Dependabot & Automated Lockfile Maintenance¶

Automated dependency maintenance ensures all reusable actions and Python environments remain secure, up to date, and free of known vulnerabilities.

⚙️ Dependabot Configuration (.github/dependabot.yaml)¶

Dependabot automatically monitors dependency updates across two primary ecosystems:

1. github-actions: Scans all composite actions in .github/actions/, python/, infra/, odbc/, sqlmesh/, and reusable workflows in .github/workflows/.
2. uv: Monitors Python dependencies defined in pyproject.toml.

version: 2
updates:
  - package-ecosystem: "github-actions"
    directory: "/"
    schedule:
      interval: "weekly"
    labels:
      - "dependencies"
      - "github-actions"

  - package-ecosystem: "uv"
    directory: "/"
    schedule:
      interval: "weekly"
    labels:
      - "dependencies"
      - "python"

🔄 Lockfile Bumps & Commit SHA Pinned Updates¶

• GitHub Actions Pinning: When Dependabot proposes a version bump for an action reference, it retains full 40-character commit SHA pinning with version comments (e.g. uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1).
• Manual Bumps via mise: Maintainers can trigger an immediate automated audit of all action dependencies across the repository by executing:

  mise run bump