python dependency updates should be automated

[jku]

Currently nothing updates python dependencies automatically, there should be something that at least complains when they are out-of-date...

• The dependencies are hash pinned so I'm not sure dependabot is usable for this?
• There is a make target for updating requirements/*.txt but the files need to be deleted first

[woodruffw]

• The dependencies are hash pinned so I'm not sure dependabot is usable for this?

Dependabot should be able to handle this, since PyPI (Warehouse) uses a similar hashed-requirements pattern with Dependabot.

For ref, their Dependabot config: https://github.com/pypi/warehouse/blob/main/.github/dependabot.yml

[jku]

Yes, I think you're right: I guess a .in and .txt files trigger dependabot into using pip-compile...

The remaining issue is that current code uses uv pip compile likely because it supports --prerelease=allow.

[DK96-OS]

Hello Sigstore Maintainers,

Here is an alternative to the warehouse reference: https://docs.github.com/en/code-security/dependabot/working-with-dependabot/dependabot-options-reference#dependency-type-allow

Their config uses 2 lines to include direct and indirect dependencies.

updates:
  allow:
  - dependency-type: direct
  - dependency-type: indirect

Instead, you can use:

updates:
  allow:
  - dependency-type: all