflows/reviewdog.yml

@@ -17,7 +17,7 @@ jobs:
 
     permissions:
       contents: read
-      pull-requests: write
+      pull-requests: write # Reviewdog comments on pull requests
 
     steps:
       - name: Harden Runner
@@ -36,7 +36,7 @@ jobs:
         with:
           persist-credentials: false
 
-      - uses: reviewdog/action-typos@fe961cdbe416990b23bc1597325891575ef2dd7c # v1.18.0
+      - uses: reviewdog/action-typos@d5eb1bbcd1b3bfde596f6eeb470322727862fe98 # v1.19.0
 
   actionlint:
     if: ${{ github.event.action != 'closed' }}
@@ -45,7 +45,7 @@ jobs:
 
     permissions:
       contents: read
-      pull-requests: write
+      pull-requests: write # Reviewdog comments on pull requests
 
     steps:
       - name: Harden Runner
@@ -61,4 +61,4 @@ jobs:
         with:
           persist-credentials: false
 
-      - uses: reviewdog/action-actionlint@95395aac8c053577d0bc67eb7b74936c660c6f66 # v1.67.0
+      - uses: reviewdog/action-actionlint@f00ad0691526c10be4021a91b2510f0a769b14d0 # v1.68.0