Skip to content

chore(deps): strengthen published-library compatibility CI - #270

Merged
dgenio merged 8 commits into
mainfrom
agent/library-dependency-policy
Aug 10, 2026
Merged

chore(deps): strengthen published-library compatibility CI#270
dgenio merged 8 commits into
mainfrom
agent/library-dependency-policy

Conversation

@dgenio

@dgenio dgenio commented Aug 10, 2026

Copy link
Copy Markdown
Owner

Closes #269.

  • make Python Dependabot security-only and keep the deliberate MCP v2 exclusion
  • extend the gating Python matrix to 3.10–3.14
  • add a lowest-direct dependency-floor lane on Python 3.10
  • advertise the now-tested 3.13/3.14 versions in package metadata
  • add a non-gating Python 3.15 pre-release canary
  • retain bare-install, runtime vulnerability audit and conformance checks

Merge only after the exact current head passes the expanded matrix.

Copilot AI lite review requested due to automatic review settings August 10, 2026 10:08

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Strengthens the repository’s published-library compatibility and support-signal CI by expanding the stable Python gating matrix, adding a lowest-direct dependency-floor test lane, and introducing a non-gating Python pre-release canary; it also aligns packaging metadata and Dependabot behavior with the intended support policy.

Changes:

  • Expand the gating CI matrix to Python 3.10–3.14 and disable matrix fail-fast.
  • Add a “lowest-direct” floor-dependency lane on Python 3.10 and a scheduled/non-gating Python 3.15 canary workflow.
  • Advertise tested Python 3.13/3.14 in package classifiers and make Dependabot pip updates security-only (while keeping the MCP v2 ignore).

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

File Description
pyproject.toml Adds Python 3.13/3.14 trove classifiers to match the expanded CI support signal.
.github/workflows/ci.yml Expands the gating Python matrix and adds a floor-deps lane to validate lowest-direct constraints.
.github/workflows/python-next.yml Adds a scheduled/manual non-gating Python 3.15 pre-release canary job.
.github/dependabot.yml Switches pip ecosystem updates to security-only while retaining the MCP v2 exclusion.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Comment thread .github/workflows/ci.yml Outdated
# docs/agent-context/workflows.md). Change the steps here only by changing the
# Makefile.

# Contract: this workflow runs the same gate as `make ci`.
@dgenio
dgenio merged commit 6ad416d into main Aug 10, 2026
12 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Strengthen published-library compatibility CI

2 participants