Add dependabot to monitor GitHub Actions and Python dependencies

.github/dependabot.yml

@@ -0,0 +1,25 @@
+# To get started with Dependabot version updates, you'll need to specify which
+# package ecosystems to update and where the package manifests are located.
+# Please see the documentation for all configuration options:
+# https://docs.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
+
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "monthly"
+    groups:
+      github-actions:
+        patterns:
+          - "*"
+  - package-ecosystem: "pip"
+    directory: "/"
+    schedule:
+      interval: "monthly"
+    ignore:
+      - dependency-name: "protobuf"  # see comment in requirements.txt
+    groups:
+      python:
+        patterns:
+          - "*"

.github/workflows/auto-assignment.yaml

@@ -16,8 +16,8 @@ jobs:
   welcome:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
-      - uses: actions/github-script@v6
+      - uses: actions/checkout@v4
+      - uses: actions/github-script@v7
         with:
           script: |
             const script = require('./\.github/workflows/scripts/auto-assignment.js')

.github/workflows/format.yml

@@ -12,15 +12,15 @@ jobs:
 
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
 
       - name: Get pip cache dir
         id: pip-cache
         run: |
           python -m pip install --upgrade pip setuptools
           echo "::set-output name=dir::$(pip cache dir)"
       - name: pip cache
-        uses: actions/cache@v2
+        uses: actions/cache@v3
         with:
           path: ${{ steps.pip-cache.outputs.dir }}
           key: ${{ runner.os }}-pip-${{ hashFiles('requirements.txt') }}
@@ -34,7 +34,7 @@ jobs:
 
       - name: Create Pull Request
         id: cpr
-        uses: peter-evans/create-pull-request@v4
+        uses: peter-evans/create-pull-request@v5
         with:
           commit-message: format the code
           committer: A. Unique TensorFlower <[email protected]>

.github/workflows/lint.yml

@@ -13,15 +13,15 @@ jobs:
     name: Check the code format
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
 
       - name: Get pip cache dir
         id: pip-cache
         run: |
           python -m pip install --upgrade pip setuptools
           echo "::set-output name=dir::$(pip cache dir)"
       - name: pip cache
-        uses: actions/cache@v2
+        uses: actions/cache@v3
         with:
           path: ${{ steps.pip-cache.outputs.dir }}
           key: ${{ runner.os }}-pip-${{ hashFiles('requirements.txt') }}

.github/workflows/pull_workflow.yaml

@@ -12,8 +12,8 @@ jobs:
   welcome:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
-      - uses: actions/github-script@v6
+      - uses: actions/checkout@v4
+      - uses: actions/github-script@v7
         with:
           script: |
             const script = require('./\.github/workflows/scripts/pull_workflow.js')

.github/workflows/stale-issues-pr.yml

@@ -11,7 +11,7 @@ jobs:
       pull-requests: write
     steps:
       - name: Awaiting response issues
-        uses: actions/stale@v5
+        uses: actions/stale@v9
         with:
           days-before-issue-stale: 14
           days-before-issue-close: 14
@@ -31,7 +31,7 @@ jobs:
           close-pr-message: "This PR was closed because it has been inactive for 28 days. Please reopen if you'd like to work on this further."
           repo-token: ${{ secrets.GITHUB_TOKEN }}
       - name: Contribution issues
-        uses: actions/stale@v5
+        uses: actions/stale@v9
         with:
           days-before-issue-stale: 180
           days-before-issue-close: 365

requirements.txt

@@ -2,7 +2,7 @@
 # The rest of the packages are mostly used for testing purpose.
 pandas
 pydot
-scipy ~= 1.9.2
+scipy ~= 1.11.4
 # Remove once both TensorFlow and TF-Keras nightly builds pass.
 # Temporarily enforce 3.20.3 version, as the only version which is compatible
 # with both new and old protobuf stubs. This is needed to resolve
@@ -13,7 +13,7 @@ tf-nightly
 portpicker
 pyyaml
 Pillow
-numpy ~= 1.24.3  # Sync with the numpy version used in TF
-black==22.3.0
-isort==5.10.1
-flake8==4.0.1
+numpy ~= 1.26.2  # Sync with the numpy version used in TF
+black==23.12.1
+isort==5.13.2
+flake8==6.1.0