From eede795693aca39b52208135c52bb6480b1617d6 Mon Sep 17 00:00:00 2001
From: Bozhidar Batsov <bozhidar@batsov.dev>
Date: Tue, 15 Sep 2026 16:33:13 +0300
Subject: [PATCH 1/2] Create GitHub releases from the changelog on tag push

Publishes a release automatically whenever a version tag is pushed,
with the version's section of CHANGES.md as the body. Tags here are
bare (0.8.0, not v0.8.0), so the trigger matches anything starting
with a digit. Prereleases fall back to the unreleased section, which
is headed by the upcoming version ("## 0.8.1 (unreleased)") and so is
looked up by its marker. GitHub's generated notes cover the case where
neither has anything.
---
 .github/workflows/github-release.yml | 57 ++++++++++++++++++++++++++++
 1 file changed, 57 insertions(+)
 create mode 100644 .github/workflows/github-release.yml

diff --git a/.github/workflows/github-release.yml b/.github/workflows/github-release.yml
new file mode 100644
index 0000000..5111beb
--- /dev/null
+++ b/.github/workflows/github-release.yml
@@ -0,0 +1,57 @@
+name: Create GitHub Release
+
+on:
+  push:
+    tags:
+      - "[0-9]*"  # Trigger when a version tag is pushed (e.g., 0.8.0)
+
+jobs:
+  create-release:
+    # Snapshot tags only exist to exercise the deploy pipeline.
+    if: ${{ !endsWith(github.ref_name, '-SNAPSHOT') }}
+    runs-on: ubuntu-latest
+
+    permissions:
+      contents: write
+
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@v6
+
+      # The release notes are the version's section of the changelog. A
+      # prerelease usually has no section of its own yet, so it gets the
+      # unreleased one. If neither has anything, fall back to GitHub's
+      # generated notes rather than publish an empty release.
+      #
+      # Headings look like "## 0.8.0 (2026-06-29)", and the unreleased
+      # section is headed by the upcoming version, "## 0.8.1 (unreleased)",
+      # so it is found by the marker in the third field rather than by name.
+      - name: Extract the release notes from the changelog
+        id: notes
+        run: |
+          extract() {
+            awk -v field="$1" -v text="$2" '
+              /^## / { if (found) exit; found = ($field == text); next }
+              found { print }
+            ' CHANGES.md
+          }
+          extract 2 "$GITHUB_REF_NAME" > release-notes.md
+          if ! grep -q '[^[:space:]]' release-notes.md; then
+            extract 3 "(unreleased)" > release-notes.md
+          fi
+          if grep -q '[^[:space:]]' release-notes.md; then
+            echo "found=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "::warning::No changelog section for $GITHUB_REF_NAME, using generated notes instead."
+            echo "found=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Create GitHub Release
+        uses: ncipollo/release-action@v1
+        with:
+          tag: ${{ github.ref_name }}
+          name: Weasel ${{ github.ref_name }}
+          prerelease: ${{ contains(github.ref, '-rc') || contains(github.ref, '-alpha') || contains(github.ref, '-beta') }}
+          bodyFile: ${{ steps.notes.outputs.found == 'true' && 'release-notes.md' || '' }}
+          generateReleaseNotes: ${{ steps.notes.outputs.found != 'true' }}
+          token: ${{ secrets.GITHUB_TOKEN }}

From 68e98b71228a784d3bb05ab341e6b767e1e773f1 Mon Sep 17 00:00:00 2001
From: Bozhidar Batsov <bozhidar@batsov.dev>
Date: Tue, 15 Sep 2026 16:33:13 +0300
Subject: [PATCH 2/2] Keep GitHub Actions current with Dependabot

Monthly bumps for the action versions the workflows pin.
---
 .github/dependabot.yml | 6 ++++++
 1 file changed, 6 insertions(+)
 create mode 100644 .github/dependabot.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..3a626c3
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,6 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: monthly