From 28946e201f643fde22e94428785a78dea0619b2e Mon Sep 17 00:00:00 2001
From: Randolf Jung <randolf@mathematic.io>
Date: Sat, 26 Sep 2026 11:21:19 -0700
Subject: [PATCH] ci(dependabot): require successful Pages PR checks

---
 .github/workflows/dependabot-automerge.yml | 18 +++++---------
 .github/workflows/pages-check.yml          | 29 ++++++++++++++++++++++
 .github/workflows/pages.yml                |  4 +--
 3 files changed, 36 insertions(+), 15 deletions(-)
 create mode 100644 .github/workflows/pages-check.yml

diff --git a/.github/workflows/dependabot-automerge.yml b/.github/workflows/dependabot-automerge.yml
index 88851ba..85f9a51 100644
--- a/.github/workflows/dependabot-automerge.yml
+++ b/.github/workflows/dependabot-automerge.yml
@@ -40,10 +40,8 @@ jobs:
 
             checks=$(gh api "repos/$GITHUB_REPOSITORY/commits/$PR_HEAD_SHA/check-runs?per_page=100")
             if jq -e '
-              .check_runs
-              | map({key: [.name, .app.id], run: .})
-              | group_by(.key)
-              | map(max_by([.run.started_at, .run.id]) | .run) as $latest
+              .total_count <= 100 and
+              (.check_runs as $runs
               | ([
                   ["CI", 15368],
                   ["Check", 15368],
@@ -52,17 +50,13 @@ jobs:
                   ["Analyze (actions)", 15368],
                   ["Analyze (javascript-typescript)", 15368]
                 ] | all(.[]; . as $required |
-                  ($latest | any(.[];
-                    .name == $required[0] and .app.id == $required[1] and
-                    .status == "completed" and .conclusion == "success"
-                  ))
+                  ($runs | map(select(.name == $required[0] and .app.id == $required[1]))) as $found
+                  | ($found | length > 0 and all(.[]; .status == "completed" and .conclusion == "success"))
                 ))
-              and ($latest | all(.[];
+              and ($runs | all(.[];
                 .name == "Strict Dependabot gate" or
-                .name == "Enable auto-merge" or
-                (.name == "deploy" and .status == "completed" and .conclusion == "skipped") or
                 (.status == "completed" and .conclusion == "success")
-              ))
+              )))
             ' <<< "$checks" > /dev/null; then
               echo "All exact-head checks passed on $PR_HEAD_SHA."
               exit 0
diff --git a/.github/workflows/pages-check.yml b/.github/workflows/pages-check.yml
new file mode 100644
index 0000000..0ea677b
--- /dev/null
+++ b/.github/workflows/pages-check.yml
@@ -0,0 +1,29 @@
+name: Check Docs for GitHub Pages
+
+on:
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    name: Build Pages
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      contents: read
+      pages: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0
+      - uses: actions/jekyll-build-pages@44a6e6beabd48582f863aeeb6cb2151cc1716697 # v1.0.13
+        with:
+          source: ./docs
+          destination: ./_site
+      - uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
+        with:
+          path: ./_site
diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml
index e17664c..283eea0 100644
--- a/.github/workflows/pages.yml
+++ b/.github/workflows/pages.yml
@@ -3,8 +3,6 @@ name: Deploy Docs to GitHub Pages
 on:
   push:
     branches: [main]
-  pull_request:
-    branches: [main]
   workflow_dispatch:
 
 concurrency:
@@ -36,7 +34,7 @@ jobs:
           path: ./_site
 
   deploy:
-    if: github.ref == 'refs/heads/main' && github.event_name != 'pull_request'
+    if: github.ref == 'refs/heads/main'
     needs: build
     runs-on: ubuntu-latest
     timeout-minutes: 10