[crowecawcaw]

What was the problem/requirement? (What/Why)

This repository had no .github/dependabot.yml, so nothing was watching its dependencies. Every other active repository in the org has one.

The SHA-pinned actions in .github/workflows had drifted as a result: actions/checkout v4.2.2 (in 9 workflows), actions/setup-python v5.3.0, actions/setup-node v4.1.0, and actions/upload-artifact v4.6.2.

This came up while fixing a stale anthropics/claude-code-action pin in aws-deadline/.github (#100) that Dependabot should have caught there too.

What was the solution? (How)

Add a config covering the three places where a bump is wanted:

Ecosystem	Directory	What
github-actions	/	The SHA-pinned actions in .github/workflows
npm	/cdk/farm_templates/starter_farm	The CDK starter farm app
pip	/tests	The static-check suite's requirements.txt

Each ecosystem uses one patterns: ["*"] group, so it opens a single PR per week with all of that ecosystem's bumps in it — majors included — instead of one PR per dependency. A second group per ecosystem with applies-to: security-updates batches security updates the same way; without it, those still arrive one PR at a time.

Three sets of manifests are deliberately left out, documented in the config:

• Dockerfiles (containers/, job_bundles/*/docker/): base images are pinned to the DCC/ASWF versions each sample targets, so bumping them changes what the sample demonstrates.
• conda_recipes/: recipe pins track the packaged application. cinema4d-2026 pins pywin32==308 with hashes.
• Sample Python packages under job_bundles/ (progression_4_lib, studio_pipe): dependencies are unpinned or floor-only (deadline>=0.52.1), so there is nothing for Dependabot to bump.

What is the impact of this change?

Up to three grouped PRs a week, and the action pins get current. No workflow or sample behavior changes.

How was this change tested?

• Validated against the Dependabot 2.0 JSON schema (json.schemastore.org/dependabot-2.0.json) with jsonschema: passes.
• The directory in each entry was checked against the manifest it names, from the file list on mainline.
• Not verified: that Dependabot accepts the config at runtime and opens the grouped PRs. The config only takes effect once this merges, and GitHub validates it then. Worth watching the first run on the Dependabot tab.

Was this change documented?

Yes, in comments in the config: what each entry covers and why the Dockerfiles, conda recipes, and sample packages are excluded.

---

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

[github-actions]

Claude review · advisory

Review of 0f576d5 did not finish (run). The next push retries it.

Open: 0 blocking · 0 should-fix · 0 nit.

_{Fix or reply to each thread; the next revision's review re-checks open threads and resolves those it agrees are handled. Resolving a thread yourself also closes it. Later revisions review only what changed.}