From 60aeb949a1b6fc6f674bf34776e5b2088a5e868d Mon Sep 17 00:00:00 2001
From: Rajat Roy <135772548+ryoari@users.noreply.github.com>
Date: Mon, 2 Nov 2026 06:12:26 +1100
Subject: [PATCH] dependabot: update only the GitHub Actions; the Python lock
 is updated by hand

The pip updates changed preparation.in or pyproject.toml without the hash lock that CI
installs, so they could never be merged as they were (#232, #233).
---
 .github/dependabot.yml | 23 ++++-------------------
 1 file changed, 4 insertions(+), 19 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 8c093d0b..08dfe3da 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -1,6 +1,7 @@
-# Dependabot version updates.
-# The hash-locked environments in requirements/*.lock are pinned evidence for the published
-# run and the frozen pipeline, so they are updated by hand, never automatically.
+# Dependabot version updates, for the GitHub Actions only.
+# The Python dependencies are pinned by hash in requirements/preparation.lock, which is evidence for
+# the published run, so they are updated by hand, never automatically. A pip update here would only
+# change preparation.in or pyproject.toml and leave the lock behind (as in #232 and #233).
 version: 2
 updates:
   - package-ecosystem: "github-actions"
@@ -17,19 +18,3 @@ updates:
       prefix: "chore(deps)"
       include: "scope"
 
-  - package-ecosystem: "pip"
-    directory: "/"
-    schedule:
-      interval: "weekly"
-      day: "monday"
-      time: "09:00"
-    open-pull-requests-limit: 5
-    labels:
-      - "dependencies"
-      - "python"
-    commit-message:
-      prefix: "chore(deps)"
-      include: "scope"
-    ignore:
-      # Bit-exact recomputation of the released run depends on the exact PyTorch build.
-      - dependency-name: "torch"