unsloth/.github
Pete Kloehn efedbe9740
Feature/add dependabot and codeql security checks (#4479)
* Add CodeQL analysis workflow configuration

* Add Dependabot configuration for package updates

Configure Dependabot to check for updates in various ecosystems weekly.

* Fix dependabot.yml: bun ecosystem, missing dir, grouping for PR #4479

1. studio/frontend uses bun.lock not package-lock.json, so change npm to bun
2. Add missing studio/backend/requirements/ pip entry (consumed by studio/setup.sh)
3. Add groups with patterns ["*"] to all pip/bun/npm entries to batch updates
   and avoid 30+ individual Dependabot PRs on the first run

* Consolidate pip blocks to fix overlapping directory violation

GitHub Dependabot forbids multiple same-ecosystem entries with
overlapping directories on the same branch. The root "/" directory
overlapped the 3 nested pip dirs. Merge all 4 pip blocks into one
using the `directories:` (plural) key.

Also remove redundant open-pull-requests-limit from the bun block
since grouping with patterns: ["*"] already limits PR count.

---------

Co-authored-by: Daniel Han <danielhanchen@users.noreply.github.com>
2026-03-25 02:41:33 -07:00
..
ISSUE_TEMPLATE Update issue template 2026-03-23 10:10:15 +05:30
workflows Feature/add dependabot and codeql security checks (#4479) 2026-03-25 02:41:33 -07:00
CODEOWNERS Update CODEOWNERS 2026-03-13 13:38:19 -07:00
dependabot.yml Feature/add dependabot and codeql security checks (#4479) 2026-03-25 02:41:33 -07:00
FUNDING.yml Update FUNDING.yml (#3792) 2025-12-28 19:57:43 -08:00