chore: add dependabot.yml for dependency updates#73
Merged
Conversation
Patel230
added a commit
that referenced
this pull request
Jul 11, 2026
* ci: add dependabot.yml for automated dependency updates * chore: remove dependabot.yml
Patel230
added a commit
that referenced
this pull request
Jul 11, 2026
* ci: add dependabot.yml for automated dependency updates * chore: remove dependabot.yml
Patel230
added a commit
that referenced
this pull request
Jul 11, 2026
…ad re-pin (#89) * chore: add dependabot.yml for dependency updates (#73) * ci: add dependabot.yml for automated dependency updates * chore: remove dependabot.yml * chore: re-pin GrayCodeAI deps to v0.1.x release wave, untrack hawk_bin (#84) - eyrie v0.1.0 -> v0.1.3 (drops phantom tok v0.3.0 + circular hawk dep from module graph) - hawk-core-contracts v0.1.0 -> v0.1.3 - inspect v0.1.0 -> v0.1.3 (now on hawk-mcpkit v0.1.0) - sight v0.1.0 -> v0.1.2 (now on hawk-mcpkit v0.1.0) - tok v0.1.0 -> v0.1.2 - trace v0.1.0 -> v0.1.3 - yaad v0.1.0 -> v0.1.3 - untrack 17MB hawk_bin build artifact, add to .gitignore - purge stale go.sum hashes from re-cut v0.1.0 tags * feat: Hawk Cloud integration — CLI login, usage reporting, delivery context Adds fail-open, best-effort Hawk Cloud integration to the CLI agent: - internal/platform/cloud: isolated HTTP client for Hawk Cloud with device login flow (start/poll), usage event recording, and delivery context sync. All calls are best-effort and never affect local execution. - cmd/cloud.go: 'hawk cloud connect' and 'hawk cloud login' commands with interactive device authorization flow - cmd/cloud_context.go: 'hawk cloud context' command to report delivery context (repository, branch, CI run, deployment) to Hawk Cloud - cmd/exec.go: fire-and-forget usage event sent after each exec completes - ADR-0002: architecture decision record formalizing Hawk Cloud as the Hawk-specific control plane, separate from GrayCode identity layer - examples/github/hawk-delivery-context.yml: reusable GitHub Actions workflow for CI delivery context reporting * refactor(ci): tighten binary size check with ldflags, lower threshold 110MB → 80MB refactor(make): sync size-check threshold to 80MB docs: add ecosystem-remediation-plan.md for deferred complex refactors * charmbracelet: migrate from v1 to v2 Update all charmbracelet dependencies to v2 module paths: - charmbracelet/bubbles v1.0.0 -> charm.land/bubbles/v2 v2.1.0 - charmbracelet/bubbletea v1.3.10 -> charm.land/bubbletea/v2 v2.0.7 - charmbracelet/lipgloss v1.1.0 -> charm.land/lipgloss/v2 v2.0.3 Fix lipgloss v2 API: - lipgloss.AdaptiveColor -> compat.AdaptiveColor - lipgloss.Color (type) -> lipgloss.Style - lipgloss.SetHasDarkBackground -> lipgloss.AdaptiveColor{} probing Fix bubbletea v2 API: - msg.Type -> msg.Key().Code / msg.String() - tea.KeyMsg -> key.KeyMsg - tea.MouseEvent -> Mouse() method - rand.Intn -> rand.IntN - m.input.SetCursor -> m.input.SetCursorColumn Fix Go module paths for charmbracelet v2: - github.com/charmbracelet/* -> charm.land/* (where v2 exists) - Keep github.com/charmbracelet/ sub-packages where v2 not yet released Add architecture documentation and ecosystem boundary checks: - docs/architecture/ecosystem-architecture.md - docs/plans/ecosystem-architecture-remediation.md - scripts/check-internal-layer-imports.sh - scripts/check-submodule-release-parity.sh This completes the charmbracelet v2 migration documented in scripts/check-ecosystem-boundaries.sh * Update external submodule references * Update external/yaad submodule * charmbracelet v2: fix remaining API incompatibilities * chore: re-pin yaad after TUI nested-module split Move remediation docs to done for charm v2 and yaad TUI isolation, and point external/yaad + go.mod at the commit that drops Bubble Tea from the core library graph. Publish yaad before relying on GOWORK=off parity. * docs: note yaad publish prerequisite for GOWORK=off parity * fix(ci): fail closed on missing engine Gitlinks for release Disable branch-head fallback by default in checkout-eyrie, verify Gitlink pins before goreleaser, and refresh the architecture remediation checklist with source-level evidence for contracts, metering, and auth matrices. * fix(ci): gofumpt cloud config, go.sum yaad, fix release-parity gitlinks - gofumpt internal/platform/cloud/config.go - add go.sum for yaad b7ee281 so GOWORK=off builds - read Gitlinks via git ls-tree so parity works without submodule checkout * chore: re-pin engines to post-rewrite main SHAs History rewrite changed commit SHAs; update Gitlinks and go.mod so public-module CI and submodule parity resolve against current origin/main. * chore: pin engines to v0.1.4 post-rewrite releases Re-point Gitlinks and go.mod to v0.1.4 tags published after the Co-authored-by history rewrite so public-module CI and submodule parity resolve consistently.
Patel230
added a commit
that referenced
this pull request
Jul 16, 2026
* ci: add dependabot.yml for automated dependency updates * chore: remove dependabot.yml
Patel230
added a commit
that referenced
this pull request
Jul 16, 2026
…ad re-pin (#89) * chore: add dependabot.yml for dependency updates (#73) * ci: add dependabot.yml for automated dependency updates * chore: remove dependabot.yml * chore: re-pin GrayCodeAI deps to v0.1.x release wave, untrack hawk_bin (#84) - eyrie v0.1.0 -> v0.1.3 (drops phantom tok v0.3.0 + circular hawk dep from module graph) - hawk-core-contracts v0.1.0 -> v0.1.3 - inspect v0.1.0 -> v0.1.3 (now on hawk-mcpkit v0.1.0) - sight v0.1.0 -> v0.1.2 (now on hawk-mcpkit v0.1.0) - tok v0.1.0 -> v0.1.2 - trace v0.1.0 -> v0.1.3 - yaad v0.1.0 -> v0.1.3 - untrack 17MB hawk_bin build artifact, add to .gitignore - purge stale go.sum hashes from re-cut v0.1.0 tags * feat: Hawk Cloud integration — CLI login, usage reporting, delivery context Adds fail-open, best-effort Hawk Cloud integration to the CLI agent: - internal/platform/cloud: isolated HTTP client for Hawk Cloud with device login flow (start/poll), usage event recording, and delivery context sync. All calls are best-effort and never affect local execution. - cmd/cloud.go: 'hawk cloud connect' and 'hawk cloud login' commands with interactive device authorization flow - cmd/cloud_context.go: 'hawk cloud context' command to report delivery context (repository, branch, CI run, deployment) to Hawk Cloud - cmd/exec.go: fire-and-forget usage event sent after each exec completes - ADR-0002: architecture decision record formalizing Hawk Cloud as the Hawk-specific control plane, separate from GrayCode identity layer - examples/github/hawk-delivery-context.yml: reusable GitHub Actions workflow for CI delivery context reporting * refactor(ci): tighten binary size check with ldflags, lower threshold 110MB → 80MB refactor(make): sync size-check threshold to 80MB docs: add ecosystem-remediation-plan.md for deferred complex refactors * charmbracelet: migrate from v1 to v2 Update all charmbracelet dependencies to v2 module paths: - charmbracelet/bubbles v1.0.0 -> charm.land/bubbles/v2 v2.1.0 - charmbracelet/bubbletea v1.3.10 -> charm.land/bubbletea/v2 v2.0.7 - charmbracelet/lipgloss v1.1.0 -> charm.land/lipgloss/v2 v2.0.3 Fix lipgloss v2 API: - lipgloss.AdaptiveColor -> compat.AdaptiveColor - lipgloss.Color (type) -> lipgloss.Style - lipgloss.SetHasDarkBackground -> lipgloss.AdaptiveColor{} probing Fix bubbletea v2 API: - msg.Type -> msg.Key().Code / msg.String() - tea.KeyMsg -> key.KeyMsg - tea.MouseEvent -> Mouse() method - rand.Intn -> rand.IntN - m.input.SetCursor -> m.input.SetCursorColumn Fix Go module paths for charmbracelet v2: - github.com/charmbracelet/* -> charm.land/* (where v2 exists) - Keep github.com/charmbracelet/ sub-packages where v2 not yet released Add architecture documentation and ecosystem boundary checks: - docs/architecture/ecosystem-architecture.md - docs/plans/ecosystem-architecture-remediation.md - scripts/check-internal-layer-imports.sh - scripts/check-submodule-release-parity.sh This completes the charmbracelet v2 migration documented in scripts/check-ecosystem-boundaries.sh * Update external submodule references * Update external/yaad submodule * charmbracelet v2: fix remaining API incompatibilities * chore: re-pin yaad after TUI nested-module split Move remediation docs to done for charm v2 and yaad TUI isolation, and point external/yaad + go.mod at the commit that drops Bubble Tea from the core library graph. Publish yaad before relying on GOWORK=off parity. * docs: note yaad publish prerequisite for GOWORK=off parity * fix(ci): fail closed on missing engine Gitlinks for release Disable branch-head fallback by default in checkout-eyrie, verify Gitlink pins before goreleaser, and refresh the architecture remediation checklist with source-level evidence for contracts, metering, and auth matrices. * fix(ci): gofumpt cloud config, go.sum yaad, fix release-parity gitlinks - gofumpt internal/platform/cloud/config.go - add go.sum for yaad b7ee281 so GOWORK=off builds - read Gitlinks via git ls-tree so parity works without submodule checkout * chore: re-pin engines to post-rewrite main SHAs History rewrite changed commit SHAs; update Gitlinks and go.mod so public-module CI and submodule parity resolve against current origin/main. * chore: pin engines to v0.1.4 post-rewrite releases Re-point Gitlinks and go.mod to v0.1.4 tags published after the Co-authored-by history rewrite so public-module CI and submodule parity resolve consistently.
Patel230
added a commit
that referenced
this pull request
Jul 16, 2026
* ci: add dependabot.yml for automated dependency updates * chore: remove dependabot.yml
Patel230
added a commit
that referenced
this pull request
Jul 16, 2026
* ci: add dependabot.yml for automated dependency updates * chore: remove dependabot.yml
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
dependabot.ymlfor automated dependency updates (Go modules + GitHub Actions)Test plan