Merge branch 'main' into dependabot/gradle/main/com.fasterxml.jackson.core-jackson-databind-2.22.2

Author: abashev

.github/workflows/dependabot-automerge.yml

@@ -17,16 +17,26 @@ jobs:
         with:
           github-token: "${{ secrets.GITHUB_TOKEN }}"
 
+      # GITHUB_TOKEN, deliberately: a review starts no workflow run and does not need to, so the
+      # short-lived token is enough and the approval shows in the PR as the bot rather than as a
+      # person. This needs `can_approve_pull_request_reviews` on the repository — no `permissions`
+      # block can stand in for it, and without it GitHub refuses with "GitHub Actions is not
+      # permitted to approve pull requests".
       - name: Approve patch and minor updates
         if: steps.metadata.outputs.update-type != 'version-update:semver-major'
         run: gh pr review --approve "$PR_URL"
         env:
           PR_URL: ${{ github.event.pull_request.html_url }}
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
+      # BOT_PAT here, and not GITHUB_TOKEN: auto-merge is completed on behalf of whoever enabled
+      # it, and a push made by GITHUB_TOKEN starts no workflow runs. Enabled with GITHUB_TOKEN the
+      # merge lands on main silently — no CI, no CodeQL, no dependency snapshot, and
+      # update-pr-branch never wakes to rebase the remaining PRs, so the automation cuts its own
+      # legs. A PAT is a real user, so the push behaves like any other.
       - name: Enable auto-merge for patch and minor updates
         if: steps.metadata.outputs.update-type != 'version-update:semver-major'
         run: gh pr merge --auto --squash "$PR_URL"
         env:
           PR_URL: ${{ github.event.pull_request.html_url }}
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_TOKEN: ${{ secrets.BOT_PAT }}

docs/icon/README.md

@@ -0,0 +1,38 @@
+# Icon
+
+A broken method chain: one long line, then a group of shorter ones sharing a left edge, with a
+column guide down the right. It is the formatter's own output shape — the thing that distinguishes
+it is deciding *where* to break and what to line up, not laying everything out uniformly.
+
+| File | Use |
+|---|---|
+| `icon.svg` | The mark. Inherits `currentColor`, so one file covers light, dark and monochrome. |
+| `favicon.svg` | Same geometry, guide at full strength. Below ~24px contrast is what keeps the guide visible, not shape. |
+| `avatar.svg` | The mark on a white rounded square, for the GitHub organisation and marketplace tiles. |
+| `avatar-512.png`, `avatar-128.png` | Rasterised from `avatar.svg`; GitHub organisation avatars must be raster. |
+
+Regenerate the PNGs after editing the SVG:
+
+```bash
+rsvg-convert -w 512 -h 512 docs/icon/avatar.svg -o docs/icon/avatar-512.png
+rsvg-convert -w 128 -h 128 docs/icon/avatar.svg -o docs/icon/avatar-128.png
+```
+
+## What not to break
+
+The mark has seven elements, which is the ceiling for 16px. Anything added has to displace
+something else.
+
+- **The shared right edge does the work.** The first and third bars end on the same x. That
+  implied vertical is what carries "there is a boundary" at sizes where the dashes disappear, and
+  it costs nothing because no thin element draws it. Changing either bar's width breaks the idea
+  silently — the icon will still look fine at 64px and mean nothing at 16px.
+- **The guide's rhythm must not match the bars'.** Three dashes against four bars is deliberate:
+  mismatched rhythms read as two layers, so the boundary belongs to the format rather than to any
+  one line. Align them and the dashes turn into decoration stuck on the bar ends.
+- **Check every edit at 16px first.** Every version of this mark looked fine large. The small size
+  is the only one that rejects anything.
+
+The two colours in `avatar.svg` are the only brand decision baked in here, and they are a
+placeholder. The white ground means that on GitHub's light theme the tile itself disappears and
+only the mark reads; an off-white ground keeps the tile visible if that is preferred.