chore(dependabot): track pre-commit hook versions - #55
Conversation
Dependabot bumps requirements-dev.txt but has never touched .pre-commit-config.yaml, so the hook revs drift from the pins and pre-commit runs a different ruff/mypy than CI. Both #53 and #49 were blocked on exactly that. Adding the pre-commit ecosystem makes Dependabot maintain the hook revs too, so the two stay in step without anyone remembering to do it by hand. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
|
Caution Review failedThe pull request is closed. ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
Disabled knowledge base sources:
📝 WalkthroughSummary by CodeRabbit
WalkthroughAdds a root-level Dependabot configuration for weekly updates in the ChangesDependabot configuration
Estimated code review effort: 1 (Trivial) | ~2 minutes Possibly related PRs
Suggested labels: Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
There was a problem hiding this comment.
Pull request overview
This PR updates Dependabot configuration so it also tracks and updates pre-commit hook revisions, preventing drift between .pre-commit-config.yaml hook versions and the Python dev-tool versions pinned in requirements-dev.txt.
Changes:
- Add a
package-ecosystem: pre-commitentry to Dependabot’s scheduled updates. - Document (in-file) why pre-commit hook revs must be kept in sync with CI/pip pins.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/dependabot.yml:
- Around line 18-21: Update the synchronization comment in the Dependabot
configuration to accurately state that the pre-commit and pip ecosystems update
independently, removing the claim that their versions stay synchronized; do not
change the dependency configuration.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: ea1280a1-3050-48e4-83d2-455e1fdcf026
📒 Files selected for processing (1)
.github/dependabot.yml
📜 Review details
⏰ Context from checks skipped due to timeout. (3)
- GitHub Check: copilot-pull-request-reviewer
- GitHub Check: Analyze (python)
- GitHub Check: Analyze (actions)
🔇 Additional comments (1)
.github/dependabot.yml (1)
22-25: LGTM!
The comment claimed this keeps hook revs "in step with" the pip pins. It does not: pip and pre-commit are separate ecosystems and Dependabot raises a PR per ecosystem, so the two can still diverge between merges. What it does buy is that .pre-commit-config.yaml stops being ignored entirely. Reworded, and the manual check at review time is now stated rather than implied. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The problem
Dependabot bumps
requirements-dev.txtbut has never touched.pre-commit-config.yaml. The two drift, and pre-commit ends up linting and type-checking with different versions than CI.This is not hypothetical — it is what blocked #53 and #49 since July. CodeRabbit flagged both, correctly, and they sat there. The drift predates them too:
mainhadruff==0.15.20pinned against hookrev: v0.15.17.requirements-dev.txtTwo minors apart for mypy is enough for the two to disagree on what type-checks — you pass locally and fail in CI, or the reverse.
The fix
Adds the
pre-commitecosystem so Dependabot maintains the hook revs alongside the pip pins:pre-commitis a supported ecosystem;directory: "/"points at the repo-root.pre-commit-config.yaml. YAML validated, all four ecosystems parse:pip, docker, github-actions, pre-commit.This stops the drift recurring. #53 and #49 have had their revs synced by hand in their own branches.
🤖 Generated with Claude Code