From 2d781acd87c45cd33aa4dd88fc0fefd29384bd1a Mon Sep 17 00:00:00 2001
From: Saul Beck <saul.beck@stfc.ac.uk>
Date: Tue, 18 Aug 2026 09:53:37 +0100
Subject: [PATCH 01/10] CI: Address zizmor warnings and bump deps

---
 .github/workflows/build.yml         |  9 +++++++--
 .github/workflows/deploy.yml        |  2 ++
 .github/workflows/pr_pre-commit.yml |  9 +++++++--
 .github/workflows/ui.yml            | 10 ++++++++--
 4 files changed, 24 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 8873b2b67..3b4d5f44c 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -7,16 +7,21 @@ on:
       - .github/ISSUE_TEMPLATES/**
       - scripts/**
 
+permissions: {}
+
 jobs:
 
   build:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
-      - uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b # v4.1.5
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           submodules: true
           fetch-depth: 0
-      - uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 #tag=v4.0.2
+          persist-credentials: false
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: '20'
           cache: 'npm'
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index fb56a7796..e29f0404c 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -10,6 +10,8 @@ on:
     - cron: '15 2 * * 1-5'
   workflow_dispatch:
 
+permissions: {}
+
 jobs:
   build:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/pr_pre-commit.yml b/.github/workflows/pr_pre-commit.yml
index aeff8806b..5bb80c4d2 100644
--- a/.github/workflows/pr_pre-commit.yml
+++ b/.github/workflows/pr_pre-commit.yml
@@ -4,14 +4,19 @@ name: pre-commit
 on:
   pull_request:
 
+permissions: {}
+
 jobs:
   pre-commit:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
-      - uses: actions/setup-python@82c7e631bb3cdc910f68e0081d67478d79c6982d # v5.1.0
+          persist-credentials: false
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: '3.12'
       - uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd # v3.0.1
diff --git a/.github/workflows/ui.yml b/.github/workflows/ui.yml
index 15a912ed5..71ac85bf5 100644
--- a/.github/workflows/ui.yml
+++ b/.github/workflows/ui.yml
@@ -7,12 +7,18 @@ on:
       - 'ui/**'
       - 'package-lock.json'
 
+permissions: {}
+
 jobs:
   build:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-      - uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e # v4.3.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: '24'
           cache: npm

From f5decd414ae7f351b3a788ec47a68c53353f2553 Mon Sep 17 00:00:00 2001
From: Techassi <git@techassi.dev>
Date: Tue, 1 Sep 2026 12:48:31 +0200
Subject: [PATCH 02/10] ci: Switch to our own run-prek action

---
 .github/workflows/pr_pre-commit.yml | 24 ------------------------
 .github/workflows/pr_prek.yml       | 20 ++++++++++++++++++++
 2 files changed, 20 insertions(+), 24 deletions(-)
 delete mode 100644 .github/workflows/pr_pre-commit.yml
 create mode 100644 .github/workflows/pr_prek.yml

diff --git a/.github/workflows/pr_pre-commit.yml b/.github/workflows/pr_pre-commit.yml
deleted file mode 100644
index 5bb80c4d2..000000000
--- a/.github/workflows/pr_pre-commit.yml
+++ /dev/null
@@ -1,24 +0,0 @@
----
-name: pre-commit
-
-on:
-  pull_request:
-
-permissions: {}
-
-jobs:
-  pre-commit:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          fetch-depth: 0
-          persist-credentials: false
-      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
-        with:
-          python-version: '3.12'
-      - uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd # v3.0.1
-        with:
-          extra_args: "--from-ref ${{ github.event.pull_request.base.sha }} --to-ref ${{ github.event.pull_request.head.sha }}"
diff --git a/.github/workflows/pr_prek.yml b/.github/workflows/pr_prek.yml
new file mode 100644
index 000000000..d46ea11ff
--- /dev/null
+++ b/.github/workflows/pr_prek.yml
@@ -0,0 +1,20 @@
+---
+name: prek
+
+on:
+  pull_request:
+
+permissions: {}
+
+jobs:
+  prek:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - uses: stackabletech/actions/run-prek@e8aed001d347bcf693e41b61f4098b0cb94b4ab6 # v0.18.0

From 247761aa6b6d5791553f26c22c2168d78855f51f Mon Sep 17 00:00:00 2001
From: Techassi <git@techassi.dev>
Date: Tue, 1 Sep 2026 12:50:56 +0200
Subject: [PATCH 03/10] ci: Quote env var in deploy workflow

---
 .github/workflows/deploy.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index e29f0404c..ecc44ed06 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -19,4 +19,4 @@ jobs:
       - name: Call Netlify build hook
         env:
           HOOK_URL: ${{ secrets.NETLIFY_BUILD_TRIGGER_HOOK }}
-        run: curl -X POST -d '{}' $HOOK_URL
+        run: curl -X POST -d '{}' "$HOOK_URL"

From 1b71a718bd70f1f581b6b7f2c8396a38250af2da Mon Sep 17 00:00:00 2001
From: Techassi <git@techassi.dev>
Date: Tue, 1 Sep 2026 12:51:43 +0200
Subject: [PATCH 04/10] ci: Change extention from yml to yaml

---
 .github/workflows/{build.yml => build.yaml}     | 0
 .github/workflows/{deploy.yml => deploy.yaml}   | 2 +-
 .github/workflows/{pr_prek.yml => pr_prek.yaml} | 0
 .github/workflows/{ui.yml => ui.yaml}           | 0
 4 files changed, 1 insertion(+), 1 deletion(-)
 rename .github/workflows/{build.yml => build.yaml} (100%)
 rename .github/workflows/{deploy.yml => deploy.yaml} (94%)
 rename .github/workflows/{pr_prek.yml => pr_prek.yaml} (100%)
 rename .github/workflows/{ui.yml => ui.yaml} (100%)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yaml
similarity index 100%
rename from .github/workflows/build.yml
rename to .github/workflows/build.yaml
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yaml
similarity index 94%
rename from .github/workflows/deploy.yml
rename to .github/workflows/deploy.yaml
index ecc44ed06..b859607db 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yaml
@@ -7,7 +7,7 @@ name: Build and deploy production site
 on:
   schedule:
     # Monday to Friday, 2:15 in the night
-    - cron: '15 2 * * 1-5'
+    - cron: "15 2 * * 1-5"
   workflow_dispatch:
 
 permissions: {}
diff --git a/.github/workflows/pr_prek.yml b/.github/workflows/pr_prek.yaml
similarity index 100%
rename from .github/workflows/pr_prek.yml
rename to .github/workflows/pr_prek.yaml
diff --git a/.github/workflows/ui.yml b/.github/workflows/ui.yaml
similarity index 100%
rename from .github/workflows/ui.yml
rename to .github/workflows/ui.yaml

From 2cdc80c56d52a4fec895e54e4de00cb98be295f7 Mon Sep 17 00:00:00 2001
From: Techassi <git@techassi.dev>
Date: Tue, 1 Sep 2026 12:54:16 +0200
Subject: [PATCH 05/10] ci: Add document start to workflows

---
 .github/workflows/build.yaml  | 6 +++---
 .github/workflows/deploy.yaml | 1 +
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index 3b4d5f44c..32d8e583e 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -1,3 +1,4 @@
+---
 name: Build site
 
 on:
@@ -10,7 +11,6 @@ on:
 permissions: {}
 
 jobs:
-
   build:
     runs-on: ubuntu-latest
     permissions:
@@ -23,7 +23,7 @@ jobs:
           persist-credentials: false
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: '20'
-          cache: 'npm'
+          node-version: "20"
+          cache: "npm"
       - run: npm ci
       - run: make ANTORAFLAGS=--fetch build-local
diff --git a/.github/workflows/deploy.yaml b/.github/workflows/deploy.yaml
index b859607db..e6a076077 100644
--- a/.github/workflows/deploy.yaml
+++ b/.github/workflows/deploy.yaml
@@ -1,3 +1,4 @@
+---
 name: Build and deploy production site
 
 # This job simply calls a trigger hook in netlify.

From a1edbabe05d9d1ebcdca63ed307188c6ccc59cb5 Mon Sep 17 00:00:00 2001
From: Techassi <git@techassi.dev>
Date: Tue, 1 Sep 2026 12:57:15 +0200
Subject: [PATCH 06/10] ci: Unify quotes in workflows

---
 .github/workflows/build.yaml | 2 +-
 .github/workflows/ui.yaml    | 6 +++---
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index 32d8e583e..6bc9d41cf 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -24,6 +24,6 @@ jobs:
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: "20"
-          cache: "npm"
+          cache: npm
       - run: npm ci
       - run: make ANTORAFLAGS=--fetch build-local
diff --git a/.github/workflows/ui.yaml b/.github/workflows/ui.yaml
index 71ac85bf5..e38bc0a2e 100644
--- a/.github/workflows/ui.yaml
+++ b/.github/workflows/ui.yaml
@@ -4,8 +4,8 @@ name: UI lint and bundle
 on:
   pull_request:
     paths:
-      - 'ui/**'
-      - 'package-lock.json'
+      - "ui/**"
+      - "package-lock.json"
 
 permissions: {}
 
@@ -20,7 +20,7 @@ jobs:
           persist-credentials: false
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: '24'
+          node-version: "24"
           cache: npm
       - run: npm ci
       - run: npm run lint --workspace ui

From 53d77df70575779b1fffd2409a97692eb6cbc5e6 Mon Sep 17 00:00:00 2001
From: Techassi <git@techassi.dev>
Date: Tue, 1 Sep 2026 13:00:03 +0200
Subject: [PATCH 07/10] ci: Don't fetch submodules anymore

---
 .github/workflows/build.yaml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index 6bc9d41cf..6b5c4937c 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -18,7 +18,6 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
-          submodules: true
           fetch-depth: 0
           persist-credentials: false
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0

From 3c53137f7f10e8b8fe96035969ba8fe02d3081cb Mon Sep 17 00:00:00 2001
From: Techassi <git@techassi.dev>
Date: Tue, 1 Sep 2026 13:02:44 +0200
Subject: [PATCH 08/10] ci: Add blank lines and step names

---
 .github/workflows/build.yaml |  9 +++++++--
 .github/workflows/ui.yaml    | 13 ++++++++++---
 2 files changed, 17 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index 6b5c4937c..51f93401d 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -20,9 +20,14 @@ jobs:
         with:
           fetch-depth: 0
           persist-credentials: false
+
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: "20"
           cache: npm
-      - run: npm ci
-      - run: make ANTORAFLAGS=--fetch build-local
+
+      - name: Install npm dependencies
+        run: npm ci
+
+      - name: Build documentation site
+        run: make ANTORAFLAGS=--fetch build-local
diff --git a/.github/workflows/ui.yaml b/.github/workflows/ui.yaml
index e38bc0a2e..703b4d5c2 100644
--- a/.github/workflows/ui.yaml
+++ b/.github/workflows/ui.yaml
@@ -18,10 +18,17 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
+
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: "24"
           cache: npm
-      - run: npm ci
-      - run: npm run lint --workspace ui
-      - run: npm run bundle --workspace ui
+
+      - name: Install npm dependencies
+        run: npm ci
+
+      - name: Lint the UI project
+        run: npm run lint --workspace ui
+
+      - name: Bundle the UI project
+        run: npm run bundle --workspace ui

From 2dba371f91664e1124109471f9427e1917d48315 Mon Sep 17 00:00:00 2001
From: Techassi <git@techassi.dev>
Date: Tue, 1 Sep 2026 13:04:59 +0200
Subject: [PATCH 09/10] ci: Trigger ui/build workflows on workflow changes

---
 .github/workflows/build.yaml | 1 +
 .github/workflows/ui.yaml    | 1 +
 2 files changed, 2 insertions(+)

diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index 51f93401d..4bcbb9f89 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -5,6 +5,7 @@ on:
   pull_request:
     paths-ignore:
       - .github/PULL_REQUEST_TEMPLATES/**
+      - .github/workflows/build.yaml
       - .github/ISSUE_TEMPLATES/**
       - scripts/**
 
diff --git a/.github/workflows/ui.yaml b/.github/workflows/ui.yaml
index 703b4d5c2..0ccf03c14 100644
--- a/.github/workflows/ui.yaml
+++ b/.github/workflows/ui.yaml
@@ -4,6 +4,7 @@ name: UI lint and bundle
 on:
   pull_request:
     paths:
+      - ".github/workflows/ui.yaml"
       - "ui/**"
       - "package-lock.json"
 

From 96d86727916e1c25a4849b31c7b22c7cc9a875ef Mon Sep 17 00:00:00 2001
From: dervoeti <lukas.krug@stackable.tech>
Date: Tue, 1 Sep 2026 11:40:09 +0000
Subject: [PATCH 10/10] fix: correct deploy workflow link and stop build.yaml
 ignoring itself

---
 .github/workflows/build.yaml                            | 1 -
 modules/contributor/pages/docs/backporting-changes.adoc | 2 +-
 2 files changed, 1 insertion(+), 2 deletions(-)

diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index 4bcbb9f89..51f93401d 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -5,7 +5,6 @@ on:
   pull_request:
     paths-ignore:
       - .github/PULL_REQUEST_TEMPLATES/**
-      - .github/workflows/build.yaml
       - .github/ISSUE_TEMPLATES/**
       - scripts/**
 
diff --git a/modules/contributor/pages/docs/backporting-changes.adoc b/modules/contributor/pages/docs/backporting-changes.adoc
index c770ef36e..a639750d1 100644
--- a/modules/contributor/pages/docs/backporting-changes.adoc
+++ b/modules/contributor/pages/docs/backporting-changes.adoc
@@ -19,4 +19,4 @@ The documentation uses https://trunkbaseddevelopment.com/[trunk based developmen
   That's it, you're done!
 
 The changes will become visible in the online documentation once the next build is triggered.
-You can either wait for the nightly build, or trigger a build yourself with the https://github.com/stackabletech/documentation/actions/workflows/deploy.yml[Build and deploy production site{external-link-icon}^] GitHub action.
+You can either wait for the nightly build, or trigger a build yourself with the https://github.com/stackabletech/documentation/actions/workflows/deploy.yaml[Build and deploy production site{external-link-icon}^] GitHub action.