Downstream repos are moving from exact-pinned sibling dependencies to semver ranges (>=current,<next-major). A range in pyproject.toml only changes what's allowed. CI still runs against whatever's frozen in the committed uv.lock, so nothing actually verifies the range is safe until the lock is regenerated. Note this is a spot-check, not a formal guarantee that every version in the range works.
Add two things centrally so every repo can opt in without re-inventing them:
- A
resolution input on build-test.yml and build-test-postgres.yml (default highest) so consumers can add a second CI job running --resolution lowest-direct, proving the declared floor version is actually sufficient.
- A canonical
dependabot.yml in templates/, using package-ecosystem: "uv" scoped to the sibling packages, pre-labelled dependencies, so new upstream releases open a PR that regenerates the lock and runs full CI. Chose Dependabot over Renovate: it's a native GitHub feature enabled per-repo, with no org-admin GitHub App approval needed.
label-gate.yml and build-test.yml need neither secrets nor write access, so they run normally under Dependabot's restricted token. This was confirmed by piloting in cava-ci-test. release-drafter (via merge.yml) does need contents: write + secrets on merge; also confirmed working for a Dependabot-authored merge in that same pilot, no mitigation needed.
Downstream repos are moving from exact-pinned sibling dependencies to semver ranges (
>=current,<next-major). A range inpyproject.tomlonly changes what's allowed. CI still runs against whatever's frozen in the committeduv.lock, so nothing actually verifies the range is safe until the lock is regenerated. Note this is a spot-check, not a formal guarantee that every version in the range works.Add two things centrally so every repo can opt in without re-inventing them:
resolutioninput onbuild-test.ymlandbuild-test-postgres.yml(defaulthighest) so consumers can add a second CI job running--resolution lowest-direct, proving the declared floor version is actually sufficient.dependabot.ymlintemplates/, usingpackage-ecosystem: "uv"scoped to the sibling packages, pre-labelleddependencies, so new upstream releases open a PR that regenerates the lock and runs full CI. Chose Dependabot over Renovate: it's a native GitHub feature enabled per-repo, with no org-admin GitHub App approval needed.label-gate.ymlandbuild-test.ymlneed neither secrets nor write access, so they run normally under Dependabot's restricted token. This was confirmed by piloting incava-ci-test.release-drafter(viamerge.yml) does needcontents: write+ secrets on merge; also confirmed working for a Dependabot-authored merge in that same pilot, no mitigation needed.