chore: fix Dependabot version-bump gate and stop tightening squawk-cli

[stephen-kintsugi]

Summary

Follow-ups surfaced by the first Dependabot PRs (#12, #13):

• Exempt Dependabot from the version-bump gate (ci.yml): the "version must differ from main" check fails on any Dependabot pip PR, because Dependabot edits pyproject.toml (dependency constraints) but never bumps the package version. Skipped for dependabot[bot]; dependency changes roll into the next release.
• Stop tightening squawk-cli (dependabot.yml): versioning-strategy: increase was raising the intentional >=2.0 floor (e.g. to >=2.61.0), which would force consumers off their own additional_dependencies pins. Now ignored.

Also created the missing dependencies label so Dependabot can apply it.

Notes

• After this merges, Dependabot re-runs and chore(deps): bump the python-packages group with 6 updates #13 comes back clean (no squawk-cli bump, gate passes).

---

Note

Low Risk
Workflow and Dependabot config only; no runtime package or security logic changes.

Overview
Fixes CI and Dependabot behavior so dependency-only bot PRs can pass without manual version bumps or unwanted constraint changes.

CI still requires pyproject.toml and __init__.py versions to match, but the “version must differ from main” step now runs only when the PR author is not dependabot[bot] (using pull_request.user.login, not github.actor, so Update-branch pushes don’t accidentally re-apply the gate).

Dependabot adds an explicit ignore for squawk-cli so versioning-strategy: increase won’t tighten the intentional broad >=2.0 floor that lets hook consumers pin via additional_dependencies.

^{Reviewed by Cursor Bugbot for commit 769aff3. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 1c6845a. Configure here.}

[cursor]

PR Risk Assessment

Risk level: Very Low
Review required: No
Reviewers assigned: None (jaykintsugi already requested via CODEOWNERS; no additional assignment needed)
Action taken: Approved

Rationale: The diff only touches .github/dependabot.yml (ignore squawk-cli so Dependabot does not tighten the intentional >=2.0 floor) and .github/workflows/ci.yml (exempt dependabot[bot] PRs from the version-bump gate, keyed on pull_request.user.login rather than github.actor). No production/runtime code paths change; blast radius is limited to CI gating and Dependabot behavior in this repo, and both edits are trivially reversible.

No production code changes — test coverage gate does not apply.

Re-evaluated after the follow-up commit fixing the Dependabot exemption to use PR author instead of github.actor; incremental change is a correctness fix with no material risk increase.

---

risk_level: Very Low
review_required: false
reviewers: []
action_taken: approved
rationale: CI workflow and Dependabot config only (.github/workflows/ci.yml, .github/dependabot.yml); exempts bot PRs from version-bump gate and stops squawk-cli constraint tightening — no production code or runtime behavior change.

  

_{Sent by Cursor Automation: Assign PR reviewers & Assess Risk & Approve if Safe}