chore: add Dependabot + pre-commit configs - #143
Merged
Conversation
Dependabot: weekly 'pip' (PEP-621 project deps) + 'github-actions' (keeps actions/checkout + astral-sh/setup-uv current) ecosystems. Pre-commit: opt-in hygiene hooks (trailing-whitespace, end-of-file-fixer, check-yaml/toml, check-merge-conflict, check-added-large-files with uv.lock excluded). ruff/ruff-format deferred (codebase isn't ruff-clean; needs a line-length policy first); gitleaks tracked separately. Adds pre-commit to the dev group (already resolved transitively). No application code; hooks enforce on changed files going forward.
Dependabot has native uv support (GA 2025-03): package-ecosystem: uv reads pyproject + uv.lock directly and updates the lockfile, which the pip ecosystem would have left stale on our uv-managed project.
jramos
enabled auto-merge (squash)
June 28, 2026 19:29
jramos
added a commit
that referenced
this pull request
Jul 6, 2026
…ne new item (#150) Incremental upstream review. Backlog steady at 72 open; six new PRs #142-#147. Five already covered -> SKIP; one genuinely-new latent bug -> new action item. - NousResearch#142: 5 of 6 fixes are covered clusters (GEPA/DSPy-3.2 compat x3, validate-full). The 6th is real and new here: find_skill via Path.rglob('SKILL.md') skips symlinked skill dirs on Python <3.13 (skill_sources.py:63/67/80). Promoted to a CHERRY-PICK action item (recommended). - #143: our #102 — state.db read-only importer already shipped; only cross-platform discovery extras. SKIP. - #144/#145: Sunwo0u HSE sanitized evidence packets, report-only, no mechanism. SKIP. - #146: extraction cluster — our skill_text is a @Property over signature.instructions, so its 'dead input field' premise is upstream-only. SKIP. - #147: compat + material_diff reporting subsumed by our behavioral deploy gate. SKIP. Review-log entry + new action-item row + 2026-07-06 snapshot delta.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Triage #106 — adds the missing infra-hygiene configs, tailored to our stack (uv-managed, py3.10–3.13 matrix), not a copy of upstream's.
.github/dependabot.yml: weeklyuvecosystem (native — readspyproject+uv.lockand updates the lockfile; GA 2025-03) +github-actions(keepsactions/checkout+astral-sh/setup-uvcurrent)..pre-commit-config.yaml: opt-in hygiene hooks —trailing-whitespace,end-of-file-fixer,check-yaml/check-toml,check-merge-conflict,check-added-large-files(uv.lockexcluded as a legit large file).pre-commitadded to the dev group.ruff/ruff-format(the tree isn't ruff-clean — ~2080 files exceed the 88-char default; adopting linting needs a line-length policy or reformat first) and keptgitleaksseparate (triage docs(item 5): skill-delivery bug fixed; difficulty probe is a null #107). No application code touched.Hooks enforce on changed files going forward; a one-time
pre-commit run --all-filescleanup (~18 pre-existing EOF/whitespace nits, mostly committed report JSONs) is a deferred follow-up so this PR stays scoped to the tooling.Test Plan
uv syncinstallspre-commitinto the dev group (lock delta is just the dev-group promotion).uv run pre-commit run --files .github/dependabot.yml .pre-commit-config.yaml pyproject.toml— all hooks pass (verified locally).check-yamlself-validates both new YAML files.uvecosystem; uv.lock is committed).