chore: apply tailor alterations

Signed-off-by: Martin Wimpress <code@wimpress.io>

Author: flexiondotorg

.github/workflows/tailor-automerge.yml

@@ -1,4 +1,4 @@
-name: Dependabot automerge 🤖
+name: Tailor automerge 🤖
 
 on:
   pull_request:
@@ -11,33 +11,47 @@ permissions:
 jobs:
   automerge:
     runs-on: ubuntu-slim
-    if: github.event_name == 'pull_request' && github.event.pull_request.user.login == 'dependabot[bot]'
+    if: github.event_name == 'pull_request'
     steps:
       - name: Fetch Dependabot metadata
+        if: github.event.pull_request.user.login == 'dependabot[bot]'
         id: metadata
-        uses: dependabot/fetch-metadata@v2.5.0
+        uses: dependabot/fetch-metadata@v2
         with:
           github-token: "${{ secrets.GITHUB_TOKEN }}"
           skip-commit-verification: true
 
       - name: Automerge GitHub Actions updates
-        if: steps.metadata.outputs.package-ecosystem == 'github_actions'
+        if: >-
+          github.event.pull_request.user.login == 'dependabot[bot]'
+          && steps.metadata.outputs.package-ecosystem == 'github_actions'
         run: gh pr merge --auto --squash "$PR_URL"
         env:
           PR_URL: ${{ github.event.pull_request.html_url }}
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Automerge patch and minor dependency updates
-        if: |
-          steps.metadata.outputs.package-ecosystem != 'github_actions' && (
-            steps.metadata.outputs.update-type == 'version-update:semver-patch' ||
-            steps.metadata.outputs.update-type == 'version-update:semver-minor'
+        if: >-
+          github.event.pull_request.user.login == 'dependabot[bot]'
+          && steps.metadata.outputs.package-ecosystem != 'github_actions'
+          && (
+            steps.metadata.outputs.update-type == 'version-update:semver-patch'
+            || steps.metadata.outputs.update-type == 'version-update:semver-minor'
           )
         run: gh pr merge --auto --squash "$PR_URL"
         env:
           PR_URL: ${{ github.event.pull_request.html_url }}
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
+      - name: Automerge flake.lock update
+        if: >-
+          github.event.pull_request.user.login == 'github-actions[bot]'
+          && startsWith(github.event.pull_request.head.ref, 'update_flake_lock')
+        run: gh pr merge --auto --squash "$PR_URL"
+        env:
+          PR_URL: ${{ github.event.pull_request.html_url }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
   automerge-existing:
     runs-on: ubuntu-slim
     if: github.event_name == 'workflow_dispatch'

.github/workflows/tailor.yml

@@ -14,18 +14,39 @@ jobs:
   alter:
     runs-on: ubuntu-slim
     env:
-      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      GH_TOKEN: ${{ secrets.TAILOR_TOKEN || secrets.GITHUB_TOKEN }}
     steps:
-      - uses: actions/checkout@v6.0.1
+      - uses: actions/checkout@v6
 
-      - name: Setup tailor
-        uses: wimpysworld/tailor-action@v0.1.0
-
-      - name: Alter swatches
-        run: tailor alter
+      - name: Tailor
+        uses: wimpysworld/tailor@v0
+        with:
+          alter: true
 
       - name: Create PR
-        uses: peter-evans/create-pull-request@v8.1.0
+        uses: peter-evans/create-pull-request@v8
         with:
           branch: tailor-alter
           title: "chore: alter tailor swatches"
+
+  update-flake-lock:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Check for flake.lock
+        id: check
+        run: test -f flake.lock && echo "found=true" >> "$GITHUB_OUTPUT" || echo "found=false" >> "$GITHUB_OUTPUT"
+
+      - name: Install Nix
+        if: steps.check.outputs.found == 'true'
+        uses: DeterminateSystems/determinate-nix-action@v3
+
+      - name: Update flake.lock
+        if: steps.check.outputs.found == 'true'
+        uses: DeterminateSystems/update-flake-lock@v28
+        with:
+          pr-title: "chore: update flake.lock"

.tailor.yml

@@ -1,8 +1,8 @@
-# Initially fitted by tailor on 2026-03-11
+# Refitted by tailor on 2026-03-12
 license: BlueOak-1.0.0
 
 repository:
-  description: Homebrew tap for Wimpy's World tools 🚰
+  description: "Homebrew tap for Wimpy's World tools 🚰"
   homepage: https://github.com/wimpysworld/homebrew-tap
   has_wiki: false
   has_discussions: false
@@ -19,9 +19,6 @@ repository:
   allow_update_branch: true
   allow_auto_merge: true
   web_commit_signoff_required: false
-  private_vulnerability_reporting_enabled: false
-  vulnerability_alerts_enabled: true
-  automated_security_fixes_enabled: true
   default_workflow_permissions: write
   can_approve_pull_request_reviews: true
   topics:
@@ -85,9 +82,6 @@ swatches:
   - path: .github/workflows/tailor.yml
     alteration: always
 
-  - path: .github/workflows/tailor-security.yml
-    alteration: never
-
   - path: .github/dependabot.yml
     alteration: first-fit
 
@@ -135,3 +129,6 @@ swatches:
 
   - path: .github/workflows/tailor-automerge.yml
     alteration: triggered
+
+  - path: cubic.yaml
+    alteration: first-fit

cubic.yaml

@@ -0,0 +1,32 @@
+# yaml-language-server: $schema=https://cubic.dev/schema/cubic-repository-config.schema.json
+version: 1
+
+reviews:
+  enabled: true
+  sensitivity: medium
+  incremental_commits: true
+  check_drafts: false
+  architecture_diagrams: false
+  resolve_threads_when_addressed: true
+  custom_instructions: ""
+  ignore:
+    files:
+      - "dist/**"
+      - "build/**"
+    pr_titles:
+      - "wip:*"
+    pr_labels:
+      - "wontfix"
+    head_branches: []
+    base_branches: []
+  custom_rules: []
+
+pr_descriptions:
+  cubic_review_link: false
+  generate: false
+  instructions: ""
+
+issues:
+  fix_commits_to_pr: false
+  fix_with_cubic_buttons: false
+  pr_comment_fixes: false