fix(ci): make dependabot.yml parse by dropping versioning-strategy widen for pip

.github/dependabot.yml

@@ -5,11 +5,13 @@
 # `tools/check_pip_audit.py` and the nightly CVE job catch known advisories, and
 # these pull requests make a fix reachable.
 #
-# `versioning-strategy: widen` matters here. ForgeLM declares bounded ranges
-# (`>=floor,<next-major`) with no lockfile and no pins, so Dependabot's default
-# `increase` strategy would try to raise a floor the ceiling already covers — a
-# no-op — instead of admitting a new major. `widen` keeps the declared floor and
-# raises the ceiling, which is the change the ranges actually need.
+# No `versioning-strategy` is set for `pip`. The `pip` ecosystem accepts only `auto`,
+# `increase`, `increase-if-necessary` and `lockfile-only`; a previous `widen` is not
+# among them, GitHub rejected the whole file ("did not match one of the following
+# values"), and while it did not parse Dependabot opened nothing. ForgeLM declares
+# bounded ranges (`>=floor,<next-major`) with no lockfile, so the default (`auto`) may
+# raise a floor the ceiling already covers instead of admitting a new major; look at the
+# first pull requests and tighten this then.
 #
 # `ruff`, `mypy` and `bandit` are ignored on purpose. They are blocking CI gates
 # and `tests/test_packaging.py` requires their `[dev]` range to equal the one
@@ -25,7 +27,6 @@ updates:
       interval: "weekly"
       day: "monday"
     open-pull-requests-limit: 5
-    versioning-strategy: "widen"
     labels:
       - "dependencies"
       - "area: packaging-ci"

CHANGELOG.md

@@ -87,6 +87,9 @@ All notable changes to ForgeLM are documented here.
 
 ### Fixed
 
+- Make `.github/dependabot.yml` parse. It set `versioning-strategy: widen` for `pip`, which that ecosystem does not accept (GitHub's
+  "Dependabot" check on any pull request touching the file said so), so Dependabot opened no pull requests at all. The setting is removed, the
+  header comment explains the restriction.
 - Stop saying that Microsoft Teams and Discord accept the webhook payload directly. The user manual (English and Turkish) and the
   `webhook` field descriptions said all three ingest it; the body is a Slack-style `attachments` block with no top-level `text`,
   `content` or `embeds`. Discord needs `content` or `embeds` and answers HTTP 400; Teams retired Office 365 Connectors in May 2026 and

tests/test_packaging.py

@@ -244,6 +244,29 @@ def test_setuptools_security_floor_meets_pysec_2026_3447() -> None:
     )
 
 
+def test_dependabot_config_uses_only_values_the_pip_ecosystem_accepts() -> None:
+    """GitHub rejects the whole ``dependabot.yml`` for one bad value, and Dependabot then opens nothing.
+
+    ``versioning-strategy: widen`` is valid for npm and Composer but not for ``pip``; the file shipped with it and
+    the "Dependabot" check on every pull request that touched the file said so while the weekly run silently never
+    happened.  The accepted values are listed in GitHub's error message.
+    """
+    import yaml
+
+    config = yaml.safe_load(
+        (Path(__file__).resolve().parents[1] / ".github" / "dependabot.yml").read_text(encoding="utf-8")
+    )
+    accepted = {"auto", "increase", "increase-if-necessary", "lockfile-only"}
+    for update in config["updates"]:
+        if update["package-ecosystem"] != "pip":
+            continue
+        strategy = update.get("versioning-strategy")
+        assert strategy is None or strategy in accepted, (
+            f"versioning-strategy {strategy!r} is not accepted for the pip ecosystem ({sorted(accepted)})"
+        )
+    assert any(u["package-ecosystem"] == "pip" for u in config["updates"]), "the pip update block is gone"
+
+
 def _load_runtime_dependencies() -> list:
     try:
         import tomllib  # type: ignore[import-not-found]