ci: add Dependabot for dev/docs and actions updates

Author: feodor-ra

.github/dependabot.yml

@@ -0,0 +1,34 @@
+version: 2
+
+updates:
+  # Python tooling: update the dev and docs dependency groups only.
+  # allow=development limits PRs to non-production deps; the explicit ignore is a
+  # belt-and-suspenders guard so the runtime contract (fastapi, pydantic) is never auto-bumped.
+  - package-ecosystem: "uv"
+    directory: "/"
+    schedule:
+      interval: "monthly"
+    allow:
+      - dependency-type: "development"
+    ignore:
+      - dependency-name: "fastapi"
+      - dependency-name: "pydantic"
+    groups:
+      python-dev:
+        patterns:
+          - "*"
+    commit-message:
+      prefix: "chore"
+      include: "scope"
+
+  # GitHub Actions pinned in the workflows.
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "monthly"
+    groups:
+      github-actions:
+        patterns:
+          - "*"
+    commit-message:
+      prefix: "ci"

CLAUDE.md

@@ -94,7 +94,7 @@ src-layout, package `src/fastapi_typed_errors/`:
 - Prefer pytest **fixtures** for reusable arrange values (request objects, configured apps, built artifacts) — typed, with a docstring and a `Returns:` section. Module level is only for error classes/enums that must exist at import time (they are used in type positions). Don't name a fixture `request` — it clashes with pytest's built-in.
 - Lint everything: `just lint` (ruff format --check, ruff check, ty check). Run `uv run ruff format` to apply formatting. **ruff (preview) also formats Python code blocks inside Markdown** (`README.md`, `docs/**`), so keep doc snippets canonically formatted and re-run `just lint` after editing prose with code.
 - Docs: **Material for MkDocs**, bilingual (EN default at `/`, RU at `/ru/`) via `mkdocs-static-i18n` (folder mode: `docs/en/**`, `docs/ru/**`; `nav_translations` localize the nav; language-specific assets like the Swagger SVG live per-language, shared CSS in `docs/stylesheets/`). API reference is auto-generated from Google docstrings via `mkdocstrings[python]` (`:::` blocks). Deps in the `docs` group (`~=`); serve `just docs`, strict build `just docs-build`. Published to GitHub Pages by `.github/workflows/docs.yml` (uv build + `upload-pages-artifact`/`deploy-pages`; Pages source = "GitHub Actions").
-- CI/CD (`.github/workflows/`, uv + `astral-sh/setup-uv@v9.0.0` — pin a full version; setup-uv has no floating `v8`/`v9` major tag): `ci.yml` (on push-main / PR / `workflow_call`) — `lint` + `test` (Python matrix 3.12/3.13/3.14, `pytest --cov` → 100% gate) + `test-floor` (`uv sync --resolution lowest-direct` then **`uv run --no-sync pytest`** — `uv run` alone re-syncs to the lockfile; floor = FastAPI 0.115 / pydantic 2.9, **no** coverage gate since the `iter_route_contexts` branch can't run there). Coverage is reported to **Coveralls** (`coverallsapp/github-action@v2`, `file: coverage.lcov` from `coverage lcov`) from the **3.12 matrix leg only** (gated `if: matrix.python-version == '3.12'` — identical 100% across versions; never from `test-floor`); uses the built-in `github.token` (public repo, no secret) and the Coveralls repo is auto-created on first post, so no manual enablement. Badge in both READMEs. `publish.yml` (on release published) reuses `ci.yml` then publishes via **PyPI Trusted Publishing / OIDC** (`environment: pypi`, `id-token: write`, `uv build` + smoke `scripts/smoke_test.py` on wheel+sdist + `uv publish`, no token) — needs a one-time PyPI pending-publisher config.
+- CI/CD (`.github/workflows/`, uv + `astral-sh/setup-uv@v9.0.0` — pin a full version; setup-uv has no floating `v8`/`v9` major tag): `ci.yml` (on push-main / PR / `workflow_call`) — `lint` + `test` (Python matrix 3.12/3.13/3.14, `pytest --cov` → 100% gate) + `test-floor` (`uv sync --resolution lowest-direct` then **`uv run --no-sync pytest`** — `uv run` alone re-syncs to the lockfile; floor = FastAPI 0.115 / pydantic 2.9, **no** coverage gate since the `iter_route_contexts` branch can't run there). Coverage is reported to **Coveralls** (`coverallsapp/github-action@v2`, `file: coverage.lcov` from `coverage lcov`) from the **3.12 matrix leg only** (gated `if: matrix.python-version == '3.12'` — identical 100% across versions; never from `test-floor`); uses the built-in `github.token` (public repo, no secret) and the Coveralls repo is auto-created on first post, so no manual enablement. Badge in both READMEs. `publish.yml` (on release published) reuses `ci.yml` then publishes via **PyPI Trusted Publishing / OIDC** (`environment: pypi`, `id-token: write`, `uv build` + smoke `scripts/smoke_test.py` on wheel+sdist + `uv publish`, no token) — needs a one-time PyPI pending-publisher config. `dependabot.yml` (monthly): the `uv` ecosystem updates **dev/docs groups only** (`allow: dependency-type: "development"` + explicit `ignore` of `fastapi`/`pydantic` as a guard, grouped into one PR); a separate `github-actions` ecosystem keeps the workflow action pins current.
 - Version-conditional tests: edges that behave differently on old FastAPI/pydantic (PEP 695 `type`-alias return annotations, the broken-param-hint tolerance, lazy-include dedup) are guarded by `requires_modern_fastapi = skipif(not hasattr(fastapi.routing, "iter_route_contexts"))` — they run (and count toward 100%) on the default stack, skip on the floor. `monkeypatch.delattr(..., raising=False)` where the attribute is absent on the floor.
 - Both `httpx` (old starlette `TestClient`, the FastAPI floor) and `httpx2` (new starlette) are in the dev group.
 - Environment and build: uv (`uv sync`, `uv run python ...`), build backend `uv_build`.