Dependabot covers pip and github-actions, weekly on Monday. There is no docker
ecosystem here because the Dockerfile builds `FROM ${BASE_IMAGE}`, a build arg
resolved by scripts/build/base.sh, so nothing in the file is a tag Dependabot
could pin; the base image is refreshed by the nightly rebuild in base-images
instead.
Dependabot has no Nix ecosystem either, and flake.lock pins the nixpkgs
revision that supplies the interpreter and the C headers every repository in
the catalogue is installed against. Left alone, that lock ages silently: the
shell keeps building, on packages nobody refreshed. update-flake-lock opens a
pull request for it on the same Monday schedule, and Dependabot's
github-actions axis keeps that workflow's own three action pins current.
Verified: both files parse, and the workflow resolves to one job whose steps
pin actions/checkout@v4, nix-installer-action@v16 and update-flake-lock@v24.
Neither runs before this lands on the default branch.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
787d58ce31