chore(ci): SHA-pin third-party actions, add uv Dependabot coverage - #14
Merged
Merged
Conversation
…ndabot coverage This repo had no Dependabot coverage for the packages it actually depends on — dependabot.yml declared only the github-actions ecosystem, so nothing was ever proposed for pyproject.toml or uv.lock. That matters more here than the repo's own size suggests: this is the template customers copy, so whatever posture it carries propagates to third parties. An unpinned action or an unmaintained lockfile is not just this repo's problem, it is the starting point everyone downstream inherits. Adds the uv ecosystem (uv.lock is committed, so Dependabot maintains the lock as well as pyproject.toml) and pins the two third-party actions by commit SHA. GitHub-owned actions stay on tags per the frontend apps' convention. astral-sh/setup-uv is pinned at v8.3.2, which is where it already sat and is the same major the robosystems backend runs, so there is nothing to reconcile. Majors are now ignored, matching the fleet rule.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This repo had no Dependabot coverage for its own dependencies —
dependabot.ymldeclared only thegithub-actionsecosystem, so nothing was ever proposed forpyproject.tomloruv.lock.That matters more than the repo's size suggests: this is the template customers copy, so whatever posture it carries propagates to third parties. An unpinned action or an unmaintained lockfile isn't just this repo's problem — it's the starting point everyone downstream inherits.
Changes
Dependabot gains the
uvecosystem.uv.lockis committed here, so unlike the library repos Dependabot will actively maintain the lock as well aspyproject.toml— routine update PRs will actually flow.Two third-party actions pinned by commit SHA. GitHub-owned actions stay on tags per the frontend apps' convention.
astral-sh/setup-uvpinned at v8.3.2 — where it already sat, and the same major the robosystems backend runs, so there's nothing to reconcile. Majors are now ignored, matching the fleet rule; this just stops the major being re-offered every month.Verification
All workflow YAML parses; the
dependabot.ymlschema is validated by GitHub's own check on this PR. No Python source touched.