ci: add Dependabot configuration for pip and GitHub Actions#14
Conversation
Automated dependency update PRs for two ecosystems: - pip: daily checks against requirements.txt (max 10 open PRs) - github-actions: weekly checks for workflow action versions (max 5 open PRs) Audit notes: - Zero risk — Dependabot is a native GitHub feature, no third-party actions - Labels added for easy PR triage (dependencies + ecosystem-specific) - Open-PR limits prevent Dependabot from flooding the PR queue - Daily pip schedule is appropriate given the security focus of REDACTS - Weekly github-actions schedule sufficient since actions update less often
There was a problem hiding this comment.
Pull request overview
Adds a Dependabot configuration to automatically open dependency update PRs for the repository’s Python (pip) dependencies and GitHub Actions, aligning with the repo’s security/CI posture.
Changes:
- Introduces
.github/dependabot.ymlwith daily pip checks in repo root - Adds weekly GitHub Actions update checks
- Applies consistent labeling and caps the number of concurrent Dependabot PRs per ecosystem
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| # Python dependencies (requirements.txt) | ||
| - package-ecosystem: pip | ||
| directory: "/" |
There was a problem hiding this comment.
The comment/PR description indicates this entry only targets requirements.txt, but Dependabot's pip ecosystem for directory: "/" will also pick up other pip manifests in the repo root (e.g., requirements-dev.txt). If the intent is truly to only update runtime deps, the config/comment/PR description should be adjusted to match the actual scope (or the dev requirements moved outside the monitored directory).
Dependabot Configuration
Automated dependency update PRs for two ecosystems.
Ecosystems Monitored
Audit Summary
Interaction with Existing Workflows
Dependabot PRs will automatically trigger the full CI/CD suite (CodeQL, Semgrep, Bandit, Pip-Audit) on each dependency update PR, providing defense-in-depth validation before merge.