Pin CI tools and manage dependency updates with Renovate - #792
Open
AlexWaygood wants to merge 1 commit into
Open
Pin CI tools and manage dependency updates with Renovate#792AlexWaygood wants to merge 1 commit into
AlexWaygood wants to merge 1 commit into
Conversation
Codecov Report✅ All modified and coverable lines are covered by tests. @@ Coverage Diff @@
## main #792 +/- ##
=======================================
Coverage 97.26% 97.26%
=======================================
Files 3 3
Lines 7859 7859
=======================================
Hits 7644 7644
Misses 215 215
Flags with carried forward coverage won't be shown. Click here to find out more. 🚀 New features to boost your workflow:
|
AlexWaygood
marked this pull request as ready for review
August 29, 2026 14:23
JelleZijlstra
approved these changes
Aug 29, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Note
We would need to enable the Renovate GitHub App for
python/typing_extensionsbefore landing this PR. Adding the configuration does not enable the app, and this PR removes the existing Dependabot update configuration. See Renovate's installation instructions.Pin more CI dependencies while keeping their updates automated.
Pinning GitHub Actions to commits pins the installer code, but actions can still download unpinned tools on each run:
setup-uvand Codecov currently do so. This PR pins those tool versions and switches from Dependabot to Renovate so that these additional pins can receive automated update PRs instead of requiring manual maintenance.The PR pins uv to
0.12.7in all tensetup-uvsteps, pins the Codecov CLI tov11.3.1, and pins the Python pre-commit hook dependenciesjson5andvalidate-pyproject-schema-store[all]. It also replaces the Dependabot schema hook with the Renovate schema hook and declares hook languages explicitly so Renovate can discover their additional dependencies.The monthly schedule and seven-day release cooldown are retained, with updates grouped under "CI dependencies" and a Dependency Dashboard enabled. Initial digest pinning is exempt from the cooldown because it pins a version already in use. The configuration does not enable automerging.
Renovate will update:
versionand SHA-256checksuminputs together inci.ymlandthird_party.yml.versioninput inci.yml. Codecov's existing download verification remains enabled.[build-system].requiresinpyproject.toml, currently theflit_coreversion range. This PR does not change that range.Renovate will not update Python versions or support metadata, test matrices, GitHub runner images, containers/services, or the Read the Docs environment.
uv checksums
The uv checksum is pinned in addition to the version because a version selects a release, while a checksum fixes the expected archive contents. The pinned
setup-uvaction uses an explicit checksum or its built-in checksum table for the default download source; if neither supplies a checksum, it skips verification.Renovate's native
setup-uvsupport updates the version without the checksum. The custom manager therefore uses Renovate'sgithub-release-attachmentsdatasource to update both fields together.