Repository navigation
ci: keep Dependabot off the frozen Python interop pins and the codegen pin - #1650
Merged
Merged
Conversation
…n pin #1634 repeats the deferred #1538. It bumps the exact datamodel-code-generator pin (0.64 -> 0.81) without regenerating src/adcp/types/, and edits the frozen reporting interop requirement files under scripts/ci/reporting_interop/python/, which breaks those controls. Add a pip entry for the interop directory that ignores every dependency, matching the npm entry from #1590, and pip and uv entries for the root that ignore datamodel-code-generator. Version updates stay off (open-pull-requests-limit: 0); ignore rules also apply to security updates. Generator upgrades are an SDK 10 decision (docs/v10-codegen-plan.md, #1649). Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
![aao-secretariat[bot]](https://avatars.githubusercontent.com/u/221690821?s=60&v=4){kind=small}
There was a problem hiding this comment.
Ladon verdict: Approve
Approve — clean single-file CI change to .github/dependabot.yml (+33).
Checked:
- No findings at critical/high/medium severity.
- Not a gated path (
gated_paths: false), not high-risk, no author team gate. - Change adds a
pipentry ignoring deps in the frozen interop dir, pluspip/uvroot entries ignoringdatamodel-code-generator. YAML and ecosystem values are valid;open-pull-requests-limit: 0plus the ignore rules correctly suppress security updates for the codegen pin while leaving other root deps covered. - One non-blocking note: the
uventry's rationale citesuv.lock, which is gitignored and not committed, so that entry is harmless defensive config (no-op until a lockfile lands). Not blocking.
No decision-table trigger fired (rows 1–8 all false), so this falls through to row 9.
This was referenced Oct 27, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Dependabot security updates opened #1634, which repeats the deferred #1538. It does two things this repo doesn't want:
datamodel-code-generatorpin from 0.64.0 to 0.81.0 without regenerating anything. The pin is exact because the generator's class numbering shifts between releases. An upgrade has to regeneratesrc/adcp/types/in the same change, and that's a deliberate SDK 10 decision (docs/v10-codegen-plan.mdin docs(types): plan the SDK 10 codegen fidelity and wire round-trip work #1649, againstnext). The generator is a dev-only tool and isn't shipped in the wheel.scripts/ci/reporting_interop/python/requirements-*.txt. Each file pins the installed environment that one reporting interop control verifies, so changing it breaks the control (5 failing checks on chore(deps): bump the pip group across 2 directories with 4 updates #1634) and fixes nothing in a shipped artifact.This extends
.github/dependabot.yml(added in #1590 for the npm interop lockfiles):/scripts/ci/reporting_interop/python: ignores every dependency, like the npm entry./: ignoresdatamodel-code-generator. Dependabot filed the root manifest as pip;uv.lockmakes it a uv project too, so both ecosystems carry the rule.Every entry keeps
open-pull-requests-limit: 0, so no version-update PRs start. Ignore rules also apply to security updates. Every other root dependency still gets security updates as before.#1634 will be closed with a comment pointing here.
🤖 Generated with Claude Code