Merge pull request #14 from RoboFinSystems/chore/ci-dependency-posture

chore(ci): SHA-pin third-party actions, add uv Dependabot coverage

Author: jfrench9

.github/dependabot.yml

@@ -1,9 +1,42 @@
 version: 2
+
 updates:
+  # Python — uv dependencies in pyproject.toml
+  - package-ecosystem: 'uv'
+    directory: '/'
+    schedule:
+      interval: 'monthly'
+    labels:
+      - 'dependencies'
+    # uv.lock is committed, so Dependabot maintains the lock as well as
+    # pyproject.toml. No groups: the dependency set is two packages
+    # (robosystems-client, httpx) and they are unrelated.
+    #
+    # Note this repo is a template that customers copy, so whatever posture it
+    # carries propagates outward. That is the argument for keeping its config
+    # exemplary rather than minimal.
+
   # GitHub Actions — pinned action versions
   - package-ecosystem: 'github-actions'
     directory: '/'
     schedule:
       interval: 'monthly'
     labels:
       - 'dependencies'
+    groups:
+      github-actions:
+        patterns:
+          - '*'
+        update-types:
+          - 'minor'
+          - 'patch'
+    ignore:
+      # Held across the fleet: the robosystems backend pins v8.3.2 and ignores
+      # majors because v9 flipped `prune-cache` to false and would grow its uv
+      # cache. This repo is already on v8.3.2, the same pin, so there is
+      # nothing to reconcile — the ignore just stops the major being re-offered
+      # every month. Drop this entry when the backend takes a setup-uv major,
+      # and move in step with it.
+      - dependency-name: 'astral-sh/setup-uv'
+        update-types:
+          - 'version-update:semver-major'

.github/workflows/claude.yml

@@ -37,7 +37,7 @@ jobs:
 
       - name: Run Claude Code
         id: claude
-        uses: anthropics/claude-code-action@v1
+        uses: anthropics/claude-code-action@a874e9ecd7bb36efdad65429c6b35815f5a08f10 # v1
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
 

.github/workflows/run.yml

@@ -37,7 +37,7 @@ jobs:
           python-version: '3.13'
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v8.3.2
+        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
 
       - name: Install dependencies
         run: uv sync

.github/workflows/test.yml

@@ -20,7 +20,7 @@ jobs:
           python-version: "3.13"
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v8.3.2
+        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
 
       - name: Install dependencies
         run: |