chore(ci): SHA-pin third-party actions, add uv Dependabot coverage - #13
Merged
Merged
Conversation
…ndabot coverage This repo had no Dependabot coverage for the packages it actually depends on — dependabot.yml declared only the github-actions ecosystem, so nothing was ever proposed for pyproject.toml or uv.lock. As a reference implementation that customers read and copy, its config is worth keeping exemplary rather than minimal — the posture here propagates outward the same way the integration template's does. Adds the uv ecosystem (uv.lock is committed, so Dependabot maintains the lock as well as pyproject.toml) and pins the two third-party actions by commit SHA. GitHub-owned actions stay on tags per the frontend apps' convention. astral-sh/setup-uv is pinned where it already sat, v9.0.0, with majors now ignored. It is deliberately not downgraded to the backend's v8.3.2: that would be churn with a real behaviour change (v9 flipped prune-cache) and no security gain. What the fleet shares is the rule, not the version number.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This repo had no Dependabot coverage for its own dependencies —
dependabot.ymldeclared only thegithub-actionsecosystem, so nothing was ever proposed forpyproject.tomloruv.lock.As a reference implementation customers read and copy, its config is worth keeping exemplary rather than minimal — the posture here propagates outward the same way the integration template's does.
Changes
Dependabot gains the
uvecosystem.uv.lockis committed, so Dependabot will maintain the lock as well aspyproject.toml.Two third-party actions pinned by commit SHA. GitHub-owned actions stay on tags per the frontend apps' convention.
astral-sh/setup-uvpinned where it already sat,v9.0.0, with majors now ignored. Deliberately not downgraded to the backend's v8.3.2 — that would be churn with a real behavior change (v9 flippedprune-cacheto false) and no security gain. What the fleet shares is the rule, not the version number.Note this repo and
robosystems-integration-templatenow sit on different setup-uv majors (v9.0.0 vs v8.3.2). That's pre-existing and both are pinned and held; worth aligning if you'd rather the two customer-facing repos read identically, but it isn't a correctness issue.Verification
All workflow YAML parses; the
dependabot.ymlschema is validated by GitHub's own check on this PR. No Python source touched.