From 3296940806f2ed611393bbac447381c16fba90b4 Mon Sep 17 00:00:00 2001
From: Holden <holden@arch.fyi>
Date: Wed, 17 Jun 2026 03:12:00 +0000
Subject: [PATCH 1/2] fix: lockfile workflow opens PR on dev instead of direct
 push

dev is a protected branch requiring PRs. The previous direct push caused
the lockfile update CI job to fail with 'protected branch hook declined'.
When the triggering branch is dev, the workflow now creates a side branch
and opens a PR; all other branches continue to push directly.
---
 .github/workflows/update-lockfile.yml | 18 +++++++++++++++++-
 1 file changed, 17 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/update-lockfile.yml b/.github/workflows/update-lockfile.yml
index c42f6f1..46f983c 100644
--- a/.github/workflows/update-lockfile.yml
+++ b/.github/workflows/update-lockfile.yml
@@ -15,6 +15,7 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: write
+      pull-requests: write
     steps:
       - name: Checkout repository
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
@@ -39,9 +40,24 @@ jobs:
 
       - name: Commit and push updated lockfile
         if: steps.diff.outputs.changed == 'true'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           git config user.name "github-actions[bot]"
           git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
           git add uv.lock
           git commit -m "chore: update lockfile"
-          git push
+
+          if [ "$GITHUB_REF_NAME" = "dev" ]; then
+            # dev is protected — open a PR rather than pushing directly
+            BRANCH="chore/lockfile-$(git rev-parse --short HEAD)"
+            git checkout -b "$BRANCH"
+            git push origin "$BRANCH"
+            gh pr create \
+              --base dev \
+              --head "$BRANCH" \
+              --title "chore: update lockfile" \
+              --body "Automated lockfile update triggered by a \`pyproject.toml\` change on \`dev\`."
+          else
+            git push
+          fi

From dc0c431e6bb80674ad3fdbf795f8de0cce1050c7 Mon Sep 17 00:00:00 2001
From: Holden <holden@arch.fyi>
Date: Wed, 17 Jun 2026 03:12:20 +0000
Subject: [PATCH 2/2] chore: update lockfile

---
 uv.lock | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/uv.lock b/uv.lock
index 6d4c89e..0c3f5ba 100644
--- a/uv.lock
+++ b/uv.lock
@@ -905,7 +905,7 @@ wheels = [
 
 [[package]]
 name = "winnow"
-version = "0.6.4"
+version = "0.6.5"
 source = { editable = "." }
 dependencies = [
     { name = "croniter" },