Skip to content

Commit 56e2f30

Browse files
DavidHruby1DavidHruby1
authored
Merge pull request #14 from KristianP26/chore/dependabot
ci: add Dependabot for pip and github-actions
2 parents fe05927 + 3c74f71 commit 56e2f30

2 files changed

Lines changed: 192 additions & 0 deletions

File tree

‎.github/dependabot.yml‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
# Dependabot configuration — automated dependency update PRs.
2+
# Docs: https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
3+
version: 2
4+
updates:
5+
# Python dependencies (requirements.txt + requirements-build.txt at root).
6+
- package-ecosystem: "pip"
7+
directory: "/"
8+
schedule:
9+
interval: "weekly"
10+
day: "monday"
11+
time: "06:00"
12+
timezone: "Etc/UTC"
13+
open-pull-requests-limit: 5
14+
commit-message:
15+
prefix: "chore"
16+
include: "scope"
17+
labels:
18+
- "dependencies"
19+
- "python"
20+
groups:
21+
python-minor-and-patch:
22+
update-types:
23+
- "minor"
24+
- "patch"
25+
26+
# GitHub Actions used by the CI and release workflows.
27+
- package-ecosystem: "github-actions"
28+
directory: "/"
29+
schedule:
30+
interval: "weekly"
31+
day: "monday"
32+
time: "06:00"
33+
timezone: "Etc/UTC"
34+
open-pull-requests-limit: 5
35+
commit-message:
36+
prefix: "ci"
37+
include: "scope"
38+
labels:
39+
- "dependencies"
40+
- "github-actions"
41+
groups:
42+
actions-minor-and-patch:
43+
update-types:
44+
- "minor"
45+
- "patch"

‎docs/superpowers/plans/2026-06-04-dependabot.md‎

Lines changed: 147 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,147 @@
1+
# Dependabot Setup Implementation Plan
2+
3+
> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
4+
5+
**Goal:** Enable automated dependency update PRs for the project's two dependency surfaces — Python (`pip`) and GitHub Actions — via a `.github/dependabot.yml` config.
6+
7+
**Architecture:** A single declarative `dependabot.yml` (schema version 2) with two `updates` entries. Both run weekly, group minor+patch bumps into one PR per ecosystem (to cut noise), and leave major bumps as individual PRs (so breaking changes get individual review). No code changes; verification is YAML-parse + structural assertion.
8+
9+
**Tech Stack:** GitHub Dependabot config (YAML v2). Ecosystems: `pip` (root `requirements.txt` + `requirements-build.txt`), `github-actions` (`.github/workflows/*`).
10+
11+
---
12+
13+
## Context (verified in repo)
14+
15+
- Dependency files: `requirements.txt`, `requirements-build.txt` (both at repo root `/`).
16+
- Workflows: `.github/workflows/ci.yml`, `.github/workflows/release.yml`, using `actions/checkout@v4`, `actions/setup-python@v5` (versioned → Dependabot has targets).
17+
- Default branch: `main`. No existing `.github/dependabot.yml`.
18+
- Schema confirmed via GitHub Docs (Context7): `version: 2`; `groups` supports `patterns` / `update-types`; `commit-message` supports `prefix` + `include: "scope"`.
19+
20+
## File Structure
21+
22+
- Create: `.github/dependabot.yml` — the only artifact.
23+
24+
---
25+
26+
## Task 1: Create `dependabot.yml`
27+
28+
**Files:**
29+
- Create: `.github/dependabot.yml`
30+
31+
- [ ] **Step 1: Write the config**
32+
33+
Create `.github/dependabot.yml` with exactly:
34+
35+
```yaml
36+
# Dependabot configuration — automated dependency update PRs.
37+
# Docs: https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
38+
version: 2
39+
updates:
40+
# Python dependencies (requirements.txt + requirements-build.txt at root).
41+
- package-ecosystem: "pip"
42+
directory: "/"
43+
schedule:
44+
interval: "weekly"
45+
day: "monday"
46+
time: "06:00"
47+
timezone: "Etc/UTC"
48+
open-pull-requests-limit: 5
49+
commit-message:
50+
prefix: "chore"
51+
include: "scope"
52+
labels:
53+
- "dependencies"
54+
- "python"
55+
groups:
56+
python-minor-and-patch:
57+
update-types:
58+
- "minor"
59+
- "patch"
60+
61+
# GitHub Actions used by the CI and release workflows.
62+
- package-ecosystem: "github-actions"
63+
directory: "/"
64+
schedule:
65+
interval: "weekly"
66+
day: "monday"
67+
time: "06:00"
68+
timezone: "Etc/UTC"
69+
open-pull-requests-limit: 5
70+
commit-message:
71+
prefix: "ci"
72+
include: "scope"
73+
labels:
74+
- "dependencies"
75+
- "github-actions"
76+
groups:
77+
actions-minor-and-patch:
78+
update-types:
79+
- "minor"
80+
- "patch"
81+
```
82+
83+
- [ ] **Step 2: Verify YAML parses and has the expected structure**
84+
85+
Run (works whether or not PyYAML is installed — falls back to a structural string check):
86+
87+
```bash
88+
.venv/Scripts/python.exe - <<'PY'
89+
import pathlib, sys
90+
text = pathlib.Path(".github/dependabot.yml").read_text(encoding="utf-8")
91+
try:
92+
import yaml
93+
data = yaml.safe_load(text)
94+
assert data["version"] == 2, "version must be 2"
95+
ecos = {u["package-ecosystem"] for u in data["updates"]}
96+
assert ecos == {"pip", "github-actions"}, f"unexpected ecosystems: {ecos}"
97+
for u in data["updates"]:
98+
assert u["directory"] == "/"
99+
assert u["schedule"]["interval"] == "weekly"
100+
assert "groups" in u
101+
print("dependabot.yml OK (parsed via PyYAML):", sorted(ecos))
102+
except ModuleNotFoundError:
103+
for token in ('version: 2', 'package-ecosystem: "pip"',
104+
'package-ecosystem: "github-actions"', 'interval: "weekly"'):
105+
assert token in text, f"missing: {token}"
106+
print("dependabot.yml OK (string check; PyYAML not installed)")
107+
PY
108+
```
109+
Expected: prints an `OK` line, no `AssertionError`.
110+
111+
- [ ] **Step 3: Confirm nothing else broke**
112+
113+
Run: `.venv/Scripts/python.exe -m compileall src/ tests/` and `.venv/Scripts/python.exe -m unittest discover -s tests`
114+
Expected: compile OK; tests still pass (config change touches no Python).
115+
116+
- [ ] **Step 4: Commit**
117+
118+
```bash
119+
git add .github/dependabot.yml
120+
git commit -m "ci: add Dependabot config for pip and github-actions"
121+
```
122+
123+
---
124+
125+
## Task 2: Document the plan
126+
127+
**Files:**
128+
- Create: `docs/superpowers/plans/2026-06-04-dependabot.md` (this file)
129+
130+
- [ ] **Step 1: Commit the plan**
131+
132+
```bash
133+
git add docs/superpowers/plans/2026-06-04-dependabot.md
134+
git commit -m "docs: add Dependabot setup plan"
135+
```
136+
137+
---
138+
139+
## Notes / Decisions baked in
140+
141+
- **Two ecosystems only.** The repo has no Docker/npm/submodules, so `pip` + `github-actions` cover everything.
142+
- **One `pip` entry covers both requirements files** — Dependabot scans the directory and updates the requirements `.txt` files it finds there; no separate entry needed.
143+
- **Weekly, grouped minor+patch.** Reduces PR churn for a solo-maintainer repo. Major bumps stay ungrouped so breaking changes are reviewed one at a time.
144+
- **Commit prefixes match the repo's Conventional Commits style:** `chore(deps):` for Python, `ci(deps):` for Actions (`include: "scope"` appends the `deps` scope).
145+
- **Labels** `dependencies` + per-ecosystem. Dependabot auto-creates only the default `dependencies` label; custom labels (`python`, `github-actions`) that don't already exist in the repo are silently ignored (non-fatal). Create them with `gh label create python` / `gh label create github-actions` if you want them applied.
146+
- **No target-branch override** — defaults to the repo default branch (`main`).
147+
- **No tests added.** A static YAML config is verified by parse + structural assertion, not a unit test; GitHub validates the file server-side on push.

0 commit comments

Comments
 (0)