From 0914f6705294eda29cb68ac2b3558515a5af578e Mon Sep 17 00:00:00 2001 From: devdudeio Date: Fri, 18 Sep 2026 04:01:46 +0200 Subject: [PATCH 1/2] Add a Dependabot config for cargo and the workflows Detected ecosystems: cargo at "/" (single Cargo.toml with a committed Cargo.lock) and github-actions at "/" (ci.yml, pages.yml and the claude-* workflows). web/ is a static site built by a Python script with no requirements.txt or pyproject.toml, so there is no pip manifest to watch. Groups encode coupling Cargo cannot express. The reason to bother: in peculium-wallet Dependabot bumped vitest and left @vitest/coverage-v8 behind, and the peer mismatch broke CI; Rust has no peer dependencies at all, so a split bump of a family simply does not compile. - clap: clap, clap_*, anstream, anstyle - clap_complete is generated from clap's derive types and anstream/anstyle are the colour stack clap renders through - rustcrypto: argon2, chacha20poly1305, zeroize, getrandom - shared trait crates, so the KDF and the AEAD have to agree on the same trait major verus-sdk is ignored: it is a git dependency pinned by revision on purpose, and chainvue-web-wallet pins the same commit so the CLI and the wallet cannot build different transactions from the same inputs. Moving it is a coordinated change, not a weekly bump. Claude-Session: https://claude.ai/code/session_01AxFbkWrzkhDieg5RGm8YdK --- .github/dependabot.yml | 51 ++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 51 insertions(+) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..4fe7d0b --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,51 @@ +# Dependabot for pecu, the CLI wallet. +# +# Ecosystems found in the repo: cargo (a single-package Cargo.toml with a +# committed Cargo.lock) and github-actions (ci.yml, pages.yml and the +# claude-* workflows). web/ is a static site built by a Python script with no +# requirements.txt or pyproject.toml, so there is no pip manifest to watch. +version: 2 +updates: + - package-ecosystem: github-actions + directory: "/" + schedule: + interval: weekly + + - package-ecosystem: cargo + directory: "/" + schedule: + interval: weekly + open-pull-requests-limit: 5 + groups: + # Crate families that only work in lockstep, grouped so a bump cannot + # land half-applied. The reason this repo bothers: in peculium-wallet + # Dependabot bumped `vitest` and left `@vitest/coverage-v8` behind, and + # the resulting peer mismatch broke CI. Cargo has no peer dependencies to + # catch that for us, so the coupling is spelled out here. + # + # clap_complete is generated from clap's derive types and anstream/anstyle + # are the colour stack clap renders through: a major on one without the + # others does not compile. + clap: + patterns: + - clap + - "clap_*" + - anstream + - anstyle + # RustCrypto: shared trait crates, so the KDF, the AEAD and zeroize have + # to agree on the same trait major. + rustcrypto: + patterns: + - argon2 + - chacha20poly1305 + - zeroize + - getrandom + dev-dependencies: + dependency-type: development + update-types: ["minor", "patch"] + ignore: + # verus-sdk is a git dependency pinned by revision on purpose: the CLI and + # chainvue-web-wallet pin the same commit so the two cannot build + # different transactions from the same inputs. Moving it is a deliberate, + # coordinated change, not a weekly bump. + - dependency-name: verus-sdk From 976648e04f6419e0c477a76536848c364e97092d Mon Sep 17 00:00:00 2001 From: devdudeio Date: Tue, 29 Sep 2026 03:25:36 +0200 Subject: [PATCH 2/2] Skip the Claude PR review on Dependabot PRs, group image with rqrr Dependabot runs get no Actions secrets and claude-code-action rejects bot actors, so the required "Find reasons not to merge" check would fail on every Dependabot PR. Skipped, it reports success. rqrr takes an image::GrayImage from this crate, so the two must move together. --- .github/dependabot.yml | 6 ++++++ .github/workflows/claude-pr-review.yml | 6 +++++- 2 files changed, 11 insertions(+), 1 deletion(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 4fe7d0b..d0c5a5f 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -40,6 +40,12 @@ updates: - chacha20poly1305 - zeroize - getrandom + # rqrr decodes an image::GrayImage built by this crate, so an image + # major without the matching rqrr does not compile. + image: + patterns: + - image + - rqrr dev-dependencies: dependency-type: development update-types: ["minor", "patch"] diff --git a/.github/workflows/claude-pr-review.yml b/.github/workflows/claude-pr-review.yml index 29d86db..2e35f52 100644 --- a/.github/workflows/claude-pr-review.yml +++ b/.github/workflows/claude-pr-review.yml @@ -60,7 +60,11 @@ jobs: # run on them -- and making it run, via pull_request_target, would hand an # outside contributor a workflow with write permissions on a wallet. A # maintainer reviews fork pull requests by hand. See docs/claude-automation.md. - if: github.event.pull_request.head.repo.full_name == github.repository + # Dependabot runs get no Actions secrets either, and the action rejects bot + # actors; skipped here, the required check still reports success. + if: >- + github.event.pull_request.head.repo.full_name == github.repository && + github.event.pull_request.user.login != 'dependabot[bot]' runs-on: ubuntu-latest timeout-minutes: 25 steps: