ci: pin yamllint where Dependabot can see it - #14
Merged
Conversation
lens0021
force-pushed
the
claude/github-actions-workflows-bbht4a
branch
from
August 15, 2026 12:05
7a42f8b to
66eb5a5
Compare
lens0021
changed the title
yamllint is the only linter the runner image does not ship, so the job installed it itself and the version sat in a `run:` line, which no updater reads. Moving it into pyproject.toml puts it in front of Dependabot's uv ecosystem, and uv.lock records a sha256 for yamllint and for the two packages it pulls in -- neither of which the `pipx install` line pinned at all. `uv run --frozen` installs exactly what the lockfile says and fails if the lockfile and pyproject.toml have drifted apart, so a hand-edited version cannot quietly take effect. Nothing here is a Python package; `package = false` says so. The `project` table exists only so the lockfile carries a fixed `requires-python` instead of whichever interpreter last ran `uv lock`.
lens0021
force-pushed
the
claude/github-actions-workflows-bbht4a
branch
from
August 15, 2026 12:20
66eb5a5 to
874c56f
Compare
lens0021
marked this pull request as ready for review
August 15, 2026 12:22
lens0021
added a commit
to chaotic-ground/wikven
that referenced
this pull request
Aug 15, 2026
The version sat in a pipx install line, which no package manager reads, so it was one of the pins nothing was watching. A uv dependency group is a manifest Dependabot already knows how to bump, and the lockfile pins yamllint's own dependencies too, which the pipx install resolved fresh on every run. Follows chaotic-ground/setup-mago#14. The other two loose pins, taplo and updatecli, stay manual: both live in a workflow "with:" input, and updatecli's yaml target reformats the file it edits -- it drops blank lines and halves the space before a comment, which yamllint --strict then rejects.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This branch previously carried updatecli manifests. It no longer does — the only version updatecli
was there to keep was yamllint's, and a package file hands that to Dependabot instead, so the extra
updater is gone.
What changed
pyproject.tomldeclaresyamllint==1.38.0in a PEP 735 dependency group.uv.lockrecords a sha256 for yamllint and for the two packages it pulls in — none of which theold
pipx install yamllint==1.38.0line pinned at all.uv run --frozen --group lint yamllint --strict ..--frozeninstallsexactly what the lockfile says and fails if the lockfile and
pyproject.tomlhave drifted apart.uvecosystem, so the bump arrives as a PR like every other pin here.Why not a package
Nothing in this repository is a Python package, and
package = falsesays so. Theprojecttableis there for one reason: without it
uv lockwrites whichever interpreter it happened to find intothe lockfile's
requires-python, so the file would change depending on who regenerated it.Verified
uv lockresolves,uv run --frozen --group lint yamllint --strict .passes over the repository,and
typosis clean over the new lockfile.