From 2d2bb701fab562e10ee3410b3bedfcec8edb7505 Mon Sep 17 00:00:00 2001 From: Yuan Tang Date: Mon, 17 Mar 2025 23:20:31 -0400 Subject: [PATCH] ci: Add dependabot scans for Python deps (#1618) # What does this PR do? This PR adds dependabot updates for Python dependencies. In addition: * Consistent weekly schedule on a specific day * Specific commit messages * `open-pull-requests-limit` is intentional to avoid upgrading dependencies that will likely cause regressions. We want to keep the focus here on security updates only Signed-off-by: Yuan Tang --- .github/dependabot.yml | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 4aba604dd..d68af5615 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -5,4 +5,19 @@ updates: - package-ecosystem: "github-actions" directory: "/" # Will use the default workflow location of `.github/workflows` schedule: - interval: "daily" + interval: "weekly" + day: "saturday" + commit-message: + prefix: chore(github-deps) + - package-ecosystem: "uv" + directory: "/" + schedule: + interval: "weekly" + day: "saturday" + # ignore all non-security updates: https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#open-pull-requests-limit + open-pull-requests-limit: 0 + labels: + - type/dependencies + - python + commit-message: + prefix: chore(python-deps)