From 4fdd4a3c57a7f1be5105844c774dd2745f94c2da Mon Sep 17 00:00:00 2001 From: kkdev92 Date: Mon, 17 Aug 2026 23:30:46 +0900 Subject: [PATCH] Say why CI's Python tools are not in dependabot.yml The file already explains why firmware and managed-component versions are left to manual review. tools/requirements-ci.txt arrived after that note was written and is not covered by it, so the omission reads as an oversight rather than a decision. It is a decision. Dependabot would treat the .in and .txt as a pip-compile pair and regenerate the lock in its own environment, but this lock only installs if it is resolved for the runners specifically: resolved anywhere else it drops typing-extensions, and --require-hashes then refuses the entire install rather than fetching the missing package. Security alerts do not come from this file and continue to cover those packages, which is the part that matters for being told about a vulnerability. Co-Authored-By: Claude Opus 5 (1M context) --- .github/dependabot.yml | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 79d783d..0aac047 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -10,3 +10,14 @@ updates: # Firmware and managed-component versions are pinned in platformio.ini, # idf_component.yml, and dependencies.lock. Review those updates manually and # verify hardware-dependent behavior on a board. +# +# CI's Python tools are pinned in tools/requirements-ci.txt and are deliberately +# not listed above either. Dependabot would treat that file and its .in as a +# pip-compile pair and regenerate the lock in its own environment, but the lock +# only installs if it is resolved for the runners specifically +# (--python-version 3.12 --python-platform linux); resolved anywhere else it +# drops typing-extensions and --require-hashes then refuses the whole install. +# Bump the version in tools/requirements-ci.in and regenerate with the command +# in its header. +# +# Security alerts are unaffected by this file and still cover those packages.