ci: drop the uv ecosystem from dependabot.yml, it can't work here - #197
Conversation
pyproject.toml declares cuga as an editable path dependency at
../cuga-agent, deliberately outside this repo, so cuga-eval always
integration-tests against cuga-agent's live main rather than a pinned
version. Dependabot requires path-based dependencies to resolve inside
the scanned repo's own source tree, so every uv ecosystem run fails
outright ("Dependabot couldn't fetch all your path-based dependencies")
before it can look at any of the other, normal PyPI packages in the same
lockfile. Confirmed via dependabot-core#8428, #12945, #13872: this is a
known, unresolved upstream limitation for path/workspace sources outside
the repo, not a config gap - no ignore: rule or similar works around it.
Nesting cuga-agent inside this repo (e.g. a git submodule) would satisfy
Dependabot but pins to one commit instead of tracking main, defeating
the point of this repo, so not worth it just for Dependabot's sake.
pip-audit (CI's security job + the weekly dependency-audit.yml, both
already live) remains the vulnerability-detection backstop for Python
deps; version bumps for them stay manual, same as before this effort.
The github-actions ecosystem is unaffected and already proven working
(#194-#196).
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Team Run ID: 📒 Files selected for processing (1)
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review. 📝 WalkthroughWalkthroughThe Dependabot configuration removes the failing ChangesDependabot maintenance
Estimated code review effort: 2 (Simple) | ~10 minutes Merge Risk: ⚪ Minimal · up to The change disables unusable Python Dependabot updates and prevents obsolete Python update groups from auto-merging, while retaining GitHub Actions dependency automation. Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
ReviewVerified independently of the description: the post-change The premise holds and is unusually well-evidenced — the failure was confirmed live via the Dependabot tab rather than inferred from the upstream issues, and the submodule alternative is considered and correctly rejected on the grounds that pinning a commit defeats the point of the repo. Flagging the security-updates question as untested rather than settled is also the right call, since it can't be confirmed without a live alert firing. No correctness problems in the diff itself. Finding: the auto-merge allowlist still names the deleted group —
|
Sergey-Zeltyn
left a comment
Sergey-Zeltyn
left a comment
There was a problem hiding this comment.
See comments above. Both are non-blocking, decide what you want to do and then I"ll approve unless new issues arise
That group no longer exists in dependabot.yml since the uv ecosystem entry was removed, so the clause could never match.
Folded in — 8e86781 drops the
Agreed this is out of scope for this PR — leaving it as a follow-up rather than scope-creeping the fix in here. |
2 participants
Problem
Follow-up to #192. `pyproject.toml` declares `cuga` as an editable path dependency at `../cuga-agent` — deliberately outside this repo, since cuga-eval is designed to always integration-test against cuga-agent's live `main` rather than a pinned version (the same reason CI checks it out as a sibling before every `uv sync`).
Dependabot requires path-based dependencies to resolve inside the scanned repo's own source tree. Verified live in this repo (via "Check for updates" in the Dependabot tab): every `uv` ecosystem run fails immediately with "Dependabot couldn't fetch all your path-based dependencies. The affected dependencies were `cuga` at /pyproject.toml." — before it can even look at the other, normal PyPI packages in the same `uv.lock`. This is a known, unresolved upstream limitation (dependabot-core#8428, #12945, #13872 are the same failure class for path/workspace sources outside the repo), not something an `ignore:` rule or similar config can route around.
We never actually wanted Dependabot to version-bump `cuga` itself — it has no pinned version to bump, it always tracks `main`. The real cost is collateral: because `uv.lock` is one unified resolution graph, the unreachable `cuga` source blocks Dependabot from producing updates for any of the other Python packages too.
Nesting `cuga-agent` inside this repo (e.g. a git submodule) would satisfy Dependabot, but pins to one commit instead of tracking `main`, defeating the actual point of this repo — not worth trading away.
Change
Drop the `uv` `package-ecosystem` entry from `.github/dependabot.yml`, with an inline comment explaining why. The `github-actions` entry is unaffected and already proven working — 3 real PRs landed from it (#194, #195, #196), correctly left for manual review since they're major bumps.
`pip-audit` (CI's `security` job + the weekly `dependency-audit.yml`, both already live on `main`) remains the vulnerability-detection backstop for Python deps. Version bumps for them stay manual, same as before this whole effort — just with working CVE detection now instead of a check that blocked unrelated PRs.
What Dependabot still checks after this change
Verification
Summary by CodeRabbit