Repository navigation
ci: fix Dependabot config to match repo structure - #21
donny-devops wants to merge 3 commits into
Conversation
The prior config referenced directories (/desktop-assistant, /to-dojo, /web-scraper) that don't exist in this repo; the npm and pip manifests both live at the repo root. Points ecosystems at the correct paths. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
|
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
PR Summary by Qodoci: fix Dependabot config for root npm/pip manifests
AI Description
Diagram
High-Level Assessment
Files changed (12)
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request adds various configuration, documentation, and agent definition files for an agentic development environment, while deleting the main README.md file. Feedback on these changes identifies critical issues: a shell script references a non-existent npm package (license-checker-rschmitt) with incorrect flags, the deletion of README.md removes primary documentation, and .env.example references a non-existent model (gpt-5.5).
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
| @@ -0,0 +1 @@ | |||
| npx license-checker-rschmitt --production --onlyAllow 'MIT;Apache-2.0;BSD-2-Clause;BSD-3-Clause;ISC;0BSD;Unlicense' --exclude '@img/*' No newline at end of file | |||
There was a problem hiding this comment.
The package license-checker-rschmitt does not exist on npm and will cause the script to fail with a 404 error. This appears to be a hallucination of the maintained fork license-checker-rseidelsohn.
Additionally, the --exclude option in license-checker-rseidelsohn has been renamed to --excludeLicenses and is used for excluding license names, not package names. To exclude packages starting with a specific prefix (like @img/), the --excludePackagesStartingWith option should be used instead.
| npx license-checker-rschmitt --production --onlyAllow 'MIT;Apache-2.0;BSD-2-Clause;BSD-3-Clause;ISC;0BSD;Unlicense' --exclude '@img/*' | |
| npx license-checker-rseidelsohn --production --onlyAllow 'MIT;Apache-2.0;BSD-2-Clause;BSD-3-Clause;ISC;0BSD;Unlicense' --excludePackagesStartingWith '@img/' |
| @@ -1,56 +0,0 @@ | |||
| # Post-Quantum Studio | |||
There was a problem hiding this comment.
The deletion of the main README.md file removes the primary documentation for the repository. If this was accidental, the file should be restored.
| @@ -0,0 +1,4 @@ | |||
| OPENAI_API_KEY=your_key_here | |||
| OPENAI_MODEL=gpt-5.5 | |||
There was a problem hiding this comment.
The model gpt-5.5 does not exist. It is recommended to use a valid, currently available model such as gpt-4o as the default example to prevent configuration errors or confusion for developers setting up the environment.
OPENAI_MODEL=gpt-4o
![amazon-q-developer[bot]](https://avatars.githubusercontent.com/in/1220912?s=60&v=4){kind=small}
There was a problem hiding this comment.
Review Summary
This PR successfully adds a valid Dependabot configuration that correctly targets the npm and pip ecosystems present in the repository. The configuration properly references package.json and pyproject.toml at the root directory, which matches the actual repo structure.
Critical Issues Found (3)
Three files are missing the required newline at end of file, which violates POSIX standards and can cause issues with various Unix tools including git, diff, and text editors. These should be fixed before merge to ensure proper tool compatibility.
Dependabot Configuration
The .github/dependabot.yml configuration is valid and will function correctly once the POSIX compliance issues are resolved. The github-actions ecosystem is appropriately included for future workflow files.
You can now have the agent implement changes and create commits directly on your pull request's source branch. Simply comment with /q followed by your request in natural language to ask the agent to make changes.
| target-version = "py312" | ||
|
|
||
| [tool.pytest.ini_options] | ||
| testpaths = ["tests"] No newline at end of file |
There was a problem hiding this comment.
🛑 Format Error: Add a newline at end of file. POSIX requires text files to end with a newline character, and many tools fail or produce warnings without it.
| testpaths = ["tests"] | |
| testpaths = ["tests"] | |
| OPENAI_API_KEY=your_key_here | ||
| OPENAI_MODEL=gpt-5.5 | ||
| APP_ENV=development | ||
| LOG_LEVEL=info No newline at end of file |
There was a problem hiding this comment.
🛑 Format Error: Add a newline at end of file. POSIX requires text files to end with a newline character, and many tools fail or produce warnings without it.
| LOG_LEVEL=info | |
| LOG_LEVEL=info | |
| .DS_Store | ||
| Thumbs.db | ||
| .vscode/ | ||
| .idea/ No newline at end of file |
There was a problem hiding this comment.
🛑 Format Error: Add a newline at end of file. POSIX requires text files to end with a newline character, and many tools fail or produce warnings without it.
| .idea/ | |
| .idea/ | |
There was a problem hiding this comment.
Pull request overview
This PR is presented as a CI-focused change to correct Dependabot configuration to match the repository’s actual structure. However, it also introduces a large set of unrelated repository changes (new docs/config artifacts, Python project scaffolding) and clears the existing README content, which materially expands scope beyond the stated intent.
Changes:
- Adds
.github/dependabot.ymlwith update rules for npm, pip, and GitHub Actions at the repo root. - Adds multiple new non-CI/non-Dependabot files (docs/config artifacts, scripts, calendar file, security service configs).
- Removes all content from
README.md(leaving it empty).
Reviewed changes
Copilot reviewed 13 out of 17 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
target.yaml |
Adds a deployment/target selection YAML (unrelated to Dependabot). |
security-services.yaml |
Adds security tool configuration scaffolding (unrelated to Dependabot). |
README.md |
Removes all README content (now empty). |
pyproject.toml |
Adds Python project metadata/dependencies (unrelated to Dependabot config fix). |
Mastering the Kubernetes Gateway API.ics |
Adds a calendar invite file (unrelated to Dependabot). |
echozulu-security-governor.md |
Adds agent/governance documentation (unrelated to Dependabot). |
echozulu-deployment-operator.md |
Adds deployment-operator documentation (unrelated to Dependabot). |
deepseek_bash_20260523_c4b344.sh |
Adds a one-line script artifact (unrelated to Dependabot). |
CONTEXT.md |
Adds OpenClaw context-window documentation (unrelated to Dependabot). |
COMMANDS.md |
Adds OpenClaw commands/authorization documentation (unrelated to Dependabot). |
AGENTS.md |
Adds operational rules for agents (unrelated to Dependabot). |
.gitignore |
Adds ignores for Python/Node and agent outputs (missing .next/ for this Next.js repo). |
.github/dependabot.yml |
Adds Dependabot configuration for npm/pip/actions at /. |
.env.example |
Adds environment variable example (OpenAI-related). |
Comments suppressed due to low confidence (1)
README.md:1
- README.md has been reduced to an empty file (all content removed). If the goal of this PR is CI/Dependabot configuration, this looks like an accidental deletion and it also removes key project documentation for contributors.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| version: 2 | ||
| updates: | ||
| - package-ecosystem: "npm" | ||
| directory: "/" | ||
| schedule: | ||
| interval: "weekly" | ||
| open-pull-requests-limit: 10 |
|
Closing — this PR was accidentally built on a branch based on 🤖 Addressed by Claude Code |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: f45a41ebee
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| target-version = "py312" | ||
|
|
||
| [tool.pytest.ini_options] | ||
| testpaths = ["tests"] No newline at end of file |
There was a problem hiding this comment.
This root Python test config is added to a repo whose tracked source is the Next.js app, and there is no root tests/ directory for it to target. In environments that auto-run pytest when a pyproject.toml is present, this now exits with code 5 after warning that no files were found in testpaths, so automation can fail even though the app has no Python test suite here.
Useful? React with 👍 / 👎.
| @@ -1,56 +0,0 @@ | |||
| # Post-Quantum Studio | |||
There was a problem hiding this comment.
This commit empties the README, removing the only setup commands, quality gates, project structure, license, and the warning that the crypto provider is demo-only. Anyone trying to run or evaluate this repo loses the project’s onboarding and safety context, so this should be restored or intentionally replaced rather than deleted.
Useful? React with 👍 / 👎.
Code Review by Qodo
1. README wiped
|
![qodo-code-review[bot]](https://avatars.githubusercontent.com/in/484649?s=60&v=4){kind=small}
| BEGIN:VCALENDAR | ||
| VERSION:2.0 | ||
| PRODID:Calendar | ||
| CALSCALE:GREGORIAN | ||
| METHOD:PUBLISH | ||
| BEGIN:VEVENT | ||
| SUMMARY:Mastering the Kubernetes Gateway API | ||
| UID:event-message:4518588 | ||
| URL:https://youtube.com/watch?v=cpzYH_Xk_xw | ||
| SEQUENCE:0 | ||
| STATUS:CONFIRMED | ||
| TRANSP:TRANSPARENT | ||
| DTSTART:20260525T190000Z | ||
| DTEND:20260525T200000Z | ||
| DTSTAMP:20260523T021918Z |
There was a problem hiding this comment.
2. Unrelated calendar file added 🐞 Bug ⚙ Maintainability
The PR adds a calendar invite file (Mastering the Kubernetes Gateway API.ics) that is unrelated to Dependabot configuration and increases repository clutter. Keeping personal artifacts in-repo makes future maintenance and review harder.
Agent Prompt
### Issue description
A personal/one-off calendar export file is committed to the repo.
### Issue Context
The PR goal is Dependabot config; this file does not appear related to CI or dependency management.
### Fix Focus Areas
- Mastering the Kubernetes Gateway API.ics[1-55]
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
| @@ -0,0 +1 @@ | |||
| npx license-checker-rschmitt --production --onlyAllow 'MIT;Apache-2.0;BSD-2-Clause;BSD-3-Clause;ISC;0BSD;Unlicense' --exclude '@img/*' No newline at end of file | |||
There was a problem hiding this comment.
3. One-off command file committed 🐞 Bug ⚙ Maintainability
The PR adds deepseek_bash_20260523_c4b344.sh, which is just a single ad-hoc npx command and is not integrated into repo scripts or tooling. This kind of stray file tends to accumulate and becomes unclear/unsafe to run later without context.
Agent Prompt
### Issue description
A standalone file containing a single `npx ...` command was committed without documentation or integration.
### Issue Context
If this is intended to be run by contributors/CI, it should be captured as an `npm` script (package.json) or documented in a README/docs location; otherwise it should be removed.
### Fix Focus Areas
- deepseek_bash_20260523_c4b344.sh[1-1]
- package.json[6-14]
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
| OPENAI_API_KEY=your_key_here | ||
| OPENAI_MODEL=gpt-5.5 | ||
| APP_ENV=development | ||
| LOG_LEVEL=info No newline at end of file |
There was a problem hiding this comment.
4. Missing trailing newlines 🐞 Bug ⚙ Maintainability
Several newly added text files are missing a trailing newline at end-of-file, which commonly creates noisy diffs and can trip basic formatting checks in some tooling. This is a low-severity hygiene issue but easy to fix now.
Agent Prompt
### Issue description
Some newly added text files were committed without a trailing newline.
### Issue Context
Git diffs already flag this as `No newline at end of file`.
### Fix Focus Areas
- .env.example[1-4]
- pyproject.toml[1-25]
- deepseek_bash_20260523_c4b344.sh[1-1]
- Mastering the Kubernetes Gateway API.ics[1-55]
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
| @@ -1,56 +0,0 @@ | |||
| # Post-Quantum Studio | |||
There was a problem hiding this comment.
1. Readme wiped 🐞 Bug ⚙ Maintainability
This PR removes all README.md content, leaving the repo with an empty landing/documentation page. This is a significant documentation regression and is likely accidental given the PR’s Dependabot-focused scope.
Agent Prompt
### Issue description
README.md’s content was removed, leaving the repository with no top-level documentation.
### Issue Context
In the PR branch, `README.md` exists but is empty.
### Fix Focus Areas
- README.md[1-1]
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
Summary
.github/dependabot.ymlcovering the ecosystems that actually exist in this repo: npm (package.json) and pip (pyproject.toml), both at the repo root, plus github-actions for future workflow files./desktop-assistant,/to-dojo,/web-scraper) that don't exist anywhere in this repo — those configs would never trigger any Dependabot updates. PR Add Dependabot configuration for package updates #6/Add Dependabot configuration for package updates #7's committed file also contains a leftover PowerShell heredoc artifact (@"..."@ | Set-Content ...) baked into the YAML content, so it isn't even valid as committed.Test plan
.github/dependabot.ymlparses (GitHub validates on merge)🤖 Generated with Claude Code