Dependabot was adopted as the trigger for lock.yml in #565, closing the earlier GitHub App idea in #346. However, #594 shows that Dependabot is unreliable for several repositories with uv.lock, especially where private repositories are involved.
We should revisit a small organization-owned GitHub App, used from a scheduled workflow, to create quarterly lock-file upgrade PRs across selected ComPWA repositories. This would avoid depending on Dependabot as the trigger while still producing bot-authored PRs with narrow permissions.
Suggested starting point: no webhook server, just GitHub App authentication from a scheduled workflow in ComPWA/.github.
Dependabot was adopted as the trigger for
lock.ymlin #565, closing the earlier GitHub App idea in #346. However, #594 shows that Dependabot is unreliable for several repositories withuv.lock, especially where private repositories are involved.We should revisit a small organization-owned GitHub App, used from a scheduled workflow, to create quarterly lock-file upgrade PRs across selected ComPWA repositories. This would avoid depending on Dependabot as the trigger while still producing bot-authored PRs with narrow permissions.
Suggested starting point: no webhook server, just GitHub App authentication from a scheduled workflow in
ComPWA/.github.