[smorin]

Adds a Dependabot config using the native uv ecosystem (regenerates uv.lock with pyproject.toml) plus GitHub Actions updates. This repo had no Dependabot config; using uv from the start avoids the stale-lock failures the pip ecosystem causes on uv projects (see smorinlabs/template-press#32).

---

^{Need help on this PR? Tag /codesmith with what you need. Autofix is disabled.}

[coderabbitai]

Warning

Review limit reached

@smorin, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 42 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 91f61a52-cab0-42d7-862f-259f0d082285

📥 Commits

Reviewing files that changed from the base of the PR and between 85b72b7 and 5759b32.

📒 Files selected for processing (1)

• .github/dependabot.yml

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch ci/add-dependabot-uv

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

Pull request overview

Adds initial Dependabot configuration to keep this uv-managed Python project’s dependencies (and uv.lock) and GitHub Actions dependencies up to date automatically.

Changes:

• Introduces .github/dependabot.yml with weekly update checks for the uv ecosystem at repo root.
• Adds weekly update checks for github-actions, with grouping, labels, PR limits, and Conventional Commits-style commit message prefixes.
• Configures update grouping and cooldown to reduce PR noise.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[greptile-apps]

Greptile Summary

This PR adds Dependabot configuration for dependency updates. The main changes are:

• Weekly uv dependency updates from the repository root.
• Weekly GitHub Actions version updates.
• Grouped dependency PRs with dependencies labels and chore(scope) commit messages.
• A short cooldown and open PR limit for both update groups.

Confidence Score: 5/5

Safe to merge with minimal risk.

The change is limited to a new Dependabot configuration and matches the repository’s pyproject.toml and uv.lock setup.

No files require special attention.

T-Rex Logs

What T-Rex did

• Validated the Dependabot configuration and confirmed VALIDATION_PASSED with uv and GitHub Actions entries at the repository root.
• Verified the UV sync lock was applied and the locked environment was installed, with uv sync --locked exiting 0.
• Observed the CI pipeline finish with formatting, lint, type-check, and tests all exiting 0, and pytest reporting 27 passed in 0.29s.
• Collected and linked six log artifacts documenting the validation, locking, and CI results.

_{Ran code and verified through T-Rex}

Important Files Changed

Filename	Overview
.github/dependabot.yml	Adds Dependabot version-update configuration for uv and GitHub Actions; no issues found.

_{Reviews (1): Last reviewed commit: "ci: add dependabot config using uv ecosy..." | Re-trigger Greptile}