[Repo Assist] ci: add Python package dependency tracking to Dependabot

[github-actions]

🤖 This is an automated PR from Repo Assist, an AI assistant for this repository.

Summary

The existing Dependabot configuration only tracked GitHub Actions version updates. This PR adds Python package (pip/Poetry) dependency tracking so that pyproject.toml dependencies are also monitored weekly for updates and security patches.

Changes

• Add pip ecosystem to .github/dependabot.yml — Dependabot supports Poetry's pyproject.toml via the pip ecosystem
• Weekly schedule matching the existing GitHub Actions schedule
• open-pull-requests-limit: 5 to avoid flooding maintainers with PRs
• Grouped updates: all Python dependency bumps are batched into a single PR using Dependabot's groups feature, reducing noise significantly

Rationale

Currently, Python dependency versions in pyproject.toml are only updated manually. This means:

• Security patches (e.g. the manually pinned nbconvert CVE fix) can slip through unnoticed
• Maintainers have to remember to audit dependencies periodically

Automating this via Dependabot ensures timely awareness of updates, especially security-relevant ones.

Trade-offs

• Dependabot will create up to one grouped PR per week if any Python packages have updates available. The open-pull-requests-limit: 5 cap prevents runaway PR creation.
• Some Poetry-specific constraints (e.g. version ranges, markers) may require manual adjustment when Dependabot proposes bumps — this is expected and each proposed PR is a suggestion, not an automatic merge.

Test Status

This change is a CI configuration file only — no code changes, no build or test steps to run. The dependabot.yml format is standard YAML validated by GitHub at submission.

---

Warning

🛡️ Protected Files

This was originally intended as a pull request, but the patch modifies protected files: .github/dependabot.yml.

These files may affect project dependencies, CI/CD pipelines, or agent behaviour. Please review the changes carefully before creating the pull request.

Click here to create the pull request once you have reviewed the changes

To route changes like this to a review issue instead of blocking, configure protected-files: fallback-to-issue in your workflow configuration.

Note

🔒 Integrity filtering filtered 40 items

Integrity filtering activated and filtered the following items during workflow execution.
This happens when a tool call accesses a resource that does not meet the required integrity or secrecy level of the workflow.

• issue:[Repo Assist] Monthly Activity 2026-03 #1403 (issue_read: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
• issue:Unable to estimate causal effect with intermediary variable? #69 (list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
• issue:ImportError: weighting_sampler is not an existing do sampler. #71 (list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
• issue:DoSampler: Fails when you Add a Graph to the Causal Model #83 (list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
• issue:Errors of Notebook: The Causal Story Behind Hotel Booking Cancellations #198 (list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
• issue:Mediation Analysis key error #214 (list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
• issue:arrays used as indices must be of integer (or boolean) type #225 (list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
• issue:How the Identification Works and About Two Outcomes #240 (list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
• issue:How to get the control group with propensity score matching? #242 (list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
• issue:Mediation analysis: how to choose mediators? #249 (list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
• issue:Placebo refuter with multiple treatments #251 (list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
• issue:Clarification in identification of estimands and estimation using backdoor.linear_regression #255 (list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
• issue:CATE: Continuous Outcome and Binary/Categorical Variables #257 (list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
• issue:Couple of questions on causal_identifier.py #264 (list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
• issue:Clarification on implications of refutation tests #285 (list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
• issue:DoWhy Logistic Regression with Stats Api  #296 (list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
• ... and 24 more items

Generated by Repo Assist · ◷

To install this agentic workflow, run

gh aw add githubnext/agentics/workflows/repo-assist.md@b897c2f3e43bde9ff7923c8fa9211055b26e27cc

[emrekiciman]

I don't think this is correct.