feat: Harden CI, cache dependencies, and automate schema PRs

.github/actionlint.yaml

@@ -0,0 +1,9 @@
+# Labels for the self-hosted hardware-in-the-loop rigs; without these every HIL
+# `runs-on` is reported as an unknown label.
+self-hosted-runner:
+  labels:
+    - circuitpython
+    - swan-3.0
+    - notecard-serial
+    - micropython
+    - espressif_esp32

.github/dependabot.yml

@@ -0,0 +1,21 @@
+version: 2
+
+updates:
+  # Floating major tags (@v7) already pick up minors and patches, so in practice
+  # these PRs are major bumps.
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 5
+    commit-message:
+      prefix: "chore(actions)"
+    labels:
+      - "dependencies"
+      - "github-actions"
+    groups:
+      actions-minor-patch:
+        update-types:
+          - "minor"
+          - "patch"

.github/workflows/hil-circuitpython.yml

@@ -2,31 +2,42 @@
 
 name: HIL-circuitpython
 
-on:
-  pull_request:
-    branches: [ main ]
-    paths:
-      # This is quite a big job so run only when files affecting it change.
-      - .github/workflows/hil-circuitpython.yml
-      - examples/notecard-basics/cpy_example.py
-      - test/hitl/**
-      - test/scripts/usbmount
-      - test/scripts/check_cpy*.*
-      - notecard/**
+# TEMPORARILY DISABLED (2026-09): the self-hosted HIL rig is offline -- runs
+# queued for weeks without a runner ever claiming them. The steps below are
+# fine; this is a hardware problem. To re-enable, restore the two triggers
+# commented out in the `on:` block once a runner with these labels is online:
+#   self-hosted, linux, circuitpython, swan-3.0, notecard-serial
+# Do NOT make these required status checks; `build / ci-gate` is the gate.
 
+on:
   workflow_dispatch:
     inputs:
       flash_device:
         required: false
         type: boolean
         default: true
 
-  schedule:
-    - cron: '30 4 * * 1'
+#  pull_request:
+#    branches: [ main ]
+#    paths:
+#      # This is quite a big job so run only when files affecting it change.
+#      - .github/workflows/hil-circuitpython.yml
+#      - examples/notecard-basics/cpy_example.py
+#      - test/hitl/**
+#      - test/scripts/usbmount
+#      - test/scripts/check_cpy*.*
+#      - notecard/**
+#
+#  schedule:
+#    - cron: '30 4 * * 1'
+
+permissions:
+  contents: read
 
 jobs:
   test:
     runs-on: [self-hosted, linux, circuitpython, swan-3.0, notecard-serial]
+    timeout-minutes: 45
     defaults:
       run:
         shell: bash

.github/workflows/hil-micropython.yml

@@ -1,25 +1,34 @@
 name: HIL-micropython
 
-on:
-  pull_request:
-    branches: [ main ]
-    paths:
-      - .github/workflows/hil-micropython.yml
-      - test/hitl/**
-      - notecard/**
-      - examples/notecard-basics/mpy_example.py
-      - test/scripts/check_mpy*.*
+# TEMPORARILY DISABLED (2026-09): the self-hosted HIL rig is offline -- runs
+# queued for weeks without a runner ever claiming them. The steps below are
+# fine; this is a hardware problem. To re-enable, restore the two triggers
+# commented out in the `on:` block once a runner with these labels is online:
+#   self-hosted, linux, espressif_esp32, notecard-serial, micropython
+# Do NOT make these required status checks; `build / ci-gate` is the gate.
 
+on:
   workflow_dispatch:
     inputs:
       flash_device:
         required: false
         type: boolean
         default: true
 
-  schedule:
-    - cron: '15 4 * * 1'
+#  pull_request:
+#    branches: [ main ]
+#    paths:
+#      - .github/workflows/hil-micropython.yml
+#      - test/hitl/**
+#      - notecard/**
+#      - examples/notecard-basics/mpy_example.py
+#      - test/scripts/check_mpy*.*
+#
+#  schedule:
+#    - cron: '15 4 * * 1'
 
+permissions:
+  contents: read
 
 jobs:
   test:
@@ -29,6 +38,7 @@ jobs:
       - ${{ matrix.MPY_BOARD }}
       - notecard-serial
       - micropython
+    timeout-minutes: 45
     defaults:
       run:
         shell: bash

.github/workflows/manual-run.yml

@@ -5,6 +5,9 @@ name: Manual Trigger Test
 
 on: workflow_dispatch
 
+permissions:
+  contents: read
+
 jobs:
   build:
     uses: ./.github/workflows/python-ci.yml

.github/workflows/python-ci.yml

@@ -4,7 +4,6 @@
 # Linting (flake8 and docstyle)
 # Testing and coverage with pytest
 # Optionally publish coverage to coveralls (requires secrets.GITHUB_TOKEN)
-# Reports test coverage to DataDog if secrets.DD_API_KEY is defined.
 
 on:
     workflow_call:
@@ -22,16 +21,17 @@ on:
                 required: false
                 default: false
 
+permissions:
+    contents: read
+
 jobs:
     build:
       runs-on: ubuntu-24.04
+      timeout-minutes: 15
       strategy:
         matrix:
           python-version: ['3.10', '3.11', '3.12', '3.13', '3.14']
 
-      env:
-        DD_API_KEY: ${{ secrets.DD_API_KEY }}
-
       steps:
       - name: Send building notification
         if: ${{ inputs.notehub_notify }}
@@ -43,16 +43,17 @@ jobs:
           --data '{"req":"note.add","file":"build_results.qi","body":{"result":"building"}}'
       - uses: actions/checkout@v7
       - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v7
         with:
           python-version: ${{ matrix.python-version }}
+          cache: 'pipenv'
       - name: Install pipenv
         run: |
           python -m pip install --upgrade pip
           pip install pipenv
       - name: Install dependencies
         run: |
-          pipenv install --dev --python $(which python)
+          pipenv install --dev --python "$(which python)"
       - name: Lint with flake8
         run: |
           pipenv run make flake8
@@ -68,18 +69,9 @@ jobs:
           --header 'X-Session-Token: ${{ secrets.NOTEHUB_SESSION_TOKEN }}' \
           --data '{"req":"note.add","file":"build_results.qi","body":{"result":"running_tests"}}'
 
-      - name: Check DD API Key
-        if: ${{ !env.DD_API_KEY }}
-        run: |
-          echo Test run will NOT be collected by DD
-
       - name: Test with pytest
-        env:
-          DD_CIVISIBILITY_AGENTLESS_ENABLED: ${{ !!env.DD_API_KEY }}
-          DD_SERVICE: note-python
-          DD_ENV: ci
         run: |
-          pipenv run coverage run -m pytest --ddtrace --ddtrace-patch-all --ignore=test/hitl
+          pipenv run coverage run -m pytest
       - name: Publish to Coveralls
         env:
             GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -103,3 +95,19 @@ jobs:
           --header 'Content-Type: application/json' \
           --header 'X-Session-Token: ${{ secrets.NOTEHUB_SESSION_TOKEN }}' \
           --data '{"req":"note.add","file":"build_results.qi","body":{"result":"tests_failed"}}'
+
+    # Branch protection requires `build / ci-gate` instead of the five
+    # `build / build (3.xx)` contexts, which are matched by name and would go
+    # stale whenever the matrix changes. `if: always()` is required -- a skipped
+    # check reports as successful.
+    ci-gate:
+      needs: build
+      if: always()
+      runs-on: ubuntu-24.04
+      timeout-minutes: 5
+      permissions: {}
+      steps:
+      - name: Require the full matrix to have succeeded
+        run: |
+          echo "build result: ${{ needs.build.result }}"
+          [ "${{ needs.build.result }}" = "success" ] || exit 1

.github/workflows/python-package.yml

@@ -10,6 +10,15 @@ on:
     branches: [ main ]
   workflow_dispatch:
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+# Permissions can only be reduced across a `uses:` boundary, never elevated,
+# so this is the ceiling for python-ci.yml.
+permissions:
+  contents: read
+
 jobs:
   build:
     uses: ./.github/workflows/python-ci.yml

.github/workflows/python-publish.yml

@@ -1,5 +1,9 @@
 # This workflow will upload a Python Package using Twine when a release is created
 # For more information see: https://help.github.com/en/actions/language-and-framework-guides/using-python-with-github-actions#publishing-to-package-registries
+#
+# Still authenticates with the long-lived PYPI_USERNAME/PYPI_PASSWORD secrets.
+# Moving to PyPI Trusted Publishing would remove them, but needs a trusted
+# publisher registered on the PyPI project first.
 
 name: Upload Python Package
 
@@ -8,15 +12,19 @@ on:
     tags:
       - v*
 
+permissions:
+  contents: read
+
 jobs:
   deploy:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
+    timeout-minutes: 20
     steps:
     - uses: actions/checkout@v7
       with:
         fetch-depth: 0  # setuptools-scm needs full git history
     - name: Set up Python
-      uses: actions/setup-python@v6
+      uses: actions/setup-python@v7
       with:
         python-version: '3.x'
     - name: Install dependencies