From a7304b863b1ab39a19f5b8b974983a628e825960 Mon Sep 17 00:00:00 2001
From: Bozhidar Batsov <bozhidar@batsov.dev>
Date: Tue, 15 Sep 2026 16:33:06 +0300
Subject: [PATCH 1/2] Create GitHub releases from the changelog on tag push

Publishes a release automatically whenever a v-prefixed tag is pushed,
with the version's section of CHANGELOG.adoc as the body. Prereleases
fall back to the unreleased section, and GitHub's generated notes cover
the case where neither has anything.
---
 .github/workflows/github-release.yml | 53 ++++++++++++++++++++++++++++
 1 file changed, 53 insertions(+)
 create mode 100644 .github/workflows/github-release.yml

diff --git a/.github/workflows/github-release.yml b/.github/workflows/github-release.yml
new file mode 100644
index 0000000..d3bcce8
--- /dev/null
+++ b/.github/workflows/github-release.yml
@@ -0,0 +1,53 @@
+name: Create GitHub Release
+
+on:
+  push:
+    tags:
+      - "v*"  # Trigger when a version tag is pushed (e.g., v0.4.0)
+
+jobs:
+  create-release:
+    # Snapshot tags only exist to exercise the deploy pipeline.
+    if: ${{ !endsWith(github.ref_name, '-SNAPSHOT') }}
+    runs-on: ubuntu-latest
+
+    permissions:
+      contents: write
+
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@v6
+
+      # The release notes are the version's section of the changelog. A
+      # prerelease usually has no section of its own yet, so it gets the
+      # unreleased one. If neither has anything, fall back to GitHub's
+      # generated notes rather than publish an empty release.
+      - name: Extract the release notes from the changelog
+        id: notes
+        run: |
+          extract() {
+            awk -v heading="$1" '
+              /^== / { if (found) exit; found = ($2 == heading); next }
+              found { print }
+            ' CHANGELOG.adoc
+          }
+          extract "${GITHUB_REF_NAME#v}" > release-notes.md
+          if ! grep -q '[^[:space:]]' release-notes.md; then
+            extract master > release-notes.md
+          fi
+          if grep -q '[^[:space:]]' release-notes.md; then
+            echo "found=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "::warning::No changelog section for $GITHUB_REF_NAME, using generated notes instead."
+            echo "found=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Create GitHub Release
+        uses: ncipollo/release-action@v1
+        with:
+          tag: ${{ github.ref_name }}
+          name: Drawbridge ${{ github.ref_name }}
+          prerelease: ${{ contains(github.ref, '-rc') || contains(github.ref, '-alpha') || contains(github.ref, '-beta') }}
+          bodyFile: ${{ steps.notes.outputs.found == 'true' && 'release-notes.md' || '' }}
+          generateReleaseNotes: ${{ steps.notes.outputs.found != 'true' }}
+          token: ${{ secrets.GITHUB_TOKEN }}

From 9997095482eb7a8094fa15b637b9a1ae3c335585 Mon Sep 17 00:00:00 2001
From: Bozhidar Batsov <bozhidar@batsov.dev>
Date: Tue, 15 Sep 2026 16:33:06 +0300
Subject: [PATCH 2/2] Keep GitHub Actions current with Dependabot

Monthly bumps for the action versions the workflows pin.
---
 .github/dependabot.yml | 6 ++++++
 1 file changed, 6 insertions(+)
 create mode 100644 .github/dependabot.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..3a626c3
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,6 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: monthly