From 657ae2a8b28cd0df8d25b21090364be5529c326e Mon Sep 17 00:00:00 2001
From: Denis Drobyshev <drobishev.denis@icloud.com>
Date: Mon, 3 Aug 2026 17:21:45 +0300
Subject: [PATCH] Add Dependabot

decisionrl had no dependency automation: security alerts were off and nothing
watched the third-party actions in five workflows, which is the part of the
supply chain nobody notices going stale.

Weekly, grouped: one PR for the actions, one for the dev toolchain, and a
separate PR for anything an algorithm runs on. torch is ignored, and NumPy and
Gymnasium majors are ignored, because the published results are measured on
specific versions and re-verified by examples/verify_applied_claims.py -- those
move when someone re-runs that script, not because a scheduled PR was green.
---
 .github/dependabot.yml | 48 ++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 48 insertions(+)
 create mode 100644 .github/dependabot.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..4c4da8a
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,48 @@
+version: 2
+
+updates:
+  # Actions are the highest-value thing to keep current: a stale third-party
+  # action is a supply-chain risk in every workflow that uses it.
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: weekly
+      day: monday
+    commit-message:
+      prefix: "ci"
+    groups:
+      actions:
+        patterns: ["*"]
+
+  - package-ecosystem: pip
+    directory: "/"
+    schedule:
+      interval: weekly
+      day: monday
+    commit-message:
+      prefix: "deps"
+    # One PR for the dev toolchain, separate PRs for anything an algorithm runs
+    # on: a ruff bump needs a glance, a NumPy or PyTorch bump can move a
+    # learning curve.
+    groups:
+      dev-tooling:
+        patterns: ["ruff", "mypy", "pytest*", "pre-commit", "build", "twine", "mkdocs*"]
+        dependency-type: development
+    ignore:
+      # The published results are measured on specific versions and re-verified
+      # by examples/verify_applied_claims.py. These move when someone re-runs
+      # that script, not because a scheduled PR was green.
+      - dependency-name: torch
+      - dependency-name: numpy
+        update-types: ["version-update:semver-major"]
+      - dependency-name: gymnasium
+        update-types: ["version-update:semver-major"]
+    open-pull-requests-limit: 5
+
+  - package-ecosystem: docker
+    directory: "/deploy"
+    schedule:
+      interval: weekly
+      day: monday
+    commit-message:
+      prefix: "docker"