fix(deps): make dependency updates reach the image

.github/dependabot.yml

@@ -1,6 +1,16 @@
 version: 2
 updates:
-  - package-ecosystem: pip
+  # uv, NOT pip. The image builds with `uv sync --frozen` from uv.lock, CI syncs
+  # from the same lock, and release.yml treats uv.lock as a release trigger — so
+  # uv.lock is the only file whose contents decide what ships.
+  #
+  # On `pip` Dependabot edited requirements.txt instead, which was a generated
+  # export nothing installed from. #350 bumped six pins there, changed nothing
+  # that ships, left the lock behind, and put a version pair in the file that
+  # pip cannot even resolve (pydantic 2.13.4 requires pydantic-core==2.46.4;
+  # the PR asked for 2.48.0). The export is gone and the ecosystem now points at
+  # the lock, so a bump either reaches the image or is never proposed.
+  - package-ecosystem: uv
     directory: /
     schedule:
       interval: weekly
@@ -18,14 +28,40 @@ updates:
         update-types:
           - minor
           - patch
-      pip_security:
+      uv_security:
         applies-to: security-updates
         patterns:
           - '*'
     ignore:
       - dependency-name: '*'
         update-types:
           - version-update:semver-major
+  # The docs toolchain is a separate install and needs its own watcher: docs.yml
+  # pip-installs docs/requirements-docs.txt to run MkDocs, and `uv` does not see
+  # that file. Dependabot's pip ecosystem did (it opened #125 for
+  # mkdocs-material), so dropping pip entirely would have quietly frozen MkDocs.
+  #
+  # These deps stay OUT of uv.lock on purpose. release.yml treats uv.lock as a
+  # release trigger, so a mkdocs-material bump would otherwise cut an app
+  # release that changes nothing in the app.
+  - package-ecosystem: pip
+    directory: /docs
+    schedule:
+      interval: weekly
+      day: monday
+    commit-message:
+      prefix: docs
+    labels:
+      - documentation
+      - automated
+    groups:
+      docs_toolchain:
+        patterns:
+          - '*'
+      docs_security:
+        applies-to: security-updates
+        patterns:
+          - '*'
   - package-ecosystem: github-actions
     directory: /
     schedule:

.github/workflows/release.yml

@@ -320,11 +320,21 @@ jobs:
           git config user.name "github-actions[bot]"
           git config user.email "github-actions[bot]@users.noreply.github.com"
           git add docker-compose.yml docker-compose.fleet.yml
-          # [skip ci] because this must not start another release. The paths
-          # filter on this workflow does not list the compose files, so it would
-          # not fire anyway -- the marker is what keeps that true if the filter
-          # ever widens.
-          git commit -m "chore(compose): pin the examples to $SERIES [skip ci]"
+          # No skip-CI marker, deliberately. `test` is a required check on
+          # main now, and a skipped run never reports -- the check would sit
+          # "Expected" forever and this PR could never merge. What stops a
+          # second release is the paths filter at the top of this workflow,
+          # which does not list the compose files. Keep it that way: widening it
+          # to cover them would make every pin bump cut a release.
+          #
+          # And do not write the marker out in full anywhere it can reach a
+          # commit message, not even to explain it. GitHub reads the string
+          # ANYWHERE in a HEAD commit message, body included, and skips every
+          # workflow for that commit -- no runs, no annotation, nothing to
+          # notice. A commit explaining the removal of the marker skipped all
+          # three checks on this branch and left the PR permanently BLOCKED on a
+          # required check that could never report.
+          git commit -m "chore(compose): pin the examples to $SERIES"
 
           # THROUGH A PULL REQUEST, because main is protected.
           #
@@ -334,10 +344,11 @@ jobs:
           # failure warns instead of failing. Branch protection is not going
           # away, so the mechanism has to change rather than the retry count.
           #
-          # A PR can be merged immediately here: main requires a PR but demands
-          # no approvals and no status checks (verified against the protection
-          # API). If that ever tightens, the merge below fails, the warning
-          # fires, and the release still ships -- which is the behaviour to keep.
+          # Merged with --auto, not immediately: main requires `test` to pass,
+          # and an immediate merge would be rejected while it is still running.
+          # Auto-merge lands the PR the moment the check goes green. If merging
+          # fails for any other reason the warning fires and the release still
+          # ships -- which is the behaviour to keep.
           BRANCH="chore/compose-pins-$SERIES"
           git checkout -b "$BRANCH"
           # --force-with-lease so a re-run reuses the branch instead of dying on
@@ -354,11 +365,11 @@ jobs:
             exit 0
           fi
 
-          if ! gh pr merge "$BRANCH" --squash --delete-branch; then
+          if ! gh pr merge "$BRANCH" --squash --delete-branch --auto; then
             echo "::warning::opened the pin-bump PR for $SERIES but could not merge it; merge it by hand"
             exit 0
           fi
-          echo "Pins bumped to $SERIES via $BRANCH."
+          echo "Pins bumped to $SERIES via $BRANCH (auto-merges when tests pass)."
 
       - name: Create GitHub Release
         uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3

CLAUDE.md

@@ -23,14 +23,13 @@ Self-hosted passive income platform with a web UI that guides setup, deploys Doc
 ## Development
 
 ```bash
-# Local development
-python -m venv .venv
-source .venv/bin/activate
-pip install -r requirements.txt
-uvicorn app.main:app --reload --host 0.0.0.0 --port 8080
+# Local development. uv.lock is the only source of truth: it is what the image
+# builds from and what CI syncs, so this gets you exactly what ships.
+uv sync --frozen --extra dev
+uv run uvicorn app.main:app --reload --host 0.0.0.0 --port 8080
 
 # Run tests
-pytest tests/
+uv run pytest tests/
 
 # Run dev environment
 docker compose up -d

pyproject.toml

@@ -45,7 +45,7 @@ dev = [
     # meant the test environment was assembled by hand rather than resolved from
     # the lockfile that ships.
     "docker>=7.1.0",
-    "tzdata>=2025.1",
+    "tzdata>=2026.3",
 ]
 
 [project.urls]