Use TOML for authored configuration and policies

.github/dependency-policy.toml

@@ -0,0 +1,9 @@
+version = 1
+mode = "auto"
+ci_workflow = "ci.yml"
+required_checks = ["Test"]
+integration_job = "ci"
+dispatch_workflow = "ci.yml"
+max_group_size = 10
+managed_dependencies = ["aviorstudio/gdam-actions/*", "nicodes/komizo-actions/*", "nicodes/komizo/*", "nicodes/tools/*"]
+sensitive_dependencies = ["*clerk*", "*pocketbase*", "*crypto*", "*jsonwebtoken*", "*jose*", "*oauth*", "*openid*", "*passport*", "*bcrypt*", "*argon2*", "@noble/*", "*prisma*", "*drizzle*", "*migrate*", "modernc.org/sqlite", "github.com/jackc/pgx/*", "github.com/go-sql-driver/mysql", "go.mongodb.org/mongo-driver/*"]

.github/readme-source.toml

@@ -0,0 +1,5 @@
+version = 1
+sha256 = "1e665422df7c46c45c7012d5edea1d202e481ad75fed77f2411b2498e1998bc3"
+
+[history]
+forbidden_commits = ["0eb77f25b1b2c0df30fb7a80abb435bf5bd65724"]

.github/scripts/check-documentation.py

@@ -1,11 +1,11 @@
 #!/usr/bin/env python3
 """Check tracked documentation layout and the reviewed usage README digest."""
 import hashlib
-import json
 import os
 from pathlib import Path, PurePosixPath
 import subprocess
 import sys
+import tomllib
 
 MARKDOWN = {'.md', '.markdown', '.mdown', '.mkd', '.mkdn', '.mdwn', '.mdx', '.rmd', '.qmd'}
 OTHER_DOCS = {'.rst', '.adoc', '.asciidoc'}
@@ -39,10 +39,10 @@ def check(root, include_history=True, history_required=False):
                 body = readme.read_bytes()
                 if not any(line.startswith('# ') for line in body.decode('utf-8').splitlines()):
                     errors.append('root README.md needs a product heading')
-                policy_path = root / '.github/readme-source.json'
+                policy_path = root / '.github/readme-source.toml'
                 if policy_path.is_symlink():
                     raise ValueError('README source policy cannot be a symlink')
-                policy = json.loads(policy_path.read_text())
+                policy = tomllib.loads(policy_path.read_text())
                 if policy.get('version') != 1:
                     raise ValueError('unsupported README source policy')
                 if hashlib.sha256(body).hexdigest() != policy.get('sha256'):

.github/workflows/dependency-policy.yml

@@ -48,7 +48,7 @@ jobs:
       env:
         GH_TOKEN: ${{ github.token }}
       timeout-minutes: 7
-      uses: nicodes/tools/dependencies@a1c0321f3b4917a7e99eca42e241e46670f6e1e1
+      uses: nicodes/tools/dependencies@39666e8d26d2bd0e1c7e5fee6f289fd0fd3a5202
       with:
         apply: 'true'
         output: ${{ runner.temp }}/dependency-report.json