Reduce updates for `dev` and `docs` groups dependency

[shenxianpeng]

Describe the behavior you would like

Right now, dependency updates using uv are scheduled daily, which feels too frequent for the dev and docs groups.

For the action group, checking for new releases daily makes sense, but for dev and docs, a quarterly update schedule should be sufficient.

I am not sure if we can split the dependency groups into separate manifest files that Dependabot can target independently

cpp-linter-action/pyproject.toml

Lines 7 to 24 in b514e55

	[dependency-groups]
	action = [
	"clang-tools==0.15.3",
	"cpp-linter==1.10.7",
	]
	dev = [
	"mypy>=1.17.1",
	"pre-commit>=4.3.0",
	"ruff>=0.12.8",
	]
	docs = [
	"markdown-gfm-admonition>=0.1.1",
	"mkdocs>=1.6.1",
	"mkdocs-gen-files>=0.5.0",
	"mkdocs-include-markdown-plugin>=7.1.6",
	"mkdocs-material>=9.6.16",
	"pyyaml>=6.0.2",
	]

cpp-linter-action/.github/dependabot.yml

Lines 16 to 23 in b514e55

	- package-ecosystem: uv
	directory: /
	schedule:
	interval: "daily"
	groups:
	pip:
	patterns:
	- '*'

[shenxianpeng]

From the draft release📦 Dependency updates section, the most important update is "chore(deps): bump clang-tools from 0.15.2 to 0.15.3", but other updates overshadow it.

[2bndy5]

Use skip-changelog label for dependabot PRs that are not important.

I agree quarterly is sufficient for dev and docs groups. We could also config dependabot to only focus on major or minor updates in those groups.

[shenxianpeng]

Use skip-changelog is a good idea.

We could also config dependabot to only focus on major or minor updates in those groups.

If we could, that's great to reduce the interruption and effort of these updates

[2bndy5]

Unfortunately, dependabot may not be aware of PEP735's dependency --groups. And dependency-type is not support by the uv ecosystem.

So, we have to manually specify the dependencies in their respective groups to mirror the dependencies.* tables in pyproject.toml:

group by pattern

  - package-ecosystem: uv
    directory: /
    schedule:
      interval: "daily"
    groups:
      production:
        patterns:
          - "cpp-linter"
          - "clang-tools-pip"
        exclude-patterns:
          - "mkdocs"
          - "ruff"
          - "mypy"
      dev:
        patterns:
          - "mkdocs"
          - "ruff"
          - "mypy"
        exclude-patterns:
          - "cpp-linter"
          - "clang-tools-pip"
        update-types:
          - major
          - minor

Note, schedule is only allowed to be applied to the ecosystem. schedule cannot be applied to each group.

[2bndy5]

I recently looked at using renovate to replace dependabot. But they do not support uv.lock or PEP735 because everything they support has to be implemented in JS.

It would be nice to have a package management solution that supports

• GH actions
• pip/uv
• npm/yarn/deno/bun
• rust

But we don't live in a perfect world. Maybe an AI can help instead?

[shenxianpeng]

Your solution looks good enough to just bump major and minor versions for other deps

Revnovate may be more powerful, I know Updatecli should be updated specific deps, but I don't want to introduce it since Dependabot is still good.

[2bndy5]

I know Updatecli should be updated specific deps

I was searching for alternatives when you posted this. Google did not present UpdateCLI as a result 😆 .

Any third-party solution would imply some degree of security risk anyway.

[shenxianpeng]

Any third-party solution would imply some degree of security risk anyway.

Right. I prefer Dependabot and Revnovate. UpdateCLI was inspired by Jenkins projects, such as https://github.com/jenkinsci/docker/tree/master/updatecli

[2bndy5]

It might be a while before we see the solution produce a PR. Closing this, but we can re-open it if the solution is insufficient.