From fecd31b26f9de1c0f5ec1f6a120873801fcf957f Mon Sep 17 00:00:00 2001
From: Neal Richardson <neal.p.richardson@gmail.com>
Date: Tue, 13 Oct 2026 18:31:41 -0400
Subject: [PATCH 1/2] ci: upgrade uv.lock with a scheduled workflow instead of
 dependabot

Dependabot's uv updater can't handle a lockfile that forks by Python
version (requires-python >= 3.8), so every update failed with
dependency_file_not_resolvable. Run `uv lock --upgrade` weekly and open
a PR using a GitHub App token so CI runs on it.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 .github/dependabot.yml                | 10 ++----
 .github/workflows/uv-lock-upgrade.yml | 46 +++++++++++++++++++++++++++
 2 files changed, 48 insertions(+), 8 deletions(-)
 create mode 100644 .github/workflows/uv-lock-upgrade.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 93683171..0eb17518 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -9,11 +9,5 @@ updates:
         patterns:
           - "*"
 
-  - package-ecosystem: "uv"
-    directory: "/"
-    schedule:
-      interval: "weekly"
-    groups:
-      python:
-        patterns:
-          - "*"
+# Python deps are upgraded by .github/workflows/uv-lock-upgrade.yml instead:
+# dependabot can't update a uv.lock that forks by Python version.
diff --git a/.github/workflows/uv-lock-upgrade.yml b/.github/workflows/uv-lock-upgrade.yml
new file mode 100644
index 00000000..bf581915
--- /dev/null
+++ b/.github/workflows/uv-lock-upgrade.yml
@@ -0,0 +1,46 @@
+name: uv-lock-upgrade
+on:
+  schedule:
+  - cron: "0 10 * * 1" # Mondays 10 AM UTC
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  upgrade:
+    runs-on: ubuntu-latest
+    steps:
+    # Use an app token so the PR triggers CI (GITHUB_TOKEN-created PRs don't)
+    - uses: actions/create-github-app-token@v3
+      id: app-token
+      with:
+        client-id: ${{ secrets.POSIT_CONNECT_PROJECTS_CLIENT_ID }}
+        private-key: ${{ secrets.POSIT_CONNECT_PROJECTS_PEM }}
+    - uses: actions/checkout@v6
+      with:
+        persist-credentials: false
+    - uses: astral-sh/setup-uv@v6
+    - name: Upgrade uv.lock
+      id: upgrade
+      run: |
+        {
+          echo 'summary<<EOF'
+          uv lock --upgrade 2>&1
+          echo 'EOF'
+        } >> "$GITHUB_OUTPUT"
+    - uses: peter-evans/create-pull-request@v8
+      with:
+        token: ${{ steps.app-token.outputs.token }}
+        branch: uv-lock-upgrade
+        delete-branch: true
+        commit-message: "chore(deps): upgrade uv.lock"
+        title: "chore(deps): upgrade uv.lock"
+        body: |
+          Automated `uv lock --upgrade`. Dependabot can't update this lockfile because it
+          resolves different versions per Python version (`requires-python = ">=3.8"`).
+
+          ```
+          ${{ steps.upgrade.outputs.summary }}
+          ```
+        add-paths: uv.lock

From 0a2b8da0235c1b410da91a41bfa96515ee7f61ab Mon Sep 17 00:00:00 2001
From: Neal Richardson <neal.p.richardson@gmail.com>
Date: Tue, 13 Oct 2026 18:32:13 -0400
Subject: [PATCH 2/2] ci: use latest checkout and setup-uv in uv-lock-upgrade

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 .github/workflows/uv-lock-upgrade.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/uv-lock-upgrade.yml b/.github/workflows/uv-lock-upgrade.yml
index bf581915..35b73ba9 100644
--- a/.github/workflows/uv-lock-upgrade.yml
+++ b/.github/workflows/uv-lock-upgrade.yml
@@ -17,10 +17,10 @@ jobs:
       with:
         client-id: ${{ secrets.POSIT_CONNECT_PROJECTS_CLIENT_ID }}
         private-key: ${{ secrets.POSIT_CONNECT_PROJECTS_PEM }}
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v7
       with:
         persist-credentials: false
-    - uses: astral-sh/setup-uv@v6
+    - uses: astral-sh/setup-uv@v10.3.0
     - name: Upgrade uv.lock
       id: upgrade
       run: |