ci: align the release pipeline and dependabot with the org standard (#2)

Brings the repo in line with the org standard (pg-partsmith as the reference), after today's redis-client-kit release uploaded a stale wheel.

- dependabot: `uv` + `github-actions`, one grouped PR a week each — the `pip` ecosystem never updated `uv.lock`
- `actions/checkout@v7` in the generated workflows
- Publish: `uv publish --check-url`, so a re-run after a failure skips what is already on the index instead of failing on it

CI-only, no behaviour change in the package; no release is cut by this.

Author: AlexeyShalaev

template/.github/dependabot.yml

@@ -1,18 +1,22 @@
+# The actions the workflows run and the lock file are the two things that move
+# under this project without a commit of their own; each gets one grouped pull
+# request a week. uv, not pip: the pip ecosystem never updates uv.lock.
 version: 2
 updates:
-  - package-ecosystem: "pip"
-    directory: "/"
+  - package-ecosystem: github-actions
+    directory: /
     schedule:
-      interval: "weekly"
-      day: "monday"
+      interval: weekly
+      day: monday
     groups:
-      dev-dependencies:
-        dependency-type: "development"
-    open-pull-requests-limit: 5
+      actions:
+        patterns: ["*"]
 
-  - package-ecosystem: "github-actions"
-    directory: "/"
+  - package-ecosystem: uv
+    directory: /
     schedule:
-      interval: "weekly"
-      day: "monday"
-    open-pull-requests-limit: 5
+      interval: weekly
+      day: monday
+    groups:
+      dev:
+        dependency-type: development

template/.github/workflows/ci.yml.jinja

@@ -11,7 +11,7 @@ jobs:
     name: Lint & type check
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: astral-sh/setup-uv@v7
       - run: uv sync --group dev --all-extras
       - run: uv run ruff check
@@ -27,7 +27,7 @@ jobs:
       matrix:
         python-version: ["{{ python_min_version }}", "3.12", "3.13"]
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: astral-sh/setup-uv@v7
         with:
           python-version: ${% raw %}{{ matrix.python-version }}{% endraw %}
@@ -45,7 +45,7 @@ jobs:
     needs: lint
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: astral-sh/setup-uv@v7
       - run: uv sync --group dev --all-extras
       - name: Run integration tests

template/.github/workflows/docs.yml

@@ -13,7 +13,7 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: astral-sh/setup-uv@v7
       - run: uv sync --no-dev --group docs
       - run: cp CHANGELOG.md docs/changelog.md

template/.github/workflows/publish.yml.jinja

@@ -25,7 +25,7 @@ jobs:
     outputs:
       tag: ${% raw %}{{ steps.tag.outputs.tag }}{% endraw %}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           ref: ${% raw %}{{ github.event_name == 'workflow_dispatch' && inputs.tag || github.event.workflow_run.head_sha }}{% endraw %}
           fetch-tags: true
@@ -55,7 +55,7 @@ jobs:
     runs-on: ubuntu-latest
     environment: pypi
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           ref: ${% raw %}{{ needs.check.outputs.tag }}{% endraw %}
 
@@ -69,4 +69,6 @@ jobs:
           echo "__version__ = \"$VERSION\"  # x-release-please-version" > {{ package_name }}/__version__.py
 
       - run: uv build
-      - run: uv publish
+      # --check-url: a run repeated after a failure skips what is already on the
+      # index instead of failing on it.
+      - run: uv publish --check-url https://pypi.org/simple/{{ project_slug }}/