Add secure GitHub Actions for CI and release publishing

- CI workflow builds and validates the .deb on push/PR (no upload)
- Release workflow attaches .deb only when a GitHub Release is published
- Pin third-party actions to commit SHAs; minimal permissions
- Dependabot for weekly github-actions updates
- Document release process and hardening in README

Author: tlf30

.github/dependabot.yml

@@ -0,0 +1,11 @@
+# Keep pinned GitHub Actions updated via reviewed Dependabot PRs.
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      github-actions:
+        patterns:
+          - "*"

.github/workflows/ci.yml

@@ -0,0 +1,38 @@
+# Validate .deb builds on push/PR. Does not publish artifacts.
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+# Supply-chain hardening: default least privilege for all jobs.
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  build-deb:
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      - name: Install packaging tools
+        run: sudo apt-get update && sudo apt-get install -y rsync dpkg-dev
+
+      - name: Build .deb
+        run: ./build-deb.sh
+
+      - name: Verify package metadata
+        run: |
+          deb="$(ls -1 build/debian/streamdeck-openpnp_*_all.deb | head -1)"
+          test -n "$deb"
+          dpkg-deb -I "$deb" | grep -q 'Package: streamdeck-openpnp'
+          dpkg-deb -I "$deb" | grep -q 'libnotify-bin'
+          dpkg-deb -c "$deb" | grep -q './usr/bin/streamdeck-run'
+          echo "Built: $deb ($(du -h "$deb" | cut -f1))"

.github/workflows/release.yml

@@ -0,0 +1,57 @@
+# Build and attach the .deb only when a GitHub Release is published.
+# Creating a tag alone does not publish; draft/pre-release releases are ignored.
+name: Release
+
+on:
+  release:
+    types: [published]
+
+permissions:
+  contents: write
+
+concurrency:
+  group: release-${{ github.event.release.id }}
+  cancel-in-progress: false
+
+jobs:
+  build-and-upload:
+    # Never run for forked copies of the workflow.
+    if: github.repository == 'tlf30/lumenpnp-streamdeck'
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout release tag
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          ref: ${{ github.event.release.tag_name }}
+
+      - name: Resolve package version
+        id: version
+        run: |
+          tag="${{ github.event.release.tag_name }}"
+          version="${tag#v}"
+          if ! printf '%s' "$version" | grep -Eq '^[0-9]+(\.[0-9]+)*(-[0-9A-Za-z.-]+)?$'; then
+            echo "Release tag must look like v0.1.0 (got: $tag)" >&2
+            exit 1
+          fi
+          echo "version=$version" >> "$GITHUB_OUTPUT"
+          echo "Building streamdeck-openpnp_$version_all.deb"
+
+      - name: Install packaging tools
+        run: sudo apt-get update && sudo apt-get install -y rsync dpkg-dev
+
+      - name: Build .deb
+        env:
+          VERSION: ${{ steps.version.outputs.version }}
+        run: ./build-deb.sh
+
+      - name: Verify artifact name
+        run: |
+          expected="build/debian/streamdeck-openpnp_${{ steps.version.outputs.version }}_all.deb"
+          test -f "$expected"
+          ls -la "$expected"
+
+      - name: Upload to GitHub Release
+        uses: softprops/action-gh-release@c95fe1489396fe8a9eb87c0abf8aa5b2ef267fda # v2.2.1
+        with:
+          files: build/debian/streamdeck-openpnp_${{ steps.version.outputs.version }}_all.deb
+          fail_on_unmatched_files: true

README.md

@@ -138,7 +138,7 @@ Optional `notify-send` popups for lock/unlock, idle lock, bridge offline, blocke
 - `libhidapi-libusb0`
 - `python3-venv`, `python3-pip`
 - OpenPnP with a configured machine (actuator names `VAC1` / `VAC2` expected for vacuum keys)
-- Desktop: `libnotify-bin` (`notify-send`) for notifications — optional
+- Desktop: `libnotify-bin` (`notify-send`) for notifications (installed as a package dependency)
 
 ---
 
@@ -366,7 +366,7 @@ See [HID-NOTES.md](HID-NOTES.md) for protocol details.
 | `OpenPnP bridge not running` | Restart OpenPnP; confirm `Startup.py` symlink |
 | First button press missed | Ensure only one HID client is running; use current controller (HID read/write decoupling fix) |
 | Permission denied on `/dev/hidraw*` | Run `sudo udevadm control --reload-rules && sudo udevadm trigger`; replug |
-| Notifications silent | Install `libnotify-bin`; check `notifications_enabled` |
+| Notifications silent | Check `notifications_enabled`; verify `notify-send` is available |
 | Bridge changes ignored | **Restart OpenPnP** (not just the controller) |
 | Controller changes ignored | `systemctl --user restart streamdeck` or `./run` |
 
@@ -404,6 +404,51 @@ streamdeck/
 
 ---
 
+## Releases
+
+The `.deb` is built and uploaded **only when a GitHub Release is published** — not on every push.
+
+### Publish a new version
+
+1. Update `VERSION` default in `build-deb.sh` if needed (the release workflow passes the tag).
+2. Commit and push to `main`.
+3. Create a tag matching the version, e.g. `v0.1.0`.
+4. On GitHub: **Releases → Draft a new release** → choose the tag → **Publish release**.
+5. The [Release workflow](.github/workflows/release.yml) builds `streamdeck-openpnp_<version>_all.deb` and attaches it to that release.
+
+Install from a release asset:
+
+```bash
+curl -LO https://github.com/tlf30/lumenpnp-streamdeck/releases/download/v0.1.0/streamdeck-openpnp_0.1.0_all.deb
+sudo apt install ./streamdeck-openpnp_0.1.0_all.deb
+streamdeck-setup-user
+systemctl --user enable --now streamdeck
+```
+
+### CI vs release workflows
+
+| Workflow | Trigger | Publishes `.deb`? |
+|----------|---------|-------------------|
+| [CI](.github/workflows/ci.yml) | Push / PR to `main` | No — build verification only |
+| [Release](.github/workflows/release.yml) | Release **published** | Yes — attached to the release |
+
+### GitHub Actions hardening
+
+These workflows follow supply-chain best practices:
+
+- **Pinned actions** to full commit SHAs (not floating `@v4` tags).
+- **Least-privilege `permissions`** — `contents: read` for CI; `contents: write` only on release upload.
+- **No release on PRs or tags alone** — only `release: published`.
+- **Repository guard** — release job runs only on `tlf30/lumenpnp-streamdeck`.
+- **Dependabot** weekly PRs for action updates (`.github/dependabot.yml`).
+
+Recommended repository settings (GitHub → Settings → Actions):
+
+- **Fork pull request workflows:** Do not run (prevents untrusted workflow code from accessing secrets).
+- **Workflow permissions:** Read repository contents and packages permissions (workflows elevate only where needed).
+
+---
+
 ## License
 
 [MIT License](LICENSE) — Copyright (c) 2026 LumenPNP.

build-deb.sh

@@ -70,7 +70,7 @@ Version: ${VERSION}
 Section: misc
 Priority: optional
 Architecture: ${ARCH}
-Depends: python3 (>= 3.10), python3-venv, python3-pip, libhidapi-libusb0, systemd | systemd-standalone
+Depends: python3 (>= 3.10), python3-venv, python3-pip, libhidapi-libusb0, libnotify-bin, systemd | systemd-standalone
 Maintainer: LumenPNP <support@lumenpnp.com>
 Description: Stream Deck + XL controller for OpenPnP / LumenPNP
  Installs the Stream Deck controller service, OpenPnP bridge startup script,