ci: stop Dependabot failing on the generated .dagger SDK path dependency

[hseshadr]

Claim touched: none user-facing. This keeps main's "Dependabot Updates" workflow green and closes a real advisory in the CI module's lockfile.

Root cause

Dependabot alert #4 (GHSA-54p9-h82j-f925, multidict >=6.7.0,<=6.9.0, patched in 6.9.1) is open on .dagger/uv.lock, which pinned multidict 6.7.1. With security updates enabled, Dependabot starts a uv security-update job in /.dagger for that alert. The job aborts with The following path based dependencies could not be retrieved: "dagger-io" at /.dagger/pyproject.toml because dagger-io is { path = "sdk", editable = true } and sdk/ is generated by dagger develop and gitignored. Failing run: https://github.com/gainratio/edge-proc/actions/runs/37713298087

Fix

uv lock --upgrade-package multidict in .dagger: multidict 6.7.1 -> 7.0.0. Only .dagger/uv.lock changes. No alert means no security-update job in /.dagger, so main stops going red. Coverage is unchanged: the / uv/npm and github-actions entries in dependabot.yml are untouched.

This matches the green repos: gainratio/ci has multidict 7.0.0 and gainratio/assay 6.9.1 in .dagger/uv.lock; neither has any .dagger special-casing in dependabot.yml.

Why not exclude-paths: the GitHub docs say it applies "during update scans for the given package-ecosystem entry" and patterns are "relative to the directory specified for the update configuration" (options reference). Security updates are driven by alerts, and the docs state "There is no interaction between the settings specified in the dependabot.yml file and Dependabot security alerts" (security updates); config only applies to security updates when "the directory must be the path to the manifest files" (configure security updates). So excluding .dagger from the / entry would not stop the alert-driven job, and silencing the alert would lose coverage.

Evidence

Check	Result
uv lock --check in .dagger	Resolved 56 packages, lock consistent
multidict in lock	7.0.0 (was 6.7.1)
.dagger module tests (pytest tests, real generated SDK)	52 passed
dagger functions (module loads in the engine with the new lock)	OK
check-jsonschema --builtin-schema vendor.dependabot .github/dependabot.yml	ok -- validation done

Not verified

• A Dependabot run can't be triggered from a PR branch. The alert should auto-close once this merges and the dependency graph re-scans main.
• Any future advisory in .dagger/uv.lock will hit the same path-dependency error, because Dependabot can never resolve the generated SDK. The durable answer is to keep that lock current (as here) when such an alert opens.

🤖 Generated with Claude Code

https://claude.ai/code/session_01QfxWgyzxj7Q4LtWoUmxvg7