feat: harden block inputs (batch 1)

Author: Splitter

.github/workflows/upgrade.yml

@@ -0,0 +1,84 @@
+name: Upgrade HugoBlox
+
+on:
+  workflow_dispatch:
+    inputs:
+      version_type:
+        description: 'Upgrade to version'
+        required: true
+        default: 'stable'
+        type: choice
+        options:
+        - stable
+        - canary
+  schedule:
+    # Run at 05:00 on Monday
+    - cron: '0 5 * * 1'
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  upgrade:
+    name: Upgrade
+    if: github.repository_owner != 'HugoBlox'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+
+      - name: Setup Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: '1.21'
+
+      - name: Setup Hugo
+        uses: peaceiris/actions-hugo@v3
+        with:
+          hugo-version: 'latest'
+          extended: true
+
+      - name: Run Upgrade CLI
+        env:
+          # Use manual input or default to stable for scheduled runs
+          VERSION_TYPE: ${{ inputs.version_type || 'stable' }}
+        run: |
+          FLAGS="--yes --ci"
+          
+          if [ "$VERSION_TYPE" == "canary" ]; then
+            FLAGS="$FLAGS --canary"
+          fi
+          
+          echo "Running upgrade with flags: $FLAGS"
+          npx --yes hugoblox@latest upgrade $FLAGS
+
+      - name: Create Pull Request
+        uses: peter-evans/create-pull-request@v6
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          commit-message: "chore(deps): upgrade hugoblox modules"
+          title: "⬆️ Upgrade HugoBlox Modules"
+          body: |
+            This PR upgrades the [HugoBlox](https://hugoblox.com) modules to the latest version.
+            
+            **Changes:**
+            - Updated Hugo Modules (go.mod/go.sum)
+            - Applied automatic migrations (if any)
+            
+            **Verification:**
+            - [ ] Check the Deploy Preview to ensure everything looks correct.
+            - [ ] Merge this PR to apply the updates.
+          branch: "chore/upgrade-hugoblox"
+          delete-branch: true
+          base: main
+          labels: |
+            dependencies
+            automated-pr