Repository navigation
ci(dependabot): configure dependabot for uv security updates - #37
Conversation
- add .github/dependabot.yml for the uv ecosystem with conventional commit prefixes - group security updates into a single PR and disable routine version-bump PRs Signed-off-by: thxCode <thxcode0824@gmail.com>
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces a Dependabot configuration file (.github/dependabot.yml) to automate dependency updates. The review feedback correctly identifies that uv is not a supported package ecosystem for GitHub Dependabot and recommends using pip instead to manage Python dependencies.
| @@ -0,0 +1,15 @@ | |||
| version: 2 | |||
| updates: | |||
| - package-ecosystem: "uv" | |||
There was a problem hiding this comment.
GitHub Dependabot does not support uv as a valid package-ecosystem. To configure Dependabot for Python dependencies (including those managed by uv via pyproject.toml), you should use pip as the package ecosystem.
- package-ecosystem: "pip"There was a problem hiding this comment.
Not fixed (false positive): GitHub Dependabot natively supports package-ecosystem: "uv" for pyproject.toml and uv.lock, and the dependabot app check run (.github/dependabot.yml — Dependabot config file validation) passed on this PR (All changes look good). Switching to "pip" would prevent Dependabot from updating uv.lock.
Review Triage Summary
|
There was a problem hiding this comment.
🟢 Approval recommended
The configuration matches the stated security-update requirements, with no unresolved issues.
No open issues 🎉
What changed in this PR
Adds Dependabot configuration for the repository’s uv dependencies, targeting security fixes without routine version-update PRs.
Changes:
- Configures Conventional Commit messages with a
choreprefix and dependency scope. - Groups security updates into a single PR.
- Disables routine version-update PRs with
open-pull-requests-limit: 0.
| File | Description |
|---|---|
.github/dependabot.yml |
Configures uv security-update grouping, commit formatting, and version-update limits. |
Review effort: Balanced
Add
.github/dependabot.ymlfor theuvpackage ecosystem so Dependabot security updates:chore(deps): ...to satisfy Commitizen checks.open-pull-requests-limit: 0so Dependabot only opens PRs for security vulnerabilities rather than routine weekly version bumps.