From fe5c0f8f52abd72e652f52fca17f5d0da06639a7 Mon Sep 17 00:00:00 2001 From: Steven Kearnes Date: Tue, 28 Jul 2026 19:24:52 -0400 Subject: [PATCH] Add Dependabot for GitHub Actions The workflows here are pinned to commit SHAs, which is the right call, but nothing keeps the pins current: setup-uv sits at v5.4.2 while ord-data and ord-schema run v7, and actions/checkout is behind even within its own v4 major. Dependabot understands SHA-pinned actions and rewrites the SHA together with its trailing version comment, so the pins keep their security property without freezing. Grouped monthly to keep it to one pull request. Expect a first round of catch-up pull requests once this lands. Co-Authored-By: Claude Opus 5 (1M context) --- .github/dependabot.yml | 28 ++++++++++++++++++++++++++++ 1 file changed, 28 insertions(+) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 00000000..894f7caa --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,28 @@ +# Copyright 2026 Open Reaction Database Project Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +# Actions in .github/workflows are pinned to commit SHAs. Dependabot rewrites +# both the SHA and its trailing version comment, which is what keeps a pinned +# workflow from freezing on whatever was current the day it was written. +version: 2 +updates: + - package-ecosystem: github-actions + directory: / + schedule: + interval: monthly + groups: + # One pull request per month for all actions rather than one per action. + actions: + patterns: + - "*"