Add Dependabot - #7
Merged
Merged
Conversation
decisionrl had no dependency automation: security alerts were off and nothing watched the third-party actions in five workflows, which is the part of the supply chain nobody notices going stale. Weekly, grouped: one PR for the actions, one for the dev toolchain, and a separate PR for anything an algorithm runs on. torch is ignored, and NumPy and Gymnasium majors are ignored, because the published results are measured on specific versions and re-verified by examples/verify_applied_claims.py -- those move when someone re-runs that script, not because a scheduled PR was green.
DenisDrobyshev
force-pushed
the
chore/dependabot
branch
from
August 4, 2026 20:06
e684993 to
657ae2a
Compare
DenisDrobyshev
added a commit
that referenced
this pull request
Aug 5, 2026
PR #7 has been open for two days with the same file and a better ignore list: it cites examples/verify_applied_claims.py as the reason the pinned versions matter, and it distinguishes a NumPy major from a NumPy minor rather than ignoring the package outright. Duplicating it here would have made whichever merged second a conflict.
4 tasks
DenisDrobyshev
added a commit
that referenced
this pull request
Aug 6, 2026
* Add the automation that was missing around the widest pipeline here CodeQL, Dependabot, auto-merge and an aggregate CI check. The pipeline itself was in good shape; everything surrounding it was absent. pre-commit was eighteen ruff minor versions behind and had no ruff-format, no check-toml, no check-merge-conflict and no mixed-line-ending. torch, numpy and gymnasium are ignored by Dependabot. docs/benchmarks.md reproduces scores against specific versions of all three, so a bump is a claim that those numbers still hold - it gets read, not merged. gymnasium is ignored for minor and major only, because its environment semantics have moved across minor releases before. Dependabot also watches deploy/Dockerfile: the serving image is what a user runs in production, so its base image ages like any dependency. * Leave dependabot.yml to the pull request that already adds it PR #7 has been open for two days with the same file and a better ignore list: it cites examples/verify_applied_claims.py as the reason the pinned versions matter, and it distinguishes a NumPy major from a NumPy minor rather than ignoring the package outright. Duplicating it here would have made whichever merged second a conflict.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
decisionrl had no dependency automation. Nothing watched the third-party actions across five workflows, which is the part of the supply chain that goes stale unnoticed.
Weekly and grouped: one PR for actions, one for the dev toolchain, a separate PR for anything an algorithm runs on.
torchis ignored outright, and NumPy and Gymnasium majors are ignored, because the published results are measured on specific versions and re-verified byexamples/verify_applied_claims.py— those move when someone re-runs that script, not because a scheduled PR happened to be green.Docker updates are scoped to
deploy/, where the serving image lives.🤖 Generated with Claude Code