Audit Cross-Checks No Python Dependabot Ecosystem, and KiCadLibrary's requirements-dev.txt Is Untracked #2286

Measured

A read-only sweep on 2026-10-02 covered all 22 active registry repositories. It read each repository's .github/dependabot.yml on main and develop, plus its full git tree, checking that no tree was truncated.

Python manifests that no pip or uv entry tracks:

Every other Python manifest is either tracked or has nothing to track:

• Tracked. aiopurpleair and Financial-Modeling use uv /, homeassistant-purpleair uses pip /, HomeAutomation-Config CloudInit uses uv, and Blog scripts uses pip. ESPHome-Config's easystart/python is a uv workspace member, so the root uv.lock and the uv / entry already cover it.
• Config-only, nothing to track. These are the Scripts profile, with no [project], no dependencies, and no lock: this hub's root pyproject.toml, PlexCleaner RegressionTests, HomeAutomation-Config's Cloudflare, MutationSweep, and Notify, and Blog checks.

Devcontainers no devcontainers entry tracks: only ESPHome-NonRoot, which #1609 already records. homeassistant-purpleair and ESPHome-Config declare devcontainers /. This hub's catalog/snippets/devcontainer/* files are templates, not a live devcontainer.

Also measured:

• Every declared ecosystem is dual-targeted at main and develop, and the file is byte-identical on both branches in all 18 repositories that have one.
• EspDinIoT, DevKitCIoT, AudioCleaner, and HolidayLights carry no .github/dependabot.yml at all, as Dependabot: Five Private Repositories Still Stalled, and ESPHome-NonRoot Misses the devcontainers Ecosystem #1609 records.
• PlexCleaner pins uvx ruff@0.15.22 and uvx mypy@2.3.0 in validate-task.yml, which no Dependabot ecosystem can update. The other uvx users run @latest.
• Not verified: whether devcontainers / in ESPHome-Config also scans .devcontainer/python/devcontainer.json.

The Gap Behind It

spec/audit.py asserts only the github-actions and devcontainers ecosystems a tree implies. Its own comment says that language ecosystems such as nuget, uv, and npm are directory-scoped and "not yet cross-checked". So setup.dependabot.ecosystems in spec/project-types.json is an intent the audit does not measure for Python, and a missing pip entry passes every audit.

Proposal

1. KiCadLibrary. Add pip for /, targeting both main and develop. KiCadLibrary is one of the seven repositories whose rulesets were deliberately left un-applied on 2026-10-02 pending a resync, so this can ride with that resync.

2. spec/audit.py. Cross-check Python directories against pip/uv entries, using the profile rule this sweep applied by hand:

   • a directory carrying uv.lock implies uv
   • requirements*.txt implies pip
   • a pyproject.toml with [project] dependencies and no lock implies pip or uv, unless it is a member of a uv workspace whose root lock is tracked
   • a config-only pyproject.toml implies nothing

   Report a missing entry the way the github-actions and devcontainers checks already do.

3. Record in AUDIT.md that a uvx tool@version pin in a workflow is invisible to Dependabot. Pin with @latest, or track the version through a manifest Dependabot reads.