Skip to content

[Code scan] Extend Dependabot coverage beyond GitHub Actions #92

Description

@njzjz

This issue is a result of a Codex global code scan of deepmodeling/deepmodeling_sphinx at commit 156679f.

Problem

Dependabot currently updates only the github-actions ecosystem. Python package dependencies, documentation dependencies, and pre-commit hooks are declared elsewhere but do not receive automated update PRs.

Code references:

version: 2
updates:
- package-ecosystem: "github-actions"
directory: "/"
schedule:
interval: "weekly"

dependencies = [
'sphinx',
'minify-html!=0.16.*,!=0.17.0',
'jsmin',
'cssmin',
'jinja2',
]
requires-python = ">=3.7"

sphinx >=4.2
sphinx-book-theme
.
myst_parser
docutils >=0.17
numpydoc

repos:
- repo: https://github.com/pre-commit/pre-commit-hooks
rev: v6.0.0
hooks:
- id: trailing-whitespace
- id: end-of-file-fixer
- id: check-yaml
- id: check-json
- id: check-added-large-files
- id: check-merge-conflict
- id: check-symlinks
- id: check-toml
# Python
- repo: https://github.com/astral-sh/ruff-pre-commit
rev: v0.15.14
hooks:
- id: ruff
args: ["--fix"]
- id: ruff-format
# markdown, yaml
- repo: https://github.com/pre-commit/mirrors-prettier
rev: v4.0.0-alpha.8
hooks:
- id: prettier
types_or: [markdown, yaml, html, javascript, css]
# workflow files cannot be modified by pre-commit.ci
exclude: ^(\.github/workflows)

Impact

Runtime, docs, and linting dependencies can go stale without automated visibility, while workflow actions do get update coverage.

Suggested fix

Add Dependabot entries for pip dependency files and pre-commit, or document that these dependencies are intentionally maintained manually.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    Status
    Todo

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions