From f7b22fed122815197b7f86b2a0c561111a62c966 Mon Sep 17 00:00:00 2001
From: Hugo van Kemenade <1324225+hugovk@users.noreply.github.com>
Date: Fri, 2 Oct 2026 15:26:37 +0300
Subject: [PATCH] Migrate from DigitalOcean to GitHub Actions

---
 .github/workflows/lint.yml   |  6 ++--
 .github/workflows/test.yml   |  8 ++---
 .github/workflows/update.yml | 66 ++++++++++++++++++++++++++++++++++++
 .pre-commit-config.yaml      | 13 ++++---
 4 files changed, 82 insertions(+), 11 deletions(-)
 create mode 100644 .github/workflows/update.yml

diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 379b59061..d7b093cc3 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -13,10 +13,10 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: actions/setup-python@v7
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.x"
-      - uses: j178/prek-action@v1
+      - uses: j178/prek-action@0bb87d7f00b0c99306c8bcb8b8beba1eb581c037 # v1.1.1
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 8448ff772..5fdb1c420 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -18,13 +18,13 @@ jobs:
         os: [ubuntu-latest]
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           persist-credentials: false
 
       - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@v7
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: ${{ matrix.python-version }}
           allow-prereleases: true
@@ -34,7 +34,7 @@ jobs:
             requirements.txt
 
       - name: Set up node
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 16
           cache: 'npm'
@@ -44,7 +44,7 @@ jobs:
         run: |
           python -m pip install -U pip
           python -m pip install -Ur requirements.txt --prefer-binary
-          npm install svgexport
+          npm install
 
       - name: Unit tests
         run: |
diff --git a/.github/workflows/update.yml b/.github/workflows/update.yml
new file mode 100644
index 000000000..1f46aae0d
--- /dev/null
+++ b/.github/workflows/update.yml
@@ -0,0 +1,66 @@
+name: Update site
+
+on:
+  schedule:
+    # Daily, 04:07 UTC
+    - cron: "7 4 * * *"
+  workflow_dispatch:
+    inputs:
+      push:
+        description: "Deploy to gh-pages (untick for a dry run)"
+        type: boolean
+        default: true
+
+env:
+  FORCE_COLOR: 1
+  PIP_DISABLE_PIP_VERSION_CHECK: 1
+
+permissions: {}
+
+concurrency:
+  group: update-site
+  cancel-in-progress: false
+
+jobs:
+  update:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write # to push the build to gh-pages
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: true
+
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.x"
+          cache: pip
+          cache-dependency-path: requirements.txt
+
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 16
+
+      - name: Install dependencies
+        run: |
+          python -m pip install -r requirements.txt
+          npm install
+
+      - name: Build
+        run: ./build.sh
+
+      - name: Deploy to gh-pages
+        if: github.event_name == 'schedule' || inputs.push
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          rev=$(git rev-parse HEAD)
+          git fetch --depth=1 origin gh-pages
+          git worktree add --detach "$RUNNER_TEMP/gh-pages" origin/gh-pages
+          cd "$RUNNER_TEMP/gh-pages"
+          git rm -rfq .
+          git checkout origin/gh-pages -- .gitignore
+          cp -R "$GITHUB_WORKSPACE"/build/* .
+          git add .
+          git commit -m "Deploy $rev"
+          git push origin HEAD:gh-pages
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 861b5d339..f740e6140 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -1,6 +1,6 @@
 repos:
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.15.20
+    rev: v0.16.10
     hooks:
       - id: ruff-check
         args: [--exit-non-zero-on-fix]
@@ -26,7 +26,7 @@ repos:
       - id: trailing-whitespace
 
   - repo: https://github.com/python-jsonschema/check-jsonschema
-    rev: 0.37.4
+    rev: "0.38.2"
     hooks:
       - id: check-github-workflows
 
@@ -35,13 +35,18 @@ repos:
     hooks:
       - id: actionlint
 
+  - repo: https://github.com/zizmorcore/zizmor-pre-commit
+    rev: v1.30.1
+    hooks:
+      - id: zizmor
+
   - repo: https://github.com/tox-dev/pyproject-fmt
-    rev: v2.25.1
+    rev: v2.29.4
     hooks:
       - id: pyproject-fmt
 
   - repo: https://github.com/abravalheri/validate-pyproject
-    rev: v0.25
+    rev: "0.26"
     hooks:
       - id: validate-pyproject
   - repo: meta