Keep GitHub Actions up to date with GitHub's Dependabot

[cclauss]

• Keeping your software supply chain secure with Dependabot
• Keeping your actions up to date with Dependabot
• Configuration options for the dependabot.yml file - package-ecosystem

To see all GitHub Actions dependencies, type:
% git grep 'uses: ' .github/workflows/

Description

[Briefly describe the changes made in this pull request.]

Related Issues

[Reference any related issues or tasks addressed by this pull request.]

Changes Made

[List the specific changes made in this pull request.]

Checklist

• Changes tested locally
• Code reviewed
• Documentation updated (if necessary)
• Unit tests added (if applicable)

Additional Notes

[Add any additional notes or context for the reviewer(s).]

[danielaskdd]

Automatic dependency updates pose the following issues:

• potential compatibility problems with the system;
• failure to update uv.lock, resulting in inconsistencies between the dependencies installed in Docker builds and those specified in pyproject.toml.

Given the lack of significant benefits, manual inspection and updating of dependencies are recommended.

[cclauss]

The "system" in this case is the GitHub Action runtime (not your local system), and Dependabot is created by and recommended by GitHub as stated in the commit message above. Upgrades to Actions can be security fixes, such as:

• Persist creds to a separate file actions/checkout#2286 (review)

Which is missing here:

• LightRAG/.github/workflows/pypi-publish.yml

  Line 16 in 607c11c

  - uses: actions/checkout@v4

---

package-ecosystem: github-actions != package-ecosystem: uv --> These are GitHub Actions, not Python modules that uv installs from PyPI, so they cannot cause conflicts with things that uv installs.

• https://docs.astral.sh/uv/guides/integration/github/#syncing-and-running

[danielaskdd]

Due to compatibility requirements, certain modules such as numpy must remain on lower versions. Dependabot periodically raises PRs to trigger updates — how should this be addressed?

[danielaskdd]

I got your point. The let AI solved my concern in PR #2447.