5 files changed, 55 insertions, 44 deletions
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 6fa3854..7233aac 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -4,11 +4,11 @@ updates:
     directory: "/"
     schedule:
       interval: "weekly"
-  - package-ecosystem: "github-actions"
+  - package-ecosystem: "devcontainers"
     directory: "/"
     schedule:
       interval: "weekly"
-  - package-ecosystem: "devcontainers"
+  - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
       interval: "weekly"
diff --git a/.github/renovate.json b/.github/renovate.json
index bc629bb..7904aa8 100644
--- a/.github/renovate.json
+++ b/.github/renovate.json
@@ -1,29 +1,15 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
-  "extends": [
-    "config:recommended",
-    ":disableDependencyDashboard"
-  ],
-  "assignees": [
-    "valentineus"
-  ],
-  "labels": [
-    "dependencies",
-    "automated"
-  ],
+  "extends": ["config:recommended", ":disableDependencyDashboard"],
+  "assignees": ["valentineus"],
+  "labels": ["dependencies", "automated"],
   "packageRules": [
     {
+      "description": "Group patch & minor updates together",
       "groupName": "all digest updates",
       "groupSlug": "all-digest",
-      "matchUpdateTypes": [
-        "minor",
-        "patch",
-        "pin",
-        "digest"
-      ],
-      "matchPackageNames": [
-        "*"
-      ],
+      "matchUpdateTypes": ["minor", "patch", "pin", "digest"],
+      "matchPackageNames": ["*"],
       "automerge": true
     }
   ]
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..2b8735b
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,28 @@
+name: CI
+
+on:
+  push:
+    branches: [master]
+  pull_request:
+    branches: [master]
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    name: Test
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v5
+      - name: Set up Node.js
+        uses: actions/setup-node@v5
+        with:
+          node-version: 22
+      - name: Install dependencies
+        run: npm ci
+      - name: Run checks
+        run: npm run check
+      - name: Run type checks
+        run: npm run typecheck
diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml
index f85936a..9fed247 100644
--- a/.github/workflows/mirror.yml
+++ b/.github/workflows/mirror.yml
@@ -1,15 +1,25 @@
 name: Mirror
-on: [push]
+
+on:
+  push:
+    branches: [master]
+  pull_request:
+    branches: [master]
+
+permissions:
+  contents: read
 
 jobs:
   mirror:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
-      with:
-        fetch-depth: 0
-    - uses: yesolutions/mirror-action@master
-      with:
-        REMOTE: 'https://git.popov.link/popov.link.git'
-        GIT_USERNAME: ${{ secrets.GIT_USERNAME }}
-        GIT_PASSWORD: ${{ secrets.GIT_PASSWORD }}
+      - name: Checkout repository
+        uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+      - name: Mirror to remote repository
+        uses: yesolutions/mirror-action@master
+        with:
+          REMOTE: "https://git.popov.link/popov.link.git"
+          GIT_USERNAME: ${{ secrets.GIT_USERNAME }}
+          GIT_PASSWORD: ${{ secrets.GIT_PASSWORD }}
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
deleted file mode 100644
index ccd08a1..0000000
--- a/.github/workflows/test.yml
+++ /dev/null
@@ -1,13 +0,0 @@
-name: Test
-on: [push, pull_request]
-
-jobs:
-  test:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 22
-      - run: npm ci
-      - run: npm run check