Add dependabot #8

Activity

1. tdstein

   self-assigned this

   on Oct 26, 2026
2. tdstein

   added

   ready-for-agentFully specified, ready for an autonomous coding agentFully specified, ready for an autonomous coding agent

   on Oct 26, 2026
3. tdstein commented on Oct 26, 2026

   

   tdstein

   on Oct 26, 2026

   Last edited by tdstein

   Contributor

   More actions

   Codex Workpad

   Karazhan:/Users/taylor/github.com/posit-dev/symphony/workspaces/posit-dev_posit-cli_8-136ab54519f8c95c@6b83b20
   

   Plan

   • 1. Inspect repository guidance and dependency management.
   • 2. Add weekly Dependabot updates for uv and GitHub Actions.
   • 3. Validate configuration and lockfile; review diff and publish PR.

   Acceptance Criteria

   • Dependabot updates root Python dependencies and uv.lock using the uv ecosystem.
   • Dependabot updates GitHub Actions dependencies weekly.
   • Configuration passes schema validation and the existing lockfile remains consistent.

   Validation

   • Command:
     • UV_CACHE_DIR=/tmp/posit-cli-uv-cache uv run --no-project --with pyyaml --with jsonschema python /tmp/posit-cli-check-dependabot.py
   • Observed: Passed the public Dependabot v2 JSON schema from SchemaStore.
   • Run: Post-publication exec 678c23, 2026-10-26.
   • Commit: 6b83b20
   • Command:
     • UV_CACHE_DIR=/tmp/posit-cli-uv-cache uv lock --locked
   • Observed: Resolved 58 packages successfully without changing uv.lock.
   • Run: Post-publication exec 678c23, 2026-10-26.
   • Commit: 6b83b20
   • Command:
     • git diff --check
   • Observed: Passed; working tree clean.
   • Run: Post-publication exec 678c23, 2026-10-26.
   • Commit: 6b83b20

   Evidence

   Reproduction

   • N/A: Dependency automation is a new configuration, with no runtime bug to reproduce.

   Notes

   • 2026-10-26: No repository AGENTS.md exists; read CLAUDE.md and CONTRIBUTING.md. The current pyproject.toml and uv.lock use released rsconnect-python (>=1.30,<2), rather than the Git main dependency described in the issue. Preserve the current dependency source and enable native uv updates.
   • 2026-10-26: No issue comments or linked PR feedback.
   • 2026-10-26: Added weekly uv and GitHub Actions entries with Conventional Commit prefixes. Reviewed the complete new-file diff; only .github/dependabot.yml changed.
   • 2026-10-26 handoff: PR chore(deps): add Dependabot updates for uv and GitHub Actions #22, commit 6b83b20. Schema validation, locked dependency resolution, and diff checks passed again against the published commit. PR is mergeable with no review threads; no new issue steering. Ready for review; not merged.
4. tdstein

   closed this as completedin #22on Oct 26, 2026