787d58ce31
Dependabot covers pip and github-actions, weekly on Monday. There is no docker
ecosystem here because the Dockerfile builds `FROM ${BASE_IMAGE}`, a build arg
resolved by scripts/build/base.sh, so nothing in the file is a tag Dependabot
could pin; the base image is refreshed by the nightly rebuild in base-images
instead.
Dependabot has no Nix ecosystem either, and flake.lock pins the nixpkgs
revision that supplies the interpreter and the C headers every repository in
the catalogue is installed against. Left alone, that lock ages silently: the
shell keeps building, on packages nobody refreshed. update-flake-lock opens a
pull request for it on the same Monday schedule, and Dependabot's
github-actions axis keeps that workflow's own three action pins current.
Verified: both files parse, and the workflow resolves to one job whose steps
pin actions/checkout@v4, nix-installer-action@v16 and update-flake-lock@v24.
Neither runs before this lands on the default branch.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
24 lines
415 B
YAML
24 lines
415 B
YAML
version: 2
|
|
|
|
updates:
|
|
- package-ecosystem: "pip"
|
|
directory: "/"
|
|
schedule:
|
|
interval: "weekly"
|
|
day: "monday"
|
|
time: "00:00"
|
|
rebase-strategy: "auto"
|
|
labels:
|
|
- "dependencies"
|
|
- "python"
|
|
|
|
- package-ecosystem: "github-actions"
|
|
directory: "/"
|
|
schedule:
|
|
interval: "weekly"
|
|
day: "monday"
|
|
time: "00:00"
|
|
labels:
|
|
- "dependencies"
|
|
- "ci"
|