From bef866fb6aad77403197fd732945741215addda7 Mon Sep 17 00:00:00 2001
From: Maxim Shulga <maxim.shulga@alludo.com>
Date: Sun, 2 Aug 2026 16:29:35 -0700
Subject: [PATCH] Track dependency updates with Dependabot

Add a weekly Dependabot configuration for pip, the Dockerfile base image,
and the GitHub Actions used by the publish workflow.

The Seafile AppImage is fetched by URL with a pinned checksum, which
Dependabot cannot resolve, so it stays a manual bump.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 .github/dependabot.yml | 35 +++++++++++++++++++++++++++++++++++
 IMPROVEMENTS.md        |  5 ++++-
 2 files changed, 39 insertions(+), 1 deletion(-)
 create mode 100644 .github/dependabot.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..c081fbf
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,35 @@
+version: 2
+
+updates:
+  # Python runtime dependencies pinned in requirements.txt.
+  - package-ecosystem: pip
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+    labels:
+      - dependencies
+    commit-message:
+      prefix: pip
+
+  # Base image in the Dockerfile. The Seafile AppImage is fetched by URL and
+  # checksum, so Dependabot cannot track it; bump SEAFILE_CLI_VERSION and
+  # SEAFILE_CLI_SHA256 by hand.
+  - package-ecosystem: docker
+    directory: /
+    schedule:
+      interval: weekly
+    labels:
+      - dependencies
+    commit-message:
+      prefix: docker
+
+  # Actions used by .github/workflows.
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    labels:
+      - dependencies
+    commit-message:
+      prefix: ci
diff --git a/IMPROVEMENTS.md b/IMPROVEMENTS.md
index a2602c5..9db2392 100644
--- a/IMPROVEMENTS.md
+++ b/IMPROVEMENTS.md
@@ -156,7 +156,10 @@ Acceptance criteria:
   the same manifest digest.
 - [x] Add OCI labels via `docker/metadata-action`.
 - [ ] Add an SBOM, provenance, and image signing.
-- [ ] Add dependency updates for Python, Docker, and GitHub Actions.
+- [x] Add dependency updates for Python, Docker, and GitHub Actions. A weekly
+  Dependabot configuration covers `requirements.txt`, the Dockerfile base
+  image, and the workflow actions. The Seafile AppImage is fetched by URL and
+  checksum, so it still has to be bumped by hand.
 - [ ] Run dependency and image scans on pull requests and on a schedule.
 
 Acceptance criteria: