From 9ca32f0558ce9639cc6114671681e729744ecb9f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?H=C3=A5kon=20H=C3=A6gland?= Date: Mon, 10 Aug 2026 10:15:18 +0200 Subject: [PATCH] Add Dependabot configuration for pip and GitHub Actions Without a .github/dependabot.yml GitHub only raises security alerts; it never opens version-update pull requests. That is why the Poetry lock file was able to drift far behind upstream, leaving 23 open alerts to be cleared in one batch, and why python_scripts.yml is still pinned to actions/checkout@v3 and actions/setup-python@v4 while python_sphinx_docs.yml has moved on to v4 and v5. Two ecosystems are covered: - pip, rooted at /python/sphinx_docs, which is where pyproject.toml and poetry.lock live - github-actions, rooted at /, which picks up the workflow action pins. Only tag-referenced actions can be bumped, so this manages actions/checkout and actions/setup-python; OPM/actions-poetry@master and OPM/github-pages-deploy-action@releases/v4 are branch refs and are left untouched. Both use a monthly schedule with every package in a single group, so each ecosystem produces at most one pull request per month. Ungrouped updates would be unmanageable: GitPython alone went through eight patch releases in the three weeks from 2026-07-21 to 2026-08-07. Security updates are unaffected and are still opened immediately when an advisory is published. --- .github/dependabot.yml | 41 +++++++++++++++++++++++++++++++++++++++++ 1 file changed, 41 insertions(+) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..2f901de --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,41 @@ +# Dependabot configuration. +# +# Without this file GitHub only raises *security* alerts; it never opens +# version-update pull requests. That is how the Poetry lock file was allowed to +# drift several years behind upstream (see PR #27, which had to clear 23 open +# alerts in one go). +# +# Everything is grouped into a single pull request per ecosystem, because +# ungrouped updates are unmanageable here: GitPython alone went through eight +# patch releases in the three weeks from 2026-07-21 to 2026-08-07, each of which +# would have arrived as its own pull request. +# +# Note that this file only affects scheduled version updates. Security updates +# are still opened immediately and individually whenever an advisory is +# published, independently of the schedule below. +version: 2 +updates: + # Python dependencies for the Sphinx documentation build. The directory is + # the one holding pyproject.toml / poetry.lock; the "pip" ecosystem covers + # Poetry projects. + - package-ecosystem: "pip" + directory: "/python/sphinx_docs" + schedule: + interval: "monthly" + groups: + python-dependencies: + patterns: + - "*" + + # Workflow action pins. Dependabot can only bump actions referenced by a + # version tag, so this covers actions/checkout and actions/setup-python. + # OPM/actions-poetry@master and OPM/github-pages-deploy-action@releases/v4 + # are branch refs and are left alone. + - package-ecosystem: "github-actions" + directory: "/" + schedule: + interval: "monthly" + groups: + github-actions: + patterns: + - "*"