From c16cf27231c990f6487955e090e1edcaace5ca06 Mon Sep 17 00:00:00 2001
From: Cursor Agent <cursoragent@cursor.com>
Date: Wed, 12 Aug 2026 11:44:08 +0000
Subject: [PATCH 1/2] ci(miro): regenerate dist on dependabot manifest bumps
 (#2083)

Co-authored-by: Kyle Sexton <kyle-sexton@users.noreply.github.com>
---
 .github/workflows/ci.yml                     |  1 +
 .github/workflows/dependabot-miro-bundle.yml | 62 ++++++++++++++++++++
 2 files changed, 63 insertions(+)
 create mode 100644 .github/workflows/dependabot-miro-bundle.yml

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b90e4d3d9c..c8f0f6dcb0 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -161,6 +161,7 @@ jobs:
             .github/workflows/ci.yml
             .github/workflows/claude-review.yml
             .github/workflows/claude-security-review.yml
+            .github/workflows/dependabot-miro-bundle.yml
             .github/workflows/do-not-merge.yml
             .github/workflows/link-check.yml
             .github/workflows/pr-issue-linkage.yml
diff --git a/.github/workflows/dependabot-miro-bundle.yml b/.github/workflows/dependabot-miro-bundle.yml
new file mode 100644
index 0000000000..1d48f9b788
--- /dev/null
+++ b/.github/workflows/dependabot-miro-bundle.yml
@@ -0,0 +1,62 @@
+name: dependabot-miro-bundle
+
+# Dependabot bumps plugins/miro/package*.json but cannot regenerate the committed
+# dist/index.min.js artifact. This workflow runs on Dependabot PRs, rebuilds when
+# the miro manifest changed, and pushes the bundle back to the PR branch (#2083).
+on:
+  pull_request:
+    types: [opened, synchronize, reopened]
+
+permissions:
+  contents: read
+
+jobs:
+  regenerate-miro-bundle:
+    if: github.actor == 'dependabot[bot]'
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    permissions:
+      contents: write
+      pull-requests: read
+    steps:
+      - name: Check out PR head
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.head_ref }}
+          fetch-depth: 0
+      - name: Detect miro manifest changes
+        id: scope
+        env:
+          BASE_REF: ${{ github.base_ref }}
+        run: |
+          if git diff --name-only "origin/$BASE_REF"...HEAD | grep -qE '^plugins/miro/package(-lock)?\.json$'; then
+            echo "changed=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "changed=false" >> "$GITHUB_OUTPUT"
+          fi
+      - name: Set up Node
+        if: steps.scope.outputs.changed == 'true'
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version-file: .node-version
+          cache: npm
+          cache-dependency-path: plugins/miro/package-lock.json
+      - name: Install and regenerate bundle
+        if: steps.scope.outputs.changed == 'true'
+        working-directory: plugins/miro
+        run: |
+          npm ci
+          npm run bundle
+          npm run verify-bundle
+      - name: Commit regenerated bundle when drifted
+        if: steps.scope.outputs.changed == 'true'
+        run: |
+          if git diff --quiet -- plugins/miro/dist/index.min.js; then
+            echo "dist already matches source — nothing to commit"
+            exit 0
+          fi
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git add plugins/miro/dist/index.min.js
+          git commit -m "chore(miro): regenerate dist for dependabot manifest bump"
+          git push

From 73e1476b92f87decbd006578a6810ba77542f2c1 Mon Sep 17 00:00:00 2001
From: Cursor Agent <cursoragent@cursor.com>
Date: Wed, 12 Aug 2026 12:39:52 +0000
Subject: [PATCH 2/2] fix(ci): satisfy zizmor on dependabot-miro-bundle
 workflow

Co-authored-by: Kyle Sexton <kyle-sexton@users.noreply.github.com>
---
 .github/workflows/dependabot-miro-bundle.yml | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/dependabot-miro-bundle.yml b/.github/workflows/dependabot-miro-bundle.yml
index 1d48f9b788..e893353916 100644
--- a/.github/workflows/dependabot-miro-bundle.yml
+++ b/.github/workflows/dependabot-miro-bundle.yml
@@ -12,7 +12,8 @@ permissions:
 
 jobs:
   regenerate-miro-bundle:
-    if: github.actor == 'dependabot[bot]'
+    # zizmor: ignore[bot-conditions] dependabot-only job; login is read from the PR user, not github.actor
+    if: github.event.pull_request.user.login == 'dependabot[bot]'
     runs-on: ubuntu-24.04
     timeout-minutes: 10
     permissions:
@@ -24,6 +25,7 @@ jobs:
         with:
           ref: ${{ github.head_ref }}
           fetch-depth: 0
+          persist-credentials: false
       - name: Detect miro manifest changes
         id: scope
         env:
@@ -50,6 +52,8 @@ jobs:
           npm run verify-bundle
       - name: Commit regenerated bundle when drifted
         if: steps.scope.outputs.changed == 'true'
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           if git diff --quiet -- plugins/miro/dist/index.min.js; then
             echo "dist already matches source — nothing to commit"
@@ -59,4 +63,5 @@ jobs:
           git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
           git add plugins/miro/dist/index.min.js
           git commit -m "chore(miro): regenerate dist for dependabot manifest bump"
+          git remote set-url origin "https://x-access-token:${GITHUB_TOKEN}@github.com/${GITHUB_REPOSITORY}.git"
           git push