Add .github/dependabot.yml to open weekly dependency PRs - #548
Open
turbomam wants to merge 2 commits into
Open
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
Adds a Dependabot configuration to automate weekly dependency update pull requests for Python (Poetry via pip ecosystem) and GitHub Actions, with grouping intended to reduce PR noise.
Changes:
- Introduces
.github/dependabot.ymlwith weekly schedules forpipandgithub-actions. - Groups Python minor/patch updates into a single weekly PR and applies dependency-related labels.
- Adds grouping and labeling for GitHub Actions updates.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+35
to
+38
| groups: | ||
| actions: | ||
| patterns: | ||
| - "*" |
There was a problem hiding this comment.
The PR description says major updates should remain individual PRs, but this GitHub Actions group will currently match all updates (including majors) because it doesn’t restrict update-types. To keep majors ungrouped (Dependabot default), add update-types: ["minor", "patch"] to this actions group (or split into separate minor/patch group and leave majors ungrouped).
This was referenced Apr 17, 2026
Closed
Closed
Configures Dependabot to open grouped weekly PRs for Python and GitHub Actions dependencies. Minor/patch updates are bundled into one weekly PR per ecosystem to reduce review overhead; major updates get individual PRs so they can be reviewed separately. No automation is forced — Dependabot only opens PRs; merges remain manual. Partially addresses #546.
Without update-types on the actions group, major Actions updates would have been swept into the group too, contradicting the PR description that says majors stay individual. Mirror the pip group's restriction.
realmarcin
force-pushed
the
add-dependabot-config
branch
from
August 15, 2026 07:23
ab915f2 to
a21d765
Compare
realmarcin
added a commit
that referenced
this pull request
Aug 16, 2026
A backlog doc that misstates status is worse than none, and this one shipped with three errors of exactly that kind — all introduced by describing state that changed later the same day. * It listed #548, #550, #551 and #552 as four untouched April drafts. #550 and #551 were closed hours before this file was written (obsolete, and false-premise). Only two are open. * It described #546 as "30 Dependabot alerts". All 33 were stale — every one named a package already pinned at or past its patched version — and have since been dismissed with per-alert evidence. Calling them outstanding overstates the exposure, which is the opposite of what a security line should do. * It called two of #788's regressions sibling-repo work and miscounted which four they were. `alpha-Lactose` and `Carboxymethyl cellulose` were **live** — `find_chebi_by_name` returned the monohydrate and the sodium salt — and are now overridden locally, so the shipped artifact is correct while the upstream rows remain wrong. `Cysteine-HCl` is a pre-existing bad grounding, not one of the four. Also dropped the exact sibling-repo line numbers, which had already drifted (954 -> 1017, 1183 -> 1246). Citing line numbers in an external, unpinned file guarantees this.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this does
Configures Dependabot to open weekly PRs for Python and GitHub Actions dependencies.
dependencies(+github-actionsfor Actions)What it explicitly does NOT do
poetry.lockdirectly — Dependabot will resolve and propose updates through its own PRs.Strengths
Weaknesses / things worth flagging
master. CI fails at theLintingstep on every PR until master failsruff checkon 3.12 CI — 7 lint errors in tests/test_mediadive_bulk_download.py #549 / Fix pre-existing ruff lint errors in tests/test_mediadive_bulk_download.py (closes #549) #550 lands. This PR's own CI can't go green until that's fixed.poetry updatepass (see draft PR forthcoming, if that's the route the team prefers).Admin-required follow-ups (partially addresses #546)
These need admin permission (my role is
maintain). Worth doing once this PR lands to get the most value:masterwithqc.ymljobs as required status checks. Today: no protection configured (gh api repos/.../branches/master/protectionreturns 404). This is the biggest single gap in the repo's merge-safety posture.allow_auto_mergeat repo level (Settings → General → Pull Requests). Adds the per-PR auto-merge button; does not force anything.Risk
Low. If the team wants to decline, closing this PR reverts to the status quo (no Dependabot PRs; alerts continue to accumulate).