Watch this repo's dependencies — it was the only one with nothing - #6
Merged
Conversation
The other four Sentinel repos were wired up to Dependabot on 2026-09-09 and this one was missed. The cost was visible: actions/checkout sat on v5 here while every sibling had moved to v7, with nothing to say so. GitHub Actions only. The integration declares "requirements": [] — it reaches Command Center through Home Assistant's own aiohttp session and pulls in no third-party Python packages — so there is no pip manifest to watch. Dependabot cannot read manifest.json, so adding a requirements.txt purely to give it something to track would mean watching a file nothing installs. No auto-merge workflow, following CameraNode's reasoning rather than the services': this code runs inside someone else's Home Assistant, so a bump that breaks it breaks their install rather than a deploy we can roll back. Also bumps actions/checkout v5 -> v7 to match the rest of the fleet. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Part of finding 13 from the 2026-09-12 system review.
The other four Sentinel repos were wired up to Dependabot on 2026-09-09 and
this one was missed. The cost was already visible:
actions/checkoutsat onv5 here while every sibling had moved to v7, and nothing existed to
say so.
What's watched
GitHub Actions only. The integration declares
"requirements": []— itreaches Command Center through Home Assistant's own
aiohttpsession andpulls in no third-party Python packages of its own, so there is no pip
manifest here to watch.
Worth recording because it's a trap: Dependabot cannot read
manifest.json. Adding arequirements.txtpurely to give it something totrack would mean watching a file nothing installs.
No auto-merge workflow
Following CameraNode's reasoning rather than the services'. This code runs
inside someone else's Home Assistant box, so a bump that breaks it breaks
their install — not a deployment we can roll back. These get looked at.
Also bumps
actions/checkoutv5 → v7 to match the rest of the fleet.Still open from finding 13: this repo has no tags or releases at all,
while
manifest.jsondeclares"version": "0.1.1". HACS installs fromreleases, so that version currently corresponds to nothing. Tagging it is a
publish event, so I left it for you rather than cutting a release
unprompted.
🤖 Generated with Claude Code