[hudsonaikins]

PS-DEP-01: Dependabot configured

Opened by the Infrastructure Engine (platform standard v1). Playbook: adopt-actions-ci.

Why: the conformance checker reported: no .github/dependabot.yml

What changed: .github/dependabot.yml

Added Dependabot configuration for PS-DEP-01 only.

Verification (run by the Engine, not taken from the worker)

• Rule status after the change: pass
• Out-of-scope files: none; unpinned actions: none
• (no run steps)

Review

Written by codex, reviewed by claude: approve. The patch adds only .github/dependabot.yml, which is the file PS-DEP-01 requires. The engine reports the rule passes afterwards, with nothing out of scope and no unpinned actions. The config is valid version-2 syntax and covers the repo's real manifests: pip at / and /reflex_demo (requirements files exist in both), npm at /apps/web and /frontend (both have package.json and package-lock.json), and github-actions at / (four workflows). The file adds no CI steps, secrets or paid calls. Every failing CI replay step comes from the local replay setup, not this change: pip is missing from the venv, so httpx, psycopg, vulture and reflex never install; decision-workspace runs npm at the repo root, which has no package.json; and product-validation's --expected-commit argument is rejected. A YAML-only Dependabot file can't affect those steps, so the patch should pass. One small issue is the npm entry for /reflex_demo/reflex.lock, noted below.

• [minor] .github/dependabot.yml: The npm entry includes /reflex_demo/reflex.lock. That directory is Reflex-generated and uses bun.lock, not package-lock.json. Dependabot's npm ecosystem doesn't read bun.lock (bun has its own bun ecosystem), and Reflex will likely regenerate the directory and overwrite any Dependabot changes. Drop this directory, or move it to a bun ecosystem entry if those updates are actually wanted. Python dependencies under /reflex_demo are already covered by the pip entry.

Rollback: revert this PR. Nothing outside the repository changes.
Risk: low (CI or repository configuration only).

🤖 Generated with Claude Code

[hudsonaikins]

Closing: BackIntel is paused for now, so the Infrastructure Engine is standing down on it. This PR also had a defect found by the Engine's 100-run evaluation: the npm Dependabot entry included /reflex_demo/reflex.lock, which is Bun-managed (bun.lock). The Engine now checks Dependabot ecosystems against lockfiles, so a reopened version would use the right one.