From 298dbb835c9518ddd0aa83b68c1f2be242c3eb3f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Felipe=20Say=C3=A3o=20Lobato=20Abreu?=
 <github@mentordosnerds.com>
Date: Fri, 9 Oct 2026 20:44:33 -0300
Subject: [PATCH 1/3] ci: adopt native Pages reports with template 2.1

---
 .github/workflows/reports.yml | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/reports.yml b/.github/workflows/reports.yml
index 993a891..1fd230f 100644
--- a/.github/workflows/reports.yml
+++ b/.github/workflows/reports.yml
@@ -2,16 +2,16 @@ name: "Fast Forward Reports"
 
 on:
   push:
-    branches:
-      - main
+    branches: [main]
+  pull_request:
   workflow_dispatch:
 
+# Caller permissions cap the callee; only its isolated deploy job writes Pages.
 permissions:
-  contents: write
+  contents: read
   pages: write
   id-token: write
 
 jobs:
   reports:
-    uses: php-fast-forward/dev-tools/.github/workflows/reports.yml@main
-    secrets: inherit
+    uses: php-fast-forward/dev-tools/.github/workflows/reports-native.yml@main

From 3fb9e2119fde2899601a0e389e96be7f9f963178 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Felipe=20Say=C3=A3o=20Lobato=20Abreu?=
 <github@mentordosnerds.com>
Date: Fri, 9 Oct 2026 20:58:38 -0300
Subject: [PATCH 2/3] ci: supply isolated test publisher permissions

---
 .github/workflows/tests.yml | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 83ea015..92999fa 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -5,11 +5,13 @@ on:
   workflow_dispatch:
 
 permissions:
-  contents: write
-  pages: write
-  id-token: write
+  contents: read
+  actions: read
+  statuses: write
 
 jobs:
   tests:
     uses: php-fast-forward/dev-tools/.github/workflows/tests.yml@main
+    with:
+      publish-required-statuses: ${{ github.actor != 'dependabot[bot]' }}
     secrets: inherit

From e7642aeb03bb6e9b17fc10400f18a590aa19e499 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Felipe=20Say=C3=A3o=20Lobato=20Abreu?=
 <github@mentordosnerds.com>
Date: Fri, 9 Oct 2026 21:27:36 -0300
Subject: [PATCH 3/3] ci: document native Pages and OIDC permission grants

---
 .github/workflows/reports.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/reports.yml b/.github/workflows/reports.yml
index 1fd230f..e20d83c 100644
--- a/.github/workflows/reports.yml
+++ b/.github/workflows/reports.yml
@@ -9,8 +9,8 @@ on:
 # Caller permissions cap the callee; only its isolated deploy job writes Pages.
 permissions:
   contents: read
-  pages: write
-  id-token: write
+  pages: write # Allows the callee's isolated main-only Pages deployment.
+  id-token: write # Allows OIDC authentication for that Pages deployment.
 
 jobs:
   reports: