fix(ci): require reviewed Dependabot merges and refresh tooling

.coderabbit.yaml

@@ -12,6 +12,7 @@ reviews:
   high_level_summary_placeholder: '@coderabbitai summary'
   auto_title_placeholder: '@coderabbitai'
   review_status: true
+  review_progress: false
   commit_status: true
   fail_commit_status: true
   poem: true

.github/actions/setup-just/action.yml

@@ -36,6 +36,6 @@ runs:
         echo "version=$version" >> "$GITHUB_OUTPUT"
 
     - name: Install Just
-      uses: taiki-e/install-action@7572810d7dd469b651bb7793945692cf78da5dd7  # v2.85.0
+      uses: taiki-e/install-action@6a1bd70eaac3c8bdf093356838d7ee09fda951cf  # v2.85.5
       with:
         tool: just@${{ steps.resolve.outputs.version }}

.github/dependabot.yml

@@ -7,7 +7,32 @@ updates:
       interval: "weekly"
     cooldown:
       default-days: 7
+    open-pull-requests-limit: 10
     groups:
       github-actions:
         patterns:
           - "*"
+
+  - package-ecosystem: "uv"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 7
+    open-pull-requests-limit: 10
+    groups:
+      dependencies:
+        patterns:
+          - "*"
+
+  - package-ecosystem: "vcpkg"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 7
+    open-pull-requests-limit: 10
+    groups:
+      dependencies:
+        patterns:
+          - "*"

.github/workflows/codeql.yml

@@ -85,7 +85,7 @@ jobs:
         run: just codeql-prepare
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81  # v4.37.3
+        uses: github/codeql-action/init@f205ea1c3313d32999d8d6a48b4f6530d4437b38  # v4.37.4
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
@@ -99,6 +99,6 @@ jobs:
         run: just codeql-build
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81  # v4.37.3
+        uses: github/codeql-action/analyze@f205ea1c3313d32999d8d6a48b4f6530d4437b38  # v4.37.4
         with:
           category: "/language:${{ matrix.language }}"

.github/workflows/dependabot-auto-merge.yml

@@ -59,9 +59,52 @@ jobs:
             "repos/${REPOSITORY}/issues/${PR_NUMBER}/comments" \
             --raw-field body="$body"
 
-      - name: Enable auto-merge
+      - name: Wait for CodeRabbit approval
+        id: coderabbit-approval
+        timeout-minutes: 60
         env:
           GH_TOKEN: ${{ github.token }}
           PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          REPOSITORY: ${{ github.repository }}
+        run: |
+          set -euo pipefail
+
+          while true; do
+            current_head_sha="$(
+              gh api "repos/${REPOSITORY}/pulls/${PR_NUMBER}" --jq '.head.sha'
+            )"
+            if [[ "$current_head_sha" != "$PR_HEAD_SHA" ]]; then
+              echo "::error::PR head changed while waiting for CodeRabbit approval."
+              exit 1
+            fi
+
+            review_state="$(
+              gh api --paginate \
+                "repos/${REPOSITORY}/pulls/${PR_NUMBER}/reviews?per_page=100" |
+                jq --raw-output --slurp --arg sha "$PR_HEAD_SHA" '[.[][] | select(
+                  .user.login == "coderabbitai[bot]" and
+                  .commit_id == $sha
+                )] | last | .state // empty'
+            )"
+            if [[ "$review_state" == "APPROVED" ]]; then
+              echo "approved_head_sha=${PR_HEAD_SHA}" >> "$GITHUB_OUTPUT"
+              break
+            fi
+
+            sleep 15
+          done
+
+      - name: Wait for required checks
+        timeout-minutes: 60
+        env:
+          GH_TOKEN: ${{ github.token }}
+          PR_URL: ${{ github.event.pull_request.html_url }}
+        run: gh pr checks --required --watch --fail-fast "$PR_URL"
+
+      - name: Squash approved PR head
+        env:
+          APPROVED_HEAD_SHA: ${{ steps.coderabbit-approval.outputs.approved_head_sha }}
+          GH_TOKEN: ${{ github.token }}
           PR_URL: ${{ github.event.pull_request.html_url }}
-        run: gh pr merge --auto --squash --match-head-commit "$PR_HEAD_SHA" "$PR_URL"
+        run: gh pr merge --squash --match-head-commit "$APPROVED_HEAD_SHA" "$PR_URL"

Justfile

@@ -5,14 +5,14 @@ set minimum-version := "1.57.0"
 set shell := ["bash", "-euo", "pipefail", "-c"]
 
 just_version := "1.57.0"
-uv_version := "0.11.32"
+uv_version := "0.12.0"
 git_cliff_version := "2.13.1"
 actionlint_version := "1.7.12"
-pinact_version := "4.1.0"
+pinact_version := "4.1.1"
 pinact_module := "github.com/suzuki-shunsuke/pinact/v4/cmd/pinact@v" + pinact_version
 llvm_version := "22"
 cmake_minimum_version := "4.4.0"
-cmake_version := "4.4.0"
+cmake_version := "4.4.1"
 ninja_version := "1.13.2"
 ninja_windows_wheel_version := "1.13.0"
 ccache_version := "4.13.6"

README.md

@@ -320,11 +320,11 @@ example:
 
 ```bash
 just python-sync
-pkgx +just.systems@1.57.0 +git-scm.org +cmake.org@4.4.0 +ninja-build.org +python.org just check
+pkgx +just.systems@1.57.0 +git-scm.org +cmake.org@4.4.1 +ninja-build.org +python.org just check
 ```
 
 All configure paths require CMake 4.4.0 or newer. The Justfile owns the tested
-4.4.0 toolchain pin: pkgx-backed recipes remain reproducible at that version,
+4.4.1 toolchain pin: pkgx-backed recipes remain reproducible at that version,
 while direct configure paths accept newer compatible CMake releases. CI is
 pkgx-first; because pkgx does not currently publish its CMake and Ninja packages
 for Windows, that job uses the exact Justfile pins available as PyPI wheels
@@ -376,7 +376,7 @@ followed by the `reference-smoke` test preset; products and tests are isolated u
 `scripts\fast-build.bat` configures the same reference tree and builds only the primary `cdt` target. All entry points
 preserve a compatible CMake cache and refresh it only when the selected vcpkg toolchain path changes. Direct script
 invocations must expose CMake 4.4.0 or newer on `PATH`; the canonical pkgx-backed `just` recipes select the tested
-4.4.0 toolchain automatically.
+4.4.1 toolchain automatically.
 
 ### Project Layout
 

pyproject.toml

@@ -13,7 +13,7 @@ cdt-optimize-initialize = "scripts.optimize_initialize:main"
 cdt-tag-release = "scripts.tag_release:main"
 
 [build-system]
-requires = ["uv_build>=0.11.29,<0.12"]
+requires = ["uv_build>=0.12.1,<0.13"]
 build-backend = "uv_build"
 
 [tool.uv]
@@ -51,9 +51,9 @@ dev = [
   "clang-format==22.1.8",
   "jsonschema==4.25.1",
   "pyyaml==6.0.3",
-  "ruff==0.16.0",
-  "semgrep==1.171.0",
-  "ty==0.0.63",
+  "ruff==0.16.1",
+  "semgrep==1.172.0",
+  "ty==0.0.65",
   "yamllint==1.38.0",
 ]
 experiments = [

scripts/slurm.sh

@@ -9,7 +9,7 @@ script_dir="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
 repo_root="$(cd -- "${script_dir}/.." && pwd)"
 build_dir="${repo_root}/build"
 
-module load cmake/4.4.0
+module load cmake/4.4.1
 module load gcc/13.3.0
 module load autoconf-archive/2022.02.11
 rm -rf -- "${build_dir}"