ci(deps): automate dependency updates

.github/dependabot.yml

@@ -0,0 +1,42 @@
+version: 2
+
+updates:
+  - package-ecosystem: "uv"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "09:00"
+      timezone: "America/New_York"
+    versioning-strategy: "lockfile-only"
+    cooldown:
+      default-days: 7
+    groups:
+      python-minor-and-patch:
+        patterns:
+          - "*"
+        update-types:
+          - "minor"
+          - "patch"
+    commit-message:
+      prefix: "chore(deps)"
+      prefix-development: "chore(deps-dev)"
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "09:00"
+      timezone: "America/New_York"
+    cooldown:
+      default-days: 7
+    groups:
+      actions-minor-and-patch:
+        patterns:
+          - "*"
+        update-types:
+          - "minor"
+          - "patch"
+    commit-message:
+      prefix: "chore(ci)"

.github/workflows/pypi-publish.yml

@@ -11,18 +11,18 @@ jobs:
     outputs:
       new_release: ${{ steps.check_release.outputs.new_release }}
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0  # Shallow clones should be disabled for semantic-release to function correctly
 
       - name: Install UV
-        uses: astral-sh/setup-uv@v6
+        uses: astral-sh/setup-uv@v8.2.0
         with:
           enable-cache: true
           python-version: "3.13"
 
       - name: Install deps
-        run: uv sync --dev
+        run: uv sync --locked --all-groups
 
       - name: Check if a new release is needed
         id: check_release
@@ -47,18 +47,18 @@ jobs:
       pull-requests: write  # Required for semantic-release to comment on PRs in release
       id-token: write       # Required for trusted publishing
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0  # Shallow clones should be disabled for semantic-release to function correctly
 
       - name: Install UV
-        uses: astral-sh/setup-uv@v6
+        uses: astral-sh/setup-uv@v8.2.0
         with:
           enable-cache: true
           python-version: "3.13"
 
       - name: Install deps
-        run: uv sync --dev
+        run: uv sync --locked --all-groups
 
       - name: Build next version
         run: uv run semantic-release -v version --no-changelog --no-commit --no-tag
@@ -80,4 +80,4 @@ jobs:
         run: uv run semantic-release -v publish
 
       - name: Publish to PyPI
-        run: uv publish
+        run: uv publish

.github/workflows/test.yml

@@ -14,33 +14,38 @@ jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
 
       - name: Install UV
-        uses: astral-sh/setup-uv@v6
+        uses: astral-sh/setup-uv@v8.2.0
         with:
           enable-cache: true
           python-version: "3.13"
 
+      - name: Install dependencies
+        run: uv sync --locked --all-groups
+
       - name: Run Linters
-        run: uv tool run tox -e lint
+        run: uv run --locked tox -e lint
 
   test:
     runs-on: ubuntu-latest
     strategy:
       matrix:
         python-version:
           - "3.9"
-          - "3.13"
+          - "3.14"
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
 
       - name: Install UV
-        uses: astral-sh/setup-uv@v6
+        uses: astral-sh/setup-uv@v8.2.0
         with:
           enable-cache: true
           python-version: ${{ matrix.python-version }}
 
-      - name: Run Tests
-        run: uv tool run tox -e test
+      - name: Install dependencies
+        run: uv sync --locked --all-groups
 
+      - name: Run Tests
+        run: uv run --locked tox -e test