Summary
Dependency maintenance costs more human attention than it should, and the repository publishes no machine-readable evidence of its own supply-chain posture.
Dependabot friction. .github/dependabot.yml runs weekly with no groups: block, so each dependency arrives as its own PR against hash-locked, cross-referenced constraint files that Dependabot's pip ecosystem does not model. Of the five open Dependabot PRs on 2026-09-02, four needed manual handling: two were superseded by a maintainer PR that raised the floors and recompiled the lock with the pinned resolver (#490), one was stale against a lock already advanced on main, one merged clean. This is the documented pattern, not an unlucky week — three distinct failure modes were catalogued when the whole queue was audited (#448 fixed the worst of them with ignore: rules).
No published posture. There is no OpenSSF Scorecard workflow and no CodeQL workflow (.github/workflows/ holds seven files, all build/verify/release). For a project whose entire pitch is deterministic supply-chain-adjacent verification, the absence of a Scorecard badge is a missed, nearly free credibility signal — and the checks it runs (pinned actions, branch protection, signed releases, dependency update tooling) are things this repository largely already does.
Proposal
1. Group the updates. Add groups: to .github/dependabot.yml so dev-dependency bumps arrive as one PR per cycle rather than five, and consider moving to a monthly interval for the dev group. One grouped PR is one lock recompilation instead of five, which is where the manual cost actually sits.
2. Document the maintainer path. The recompilation procedure — raise the floor, recompile only the affected lock, with the resolver version constraints/release-publish.in pins, then audit the diff for dropped environment markers and extras-qualified pins — belongs in CONTRIBUTING.md § Changing dependencies. It is currently reconstructed from scratch each time.
3. Add OpenSSF Scorecard, publish the badge, and record the starting score. Treat a dropping score as a defect. Evaluate CodeQL separately — it may add little over the existing ruff/pytest gates for a pure-Python package, so it is explicitly not part of this issue's acceptance.
Acceptance
Surface discipline
Repository infrastructure; no product surface. Headline metric: none directly — it reduces recurring maintenance cost for a single-maintainer project and publishes a credibility signal that costs one workflow file.
Related
#448 / #449 (the Dependabot failure-mode audit and its ignore: rules) · #490 (the most recent manual recompilation) · #500 · #494 (continuity — this procedure is one of the privately-held recipes).
Summary
Dependency maintenance costs more human attention than it should, and the repository publishes no machine-readable evidence of its own supply-chain posture.
Dependabot friction.
.github/dependabot.ymlruns weekly with nogroups:block, so each dependency arrives as its own PR against hash-locked, cross-referenced constraint files that Dependabot's pip ecosystem does not model. Of the five open Dependabot PRs on 2026-09-02, four needed manual handling: two were superseded by a maintainer PR that raised the floors and recompiled the lock with the pinned resolver (#490), one was stale against a lock already advanced onmain, one merged clean. This is the documented pattern, not an unlucky week — three distinct failure modes were catalogued when the whole queue was audited (#448 fixed the worst of them withignore:rules).No published posture. There is no OpenSSF Scorecard workflow and no CodeQL workflow (
.github/workflows/holds seven files, all build/verify/release). For a project whose entire pitch is deterministic supply-chain-adjacent verification, the absence of a Scorecard badge is a missed, nearly free credibility signal — and the checks it runs (pinned actions, branch protection, signed releases, dependency update tooling) are things this repository largely already does.Proposal
1. Group the updates. Add
groups:to.github/dependabot.ymlso dev-dependency bumps arrive as one PR per cycle rather than five, and consider moving to a monthly interval for the dev group. One grouped PR is one lock recompilation instead of five, which is where the manual cost actually sits.2. Document the maintainer path. The recompilation procedure — raise the floor, recompile only the affected lock, with the resolver version
constraints/release-publish.inpins, then audit the diff for dropped environment markers and extras-qualified pins — belongs inCONTRIBUTING.md§ Changing dependencies. It is currently reconstructed from scratch each time.3. Add OpenSSF Scorecard, publish the badge, and record the starting score. Treat a dropping score as a defect. Evaluate CodeQL separately — it may add little over the existing ruff/pytest gates for a pure-Python package, so it is explicitly not part of this issue's acceptance.
Acceptance
dependabot.ymlgroups dev-dependency updates; a subsequent cycle produces one grouped PR rather than one per package.CONTRIBUTING.mddocuments the lock-recompilation procedure, naming the pinned resolver requirement and the two diff audits.Surface discipline
Repository infrastructure; no product surface. Headline metric: none directly — it reduces recurring maintenance cost for a single-maintainer project and publishes a credibility signal that costs one workflow file.
Related
#448 / #449 (the Dependabot failure-mode audit and its
ignore:rules) · #490 (the most recent manual recompilation) · #500 · #494 (continuity — this procedure is one of the privately-held recipes).