From f76635cd9356276aa1c240e6746eba9b3692cf87 Mon Sep 17 00:00:00 2001
From: Andrew Whalley <awhalley@google.com>
Date: Tue, 11 Aug 2026 14:39:45 -0700
Subject: [PATCH 1/3] Fix checked-in merge conflict markers from commit d4114e6

---
 .github/workflows/jekyll.yml | 17 -----------------
 1 file changed, 17 deletions(-)

diff --git a/.github/workflows/jekyll.yml b/.github/workflows/jekyll.yml
index 6f1b946..d4dd0f6 100644
--- a/.github/workflows/jekyll.yml
+++ b/.github/workflows/jekyll.yml
@@ -34,36 +34,19 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
       - name: Setup Ruby
-<<<<<<< HEAD
-        # https://github.com/ruby/setup-ruby/releases/tag/v1.207.0
-        uses: ruby/setup-ruby@4a9ddd6f338a97768b8006bf671dfbad383215f4
-        with:
-          ruby-version: '3.4.1' # Not needed with a .ruby-version file
-          bundler-cache: true # runs 'bundle install' and caches installed gems automatically
-          cache-version: 0 # Increment this number if you need to re-download cached gems
-=======
         uses: ruby/setup-ruby@v1
         with:
           ruby-version: '3.3'
           bundler-cache: true # runs 'bundle install' and caches installed gems automatically
           cache-version: 0
->>>>>>> refs/remotes/origin/main
       - name: Setup Pages
         id: pages
         uses: actions/configure-pages@v5
       - name: Build with Jekyll
-<<<<<<< HEAD
-        # Outputs to the './_site' directory by default
-=======
->>>>>>> refs/remotes/origin/main
         run: bundle exec jekyll build --baseurl "${{ steps.pages.outputs.base_path }}"
         env:
           JEKYLL_ENV: production
       - name: Upload artifact
-<<<<<<< HEAD
-        # Automatically uploads an artifact from the './_site' directory by default
-=======
->>>>>>> refs/remotes/origin/main
         uses: actions/upload-pages-artifact@v3
 
   # Deployment job

From ce538944fa591891a2371eddafcd75812ccda1c9 Mon Sep 17 00:00:00 2001
From: Andrew Whalley <awhalley@google.com>
Date: Tue, 11 Aug 2026 14:49:40 -0700
Subject: [PATCH 2/3] Fix zizmor flagged issued in jekyll.yml

---
 .github/workflows/jekyll.yml | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/jekyll.yml b/.github/workflows/jekyll.yml
index d4dd0f6..9cfe22b 100644
--- a/.github/workflows/jekyll.yml
+++ b/.github/workflows/jekyll.yml
@@ -32,22 +32,23 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       - name: Setup Ruby
-        uses: ruby/setup-ruby@v1
+        uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1
         with:
           ruby-version: '3.3'
           bundler-cache: true # runs 'bundle install' and caches installed gems automatically
           cache-version: 0
       - name: Setup Pages
         id: pages
-        uses: actions/configure-pages@v5
+        uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5
       - name: Build with Jekyll
-        run: bundle exec jekyll build --baseurl "${{ steps.pages.outputs.base_path }}"
+        run: bundle exec jekyll build --baseurl "$BASE_PATH"
         env:
+          BASE_PATH: ${{ steps.pages.outputs.base_path }}
           JEKYLL_ENV: production
       - name: Upload artifact
-        uses: actions/upload-pages-artifact@v3
+        uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3
 
   # Deployment job
   deploy:
@@ -59,4 +60,4 @@ jobs:
     steps:
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v5
+        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5

From f3dc9abcf9627cee4400fc02caff2c33765692a4 Mon Sep 17 00:00:00 2001
From: Andrew Whalley <awhalley@google.com>
Date: Tue, 11 Aug 2026 14:54:21 -0700
Subject: [PATCH 3/3] Tightend default GITHUB_TOKEN permissions

---
 .github/workflows/jekyll.yml | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/jekyll.yml b/.github/workflows/jekyll.yml
index 9cfe22b..00a35ce 100644
--- a/.github/workflows/jekyll.yml
+++ b/.github/workflows/jekyll.yml
@@ -14,11 +14,9 @@ on:
   # Allows you to run this workflow manually from the Actions tab
   workflow_dispatch:
 
-# Sets permissions of the GITHUB_TOKEN to allow deployment to GitHub Pages
+# Sets permissions of the GITHUB_TOKEN
 permissions:
   contents: read
-  pages: write
-  id-token: write
 
 # Allow only one concurrent deployment, skipping runs queued between the run in-progress and latest queued.
 # However, do NOT cancel in-progress runs as we want to allow these production deployments to complete.
@@ -30,6 +28,10 @@ jobs:
   # Build job
   build:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pages: write
+      id-token: write
     steps:
       - name: Checkout
         uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
@@ -57,6 +59,10 @@ jobs:
       url: ${{ steps.deployment.outputs.page_url }}
     runs-on: ubuntu-latest
     needs: build
+    permissions:
+      contents: read
+      pages: write
+      id-token: write
     steps:
       - name: Deploy to GitHub Pages
         id: deployment