Repository navigation
Add a Pip Ecosystem to the Carried Dependabot Snippet - #3103
Merged
Merged
Conversation
Add a dual-targeted pip pair to catalog/snippets/configs/dependabot.yml, kept only by a repo with a pip-form Python directory, carrying the same toolchain exclude-patterns as the uv pair. Widen the python.scripts.uvx assert in spec/project-types.json to name the pip form's pins as well as the uv form's lockfile. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The pip form runs a tool at its requirements version only from the venv of a directory declared in python-directories, so the assert says that and keeps uvx at @latest for every other pip-form directory. Rename the pip placeholder directory away from the lint-only Scripts vocabulary. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Drop the uvx fallback sentence, which stated a build-profile rule in an assert scoped to the lint-only profile, and keep the pip form's clause to the declared-directory case it actually describes. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
ptr727
added
the
comments
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 21 minutes. View limit details
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Owner
Author
|
A recorded local strict-review pass covers head |
The hub's own dependabot.yml pointer and the setup.dependabot.ecosystems assert each listed the snippet's language ecosystems, and both now name pip beside nuget and uv. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Owner
Author
|
A recorded local strict-review pass covers head |
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
Two unresolved documentation consistency comments remain.
2 open findings
What changed in this PR
Adds pip Dependabot coverage for Python projects using requirements*.txt and documents pip-managed tool versions.
Changes:
- Adds
pipentries formainanddevelopwith tool exclusions. - Updates the Python project specification for pip-managed tools.
| File | Summary |
|---|---|
spec/project-types.json |
Documents pip build-profile tool version management. |
catalog/snippets/configs/dependabot.yml |
Adds pip Dependabot entries for main and develop. |
🧠 Review effort: Lite
💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## develop #3103 +/- ##
==========================================
Coverage ? 61.21%
==========================================
Files ? 17
Lines ? 9062
Branches ? 0
==========================================
Hits ? 5547
Misses ? 3515
Partials ? 0
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
Owner
Author
|
@coderabbitai review |
|
This was referenced Oct 16, 2026
Closed
ptr727
added a commit
that referenced
this pull request
Oct 16, 2026
… Fixes to Main (#3146) - #3135 makes `gh-write-guard` read a gh write's subcommand and target the way gh parses them: the subcommand is found past flags before the command and before the subcommand, an `R` inside a short-option cluster is read as a target, `GH_REPO` is read as a target, a run-time repository owner on a write fails closed, and a run-time word where `pr` or `merge` goes fails closed beside `--admin` or where word splitting may split it - #3139 releases the bootstrap lock when a `bootstrap.ps1` run ends rather than when its process does, so a second run typed at the same pwsh prompt is no longer refused the lock - #3130 matches tool names and the `all` keyword by case in the Windows agents loaders, as the Linux loaders already do - #3128 reads CodeRabbit's rate limit on a reply to an explicit review command in `pr_review.py` - #3126 reconciles VSCode-Server-DotNetCore in the hub after its resync - #3124 logs the Docker task's build-base leg in to Docker Hub - #3122 names the carried skill and the skipped review correctly - #3120 states the subprocess encoding rule in `CODESTYLE.md`, where carriers read Python style - #3118 and #3111 move the release-guard tests' workflow-command checks onto `runner_commands`, and test the alternatives wiring at the `audit_repo` and `fidelity_pass` call sites - #3116 stops the doc gates' printed names forging workflow commands - #3113 adds a catalog snippet for the release-with-smoke caller - #3109 moves the `workflow_reuse` fetch onto `audit.contents_text` - #3105 accepts `.codecov.yml` as an alternative to `codecov.yml` - #3103 adds a pip ecosystem to the carried Dependabot snippet - #3100 prefers the venv's ruff and pyright for a declared pip directory - #3098 tracks composite action pins in Dependabot - #3096 reads an uppercase Markdown suffix as Markdown at every prose gate branch After this merges, the host-safety installer payload changes, so the maintainer runs the installer after promotion. Closes #1416 Closes #1425 Closes #1578 Closes #1874 Closes #1892 Closes #1899 Closes #2804 Closes #2850 Closes #2852 Closes #2854 Closes #2996 Closes #3065 Closes #3067 Closes #3069 Closes #3079 Closes #3080 Closes #3089 Closes #3093 Closes #3101 Closes #3106 Closes #3107 Closes #3137 🤖 Generated with [Claude Code](https://claude.com/claude-code) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added a pull-request smoke build that runs when relevant release files change and reports the combined validation and build status. * Repository audits now recognize `.codecov.yml` as an alternative to `codecov.yml`. * **Improvements** * Python linting and type checks use tools from declared project environments when available, with fallbacks for missing tools. * Workflow and lint reports safely display unusual filenames and command-like text. * GitHub write-target checks now account for additional command forms and fail closed when targets cannot be verified. * Rate-limit detection now recognizes another CodeRabbit response format. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
catalog/snippets/configs/dependabot.yml: add a dual-targetedpippair, one entry formainand one fordevelop, in the same shape as theuvpair. It is commented as kept only by a repo with a pip-form Python directory, arequirements*.txtwith nouv.lock, and carries the sameruff/pyright/mypyexclude-patterns as theuventries. Its placeholder directory is/PythonProject, kept apart from the lint-only Scripts profile's vocabulary.spec/project-types.json: widen thepython.scripts.uvxassert's build-profile clause so it names the pip form beside the uv form. The pip form takes a tool's version from therequirements*.txtthat Dependabot's pip ecosystem bumps, where a directory declared inpython-directoriesinstalls that tool into its.venv.The audit side,
spec/audit.pycross-checking apipecosystem, stays with #2286.This change adds comment lines to a config snippet, which the issue asks for, so it carries the
commentslabel.Local review findings
introduced:.github/dependabot.yml:6describes the snippet as "covering nuget and uv", which no longer lists everything it covers. The sibling list atspec/project-types.jsonsetup.dependabot.ecosystems("nuget/uv/npm") has the same gap. The edit budget for the opening push was spent. Fixed in 59f8b99, which names pip in both lists.Closes on promotion: #3101
🤖 Generated with Claude Code