- dependabot.yml: weekly auto-PRs for pip and github-actions deps
(major version bumps ignored, reviewed manually)
- conventional-commits.yml: blocks PRs with non-conforming titles;
warns on individual commits (required for release-please changelogs)
- scheduled-tests.yml: weekly pytest run on py3.10+3.11, plus
dependency vulnerability audit via safety
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>