Enable Dependabot.

[hertschuh]

Also remove unneeded Python packages versions as much as possible.

[gemini-code-assist]

Summary of Changes

Hello @hertschuh, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request streamlines dependency management by integrating Dependabot for automated updates of GitHub Actions and Python packages. Concurrently, it refines the project's Python dependency specifications by removing strict version constraints from key libraries, promoting greater flexibility in package resolution while maintaining critical compatibility for specialized hardware like TPUs.

Highlights

• Dependabot Configuration: Introduced Dependabot to automate dependency updates for both GitHub Actions and Python (pip) packages, configured to run monthly.
• Dependency Version Management: Removed explicit version pins for several core Python packages (tensorflow-cpu, torch, jax[cpu]) across multiple requirements-*.txt files, allowing for more flexible dependency resolution.
• Specific Dependency Exclusion: Added an ignore rule for tensorflow-tpu in the Dependabot configuration to prevent updates beyond version 2.19.1, which is noted as the last version supporting TPUs.

🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[gemini-code-assist]

Code Review

This pull request enables Dependabot for github-actions and pip dependencies, which is a great step towards keeping the project's dependencies secure and up-to-date. The related changes to unpin package versions in the requirements files are appropriate and necessary for Dependabot to function correctly. My review includes one suggestion to refine the Dependabot configuration for Python dependencies by splitting them into logical groups. This will make the automated pull requests from Dependabot smaller and easier to review and test.

[gemini-code-assist]

While grouping all Python dependencies into a single python group is a good start, it can lead to very large and hard-to-review pull requests from Dependabot, especially as the number of dependencies grows. If one dependency update in the group causes a failure, the entire update is blocked.

Consider splitting dependencies into more granular, logical groups. For example, you could group core machine learning frameworks separately from development and testing tools. This will result in smaller, more manageable PRs.

Here is a suggested grouping:

      # Group core ML dependencies
      ml-core:
        patterns:
          - "tensorflow*"
          - "torch"
          - "jax*"
          - "keras"
          - "numpy"
          - "ml-dtypes"
          - "absl-py"
      # Group development and build tools
      dev-tools:
        patterns:
          - "mypy"
          - "ruff"
          - "pytest*"
          - "pre-commit"
          - "build"
          - "namex"

[abheesht17]

Thanks!