chore: fix Dependabot version-bump gate and stop tightening squawk-cli

[stephen-kintsugi]

Summary

Follow-ups surfaced by the first Dependabot PRs (#12, #13):

• Exempt Dependabot from the version-bump gate (ci.yml): the "version must differ from main" check fails on any Dependabot pip PR, because Dependabot edits pyproject.toml (dependency constraints) but never bumps the package version. Skipped for dependabot[bot]; dependency changes roll into the next release.
• Stop tightening squawk-cli (dependabot.yml): versioning-strategy: increase was raising the intentional >=2.0 floor (e.g. to >=2.61.0), which would force consumers off their own additional_dependencies pins. Now ignored.

Also created the missing dependencies label so Dependabot can apply it.

Notes

• After this merges, Dependabot re-runs and chore(deps): bump the python-packages group with 6 updates #13 comes back clean (no squawk-cli bump, gate passes).

---

Note

Low Risk
Changes only affect Dependabot configuration and CI gating for bot PRs; no runtime or application logic is modified.

Overview
Fixes CI and Dependabot behavior that broke the first dependency update PRs.

CI version gate: The check that requires the package version in pyproject.toml to differ from main now runs only when the PR author is not dependabot[bot]. Dependabot edits pyproject.toml for dependency bumps but never bumps the library version, so those PRs would always fail. The exemption uses pull_request.user.login rather than github.actor so human actions on a bot branch do not accidentally re-enable the check.

Dependabot: squawk-cli is added to the pip ignore list so Dependabot cannot raise the deliberate broad floor (>=2.0 in pyproject.toml) via versioning-strategy: increase, which would interfere with consumers pinning squawk via additional_dependencies.

^{Reviewed by Cursor Bugbot for commit 769aff3. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 1c6845a. Configure here.}

[cursor]

PR Risk Assessment

Risk level: Very Low
Review required: No
Reviewers assigned: None (jaykintsugi already requested via CODEOWNERS; no additional assignment needed)
Action taken: Approved

Rationale: The diff only touches .github/dependabot.yml (ignore squawk-cli so Dependabot does not tighten the intentional >=2.0 floor) and .github/workflows/ci.yml (exempt dependabot[bot] PRs from the version-bump gate, keyed on pull_request.user.login rather than github.actor). No production/runtime code paths change; blast radius is limited to CI gating and Dependabot behavior in this repo, and both edits are trivially reversible.

No production code changes — test coverage gate does not apply.

Re-evaluated after the follow-up commit fixing the Dependabot exemption to use PR author instead of github.actor; incremental change is a correctness fix with no material risk increase.

---

risk_level: Very Low
review_required: false
reviewers: []
action_taken: approved
rationale: CI workflow and Dependabot config only (.github/workflows/ci.yml, .github/dependabot.yml); exempts bot PRs from version-bump gate and stops squawk-cli constraint tightening — no production code or runtime behavior change.

  

_{Sent by Cursor Automation: Assign PR reviewers & Assess Risk & Approve if Safe}