[camUrban]

Description

This PR reduces the manual upkeep that Dependabot pull requests need. The GitHub Actions and pre-commit version updates now share one monthly multi-ecosystem group, so routine CI tooling bumps arrive as a single pull request each month instead of two weekly ones. A new dependabot-triage.yml workflow runs on every Dependabot pull request, replacing its title with a short fixed one and adding it to the lowest open release milestone. A new pip entry in dependabot.yml controls the labels and assignee on pip security update pull requests without opening any routine version updates for the requirements files. Separate from this PR, I also made the new dependabot-triage.yml workflow a required status check in the main ruleset.

Neither workflow step can run before this merges, because the workflow only runs from main once Dependabot opens a pull request. The first grouped pull request after merging is therefore its first real test. This PR deliberately leaves out automatic rebasing of pull requests that fall behind main and an approval requirement for Dependabot pull requests only. Dependabot ignores @dependabot rebase comments posted with the workflow token, and rulesets cannot scope an approval requirement or merge method to a pull request's author, so both stay manual.

Motivation

Every Dependabot pull request has needed the same set of manual steps: assigning it, setting its milestone, removing stray labels such as python that Dependabot creates on security updates, and editing the squash-merge subject so it stays within the 50-character commit subject limit. Dependabot's own titles, such as "Bump the actions group with 3 updates", leave little room once the squash merge appends the pull request number. Weekly updates for two ecosystems also produced a steady stream of small pull requests for tooling that never affects the package's runtime. Security updates do not follow the version update schedule, so the slower cadence does not delay vulnerability fixes.

Relevant Issues

None.

Changes

• Replaced the separate weekly schedule and single-ecosystem groups of the github-actions and pre-commit entries in dependabot.yml with one ci-tooling multi-ecosystem group on a monthly interval, keeping the 7-day cooldown on each entry.
• Added assignees on the ci-tooling group so grouped pull requests arrive assigned to the maintainer. Review requests already come from CODEOWNERS.
• Added a pip entry with open-pull-requests-limit: 0, labels: [dependencies], and assignees. The zero limit disables pip version updates, while the labels and assignee still apply to pip security update pull requests, which replaces Dependabot's default python label.
• Added .github/workflows/dependabot-triage.yml, which runs on opened, reopened, and synchronize events for pull requests authored by dependabot[bot], with permissions: {} at the top level and issues: write and pull-requests: write on its single job.
• Its title step sets "Bump CI tooling" when every changed file is under .github/ or is .pre-commit-config.yaml. Otherwise it sets "Bump runtime dependency" or "Bump runtime dependencies", chosen by counting the - dependency-name: entries in Dependabot's own commit messages, which keeps the count correct after the title has already been replaced.
• Its milestone step picks the lowest open milestone titled vX.Y.Z, sorting the version numbers numerically so that v5.9.0 sorts before v5.10.0. It skips pull requests that already have a milestone, so a milestone set by hand is never overwritten.
• Added dependabot-triage.yml to the list of workflows in CLAUDE.md.

Dependency Updates

None.

Change Magnitude

Minor: Small change such as a bug fix, small enhancement, or documentation update.

Checklist (check each item when completed or not applicable)

• I am familiar with the current contribution guidelines.
• PR description links all relevant issues and follows this template.
• My branch is based on main and is up to date with the upstream main branch.
• All calculations use S.I. units.
• Code is formatted with black (line length = 88).
• Code is well documented with block comments where appropriate.
• Any external code, algorithms, or equations used have been cited in comments or docstrings.
• All new modules, classes, functions, and methods have docstrings in reStructuredText format, and are formatted using docformatter (--in-place --black). See the style guide for type hints and docstrings for more details.
• All new classes, functions, and methods in the pterasoftware package use type hints. See the style guide for type hints and docstrings for more details.
• If any major functionality was added or significantly changed, I have added or updated tests in the tests package.
• Code locally passes all tests in the tests package.
• This PR passes the ReadTheDocs build check (this runs automatically with the other workflows).
• This PR passes the ascii-only, pre-commit-hooks, and zizmor GitHub actions.
• This PR passes the lint job of the CI GitHub action.
• This PR passes the test jobs of the CI GitHub action.

Assisted-by: Claude Opus 5.5

[Copilot]

🟡 Changes recommended

The workflow’s read-only Dependabot token prevents PR updates, and its stale event-payload milestone check can overwrite a maintainer’s manual assignment.

2 open issues

• Use pull_request_target for Dependabot milestone updates · New
• Check the current milestone before assigning a default · New

What changed in this PR

This PR reduces manual Dependabot upkeep by consolidating CI tooling updates and automating pull request metadata.

Changes:

• Groups GitHub Actions and pre-commit updates into one monthly pull request, retaining seven-day cooldowns.
• Configures labels and assignment for pip security updates while disabling routine pip version updates.
• Adds a workflow to shorten Dependabot pull request titles and assign the lowest open release milestone.

File	Description
CLAUDE.md	Adds the triage workflow to the documented workflow list.
.github/​workflows/​dependabot-triage.yml	Automates Dependabot pull request titles and milestone assignment.
.github/​dependabot.yml	Consolidates tooling updates and configures pip security update metadata.

_{Review effort: Balanced}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 96.72%. Comparing base (b555f4d) to head (3b74739).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #347   +/-   ##
=======================================
  Coverage   96.72%   96.72%           
=======================================
  Files          75       75           
  Lines       10933    10933           
=======================================
  Hits        10575    10575           
  Misses        358      358           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.