Automated workflows

Automated workflows

The badges at the top of the README provide a quick status view. The repository currently configures the following automations:

Automation	Trigger	Purpose
Docker build and publication	Every PR, every push to main, and every v* tag	Builds the Companion and Sidecar images for amd64/arm64. On main and tags, publishes them to GHCR. On PRs, also runs an amd64 HTTP smoke test.
Dependabot	Every Monday at 06:00 UTC	Monitors Python dependencies for Companion and Sidecar, GitHub Actions, and Docker base images, then opens update PRs.
Dependabot auto-merge	When a Dependabot PR is opened or updated	Requests auto-merge for patch updates after checks pass. GitHub's Allow auto-merge repository setting must be enabled; otherwise the PR remains for manual merging. Minor updates remain subject to review, while major updates are generally ignored by the Dependabot configuration.
Trivy scan	Every Monday at 07:00 UTC, or manually	Builds and scans both images for HIGH/CRITICAL CVEs, uploads SARIF results to the Security tab, and opens either a fix PR or an issue when manual action is required.

A successful Docker workflow means the images build and start in the smoke test. To technically prevent merging a failing PR, the relevant checks must also be configured as required status checks in the main branch protection rules.

---