Latest Results
chore(ci): group Dependabot updates for github-actions and docker
The github-actions entry had no groups block, so every action bumped in
its own PR: 18 of the 25 Dependabot PRs opened in the last 30 days were
single-action bumps, and the same actions recurred (taiki-e, CodSpeedHQ,
chainguard-dev and github each three times). The uv entry, which is
grouped, produced 3 PRs over the same period.
Group actions on minor and patch. Majors stay ungrouped so a breaking
action change is reviewed on its own rather than mixed into a batch.
Group both base images. Deliberately not filtered by update-type: the
images are pinned by digest, and a digest refresh — the base image
rebuilt under the same tag, which is what shipped the missing python
patches — is its own update type that an update-types filter would drop.
Verified groups.update-types against the SchemaStore schema, including a
negative test confirming the schema rejects invalid values rather than
passing everything. Note the vocabulary differs between blocks:
groups.update-types takes major/minor/patch, while ignore.update-types
takes version-update:semver-*.
Also drops comments that restated the field or group name beneath them. chore(deps): update pinned actions, base images and dependabot scope
Consolidates the open Dependabot PRs (#214, #215, #216, #217, #218) and
extends the sweep to dependencies Dependabot is not configured to see.
Pinned GitHub Actions, from the open PRs:
- CodSpeedHQ/action 4.18.4 -> 4.18.5
- docker/setup-buildx-action 4.1.0 -> 4.2.0
- astral-sh/setup-uv 8.2.0 -> 8.3.2
- github/codeql-action 4.36.2/4.36.3 -> 4.37.0
Dependabot split the codeql bump per sub-action, leaving init behind at
4.36.2; both init and analyze now sit on 4.37.0.
Eight further actions had no PR open and were behind:
- astral-sh/ruff-action 4.0.0 -> 4.1.0
- chainguard-dev/actions/setup-gitsign 1.6.26 -> 1.6.27
- docker/build-push-action 7.2.0 -> 7.3.0
- docker/login-action 4.2.0 -> 4.4.0
- docker/metadata-action 6.1.0 -> 6.2.0
- docker/setup-qemu-action 4.1.0 -> 4.2.0
- taiki-e/install-action 2.82.6 -> 2.83.4
- zizmorcore/zizmor-action 0.5.7 -> 0.6.0
zizmor-action 0.6.0 ships zizmor 1.27.0, which lints the workflows in CI.
Ran 1.27.0 locally with the pedantic persona used by the workflow: no
findings, so the bump does not fail the build.
Base images were pinned by digest but never updated, because
dependabot.yml declares only the github-actions and uv ecosystems. The uv
builder was 23 patch releases behind and the runtime digest predates a
rebuild of python:3.14-slim-trixie:
- ghcr.io/astral-sh/uv 0.11.6 -> 0.11.29 (python3.14-trixie-slim)
- python:3.14-slim-trixie digest refreshed
Added the docker ecosystem to dependabot.yml so this stops drifting, and
created the matching "docker" label the config references.
Python dependencies were already current; uv lock --upgrade found nothing.
Verified: ruff, mypy --strict, 603 tests, lock check, hadolint, all
pre-commit hooks, zizmor 1.27.0 pedantic, and a real docker build whose
image serves a live request against example.com. Latest Branches
0%
dependabot/github_actions/main/actions/setup-python-7.0.0 -10%
dependabot/github_actions/main/actions-2205f00104 0%
dependabot/uv/main/hypothesis-6.157.0 © 2026 CodSpeed Technology