ci: adopt Charm Tech dependabot conventions - #98
Merged
tonyandrewmeyer merged 5 commits intoJul 8, 2026
Merged
Conversation
Aligns .github/dependabot.yaml with the OP0xx spec merged as canonical/charm-tech#17 (and the rollouts merged across the other Charm Tech Python repos): * Two lanes per ecosystem (monthly grouped routine + daily ungrouped security-only, open-pull-requests-limit: 0). * uv ecosystem (charm-ubuntu is on uv; the previous pip entry was stale). * Grouped along dev-tooling / test-deps / runtime seams. No docs group; no sphinx toolchain in this repo. * commit-message.prefix: "chore" on every entry. * Cooldown: 7d default, 14d for majors; security lane has no cooldown. Per-repo deltas: dev-tooling includes zizmor and pip-audit (both are dev/CI tools, not runtime deps). File renamed .yml -> .yaml so it matches the .github/workflows/*.yaml convention already in use. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Fixes to my initial rollout, matching pytest-jubilant / jubilant /
hyrum / charmhub-listing-review / operator after re-reading the
merged files:
* Drop the daily security-only lane — the merged pattern relies on
the repo-level Dependabot security-updates toggle (managed via
canonical-repo-automation) instead. Add the header comment that
every merged file carries.
* Add the charm-tech group (ops, ops-scenario, ops-tracing, jubilant,
pytest-jubilant) — standard across every rollout, not in the
original template file kept here.
* open-pull-requests-limit: 5 -> 100 (merged convention).
* Drop semver-major-days from the github-actions lane (merged pattern
only sets default-days: 7 for actions).
* Remove the docs / integration comments that don't apply and match
the three-seam wording used in the merged files.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
tonyandrewmeyer
marked this pull request as ready for review
July 7, 2026 09:05
james-garner-canonical
approved these changes
Jul 7, 2026
tonyandrewmeyer
commented
Jul 8, 2026
Co-authored-by: James Garner <james.garner@canonical.com> Co-authored-by: Tony Meyer <tony.meyer@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Aligns .github/dependabot.yaml with the spec:
File renamed .yml -> .yaml so it matches the .github/workflows/*.yaml convention already in use.