From be21e9c4f436bd1b065e9d495a4d8acde3b2d566 Mon Sep 17 00:00:00 2001 From: Brian O'Kelley Date: Mon, 26 Oct 2026 23:50:47 +0000 Subject: [PATCH] ci: keep Dependabot off the frozen Python interop pins and the codegen pin #1634 repeats the deferred #1538. It bumps the exact datamodel-code-generator pin (0.64 -> 0.81) without regenerating src/adcp/types/, and edits the frozen reporting interop requirement files under scripts/ci/reporting_interop/python/, which breaks those controls. Add a pip entry for the interop directory that ignores every dependency, matching the npm entry from #1590, and pip and uv entries for the root that ignore datamodel-code-generator. Version updates stay off (open-pull-requests-limit: 0); ignore rules also apply to security updates. Generator upgrades are an SDK 10 decision (docs/v10-codegen-plan.md, #1649). Co-Authored-By: Claude Opus 5.5 (1M context) --- .github/dependabot.yml | 33 +++++++++++++++++++++++++++++++++ 1 file changed, 33 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index bb0e69fa2c..832e68ee47 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -12,3 +12,36 @@ updates: open-pull-requests-limit: 0 ignore: - dependency-name: "*" + + # Frozen Python environments for the same interop replay. Each requirements + # file pins the installed set an interop control verifies, so it changes only + # with its control. + - package-ecosystem: pip + directory: "/scripts/ci/reporting_interop/python" + schedule: + interval: monthly + open-pull-requests-limit: 0 + ignore: + - dependency-name: "*" + + # The SDK's own Python dependencies. Version updates stay off, so these + # entries exist only for their ignore rules, which also apply to security + # updates. datamodel-code-generator is pinned exactly because its class + # numbering shifts between releases: an upgrade must regenerate + # src/adcp/types/ in the same change, which is an SDK 10 decision + # (docs/v10-codegen-plan.md, #1649). Dependabot has filed this manifest as + # pip, and uv.lock makes it a uv project too, so both carry the rule. + - package-ecosystem: pip + directory: "/" + schedule: + interval: monthly + open-pull-requests-limit: 0 + ignore: + - dependency-name: "datamodel-code-generator" + - package-ecosystem: uv + directory: "/" + schedule: + interval: monthly + open-pull-requests-limit: 0 + ignore: + - dependency-name: "datamodel-code-generator"