chore(deps): refresh dependencies and repair validated updates

.github/scripts/dependabot_merge.py

@@ -33,6 +33,21 @@ def eligible_commits(commits):
             return False
         types = re.findall(r"(?m)^  update-type: (\S+)\s*$", metadata[1])
         dependencies = re.findall(r"(?m)^- dependency-name: ", metadata[1])
+
+        # Requirement-only bumps omit update-type; trust only the signed,
+        # single-dependency subject with an unambiguous same-major increase.
+        if not types and len(dependencies) == 1 and "update-type:" not in metadata[1]:
+            subject = data["message"].splitlines()[0]
+            bump = re.fullmatch(
+                r"(?:[\w()/-]+: )?update (\S+) requirement from "
+                r">=(\d+\.\d+\.\d+) to >=(\d+\.\d+\.\d+)", subject,
+                re.IGNORECASE)
+            name = re.search(r"(?m)^- dependency-name: (\S+)\s*$", metadata[1])
+            if bump and name and bump[1] == name[1]:
+                before = tuple(map(int, bump[2].split(".")))
+                after = tuple(map(int, bump[3].split(".")))
+                if after > before and after[0] == before[0]:
+                    types = ["version-update:semver-minor"]
         if not types or len(types) != len(dependencies):
             return False
         if any(t not in {"version-update:semver-patch",

.github/scripts/test_dependabot_merge.py

@@ -57,6 +57,24 @@ def test_unknown_update_type(self):
             "version-update:semver-minor", "unknown")
         self.assertFalse(eligible_commits([self.commit]))
 
+
+    def test_signed_requirement_bump_without_update_type(self):
+        self.commit["commit"]["message"] = (
+            "chore: update example requirement from >=7.6.0 to >=7.7.0\n\n"
+            "---\nupdated-dependencies:\n- dependency-name: example\n"
+            "  dependency-type: direct:production\n...\n")
+        self.assertTrue(eligible_commits([self.commit]))
+        original = self.commit["commit"]["message"]
+        for old, new in [("7.7.0", "8.0.0"), ("7.7.0", "7.5.0"),
+                         ("7.7.0", "7.7.0rc1"), ("update example", "update other"),
+                         (">=7.7.0", "<8"),
+                         ("...\n", "  update-type: unknown\n...\n")]:
+            self.commit["commit"]["message"] = original.replace(old, new)
+            self.assertFalse(eligible_commits([self.commit]), new)
+        self.commit["commit"]["message"] = original
+        self.commit["commit"]["verification"]["verified"] = False
+        self.assertFalse(eligible_commits([self.commit]))
+
     def test_empty_commits(self):
         self.assertFalse(eligible_commits([]))
 

.github/workflows/ci.yml

@@ -31,13 +31,13 @@ jobs:
         python-version: ['3.9', '3.10', '3.11', '3.12', '3.13', '3.14']
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           # setuptools_scm 依赖 git 标签推导版本号，浅克隆拿不到标签
           fetch-depth: 0
           persist-credentials: false
 
-      - uses: actions/setup-python@v7
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
           python-version: ${{ matrix.python-version }}
 
@@ -70,12 +70,12 @@ jobs:
     name: 可执行文件构建检查
     runs-on: windows-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           persist-credentials: false
 
-      - uses: actions/setup-python@v7
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
           python-version: '3.13'
 
@@ -108,7 +108,7 @@ jobs:
           Stop-Process -Id $proc.Id -Force
           Write-Host 'exe 启动正常'
 
-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: Awespykit-exe
           path: dist/Awespykit.exe

.github/workflows/dependabot-auto-merge.yml

@@ -26,7 +26,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       # Only trusted default-branch code receives the write token.
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ github.event.repository.default_branch }}
           persist-credentials: false

.github/workflows/release.yml

@@ -43,13 +43,13 @@ jobs:
     outputs:
       version: ${{ steps.actual.outputs.value }}
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           # setuptools_scm 从 git 标签推导版本号，浅克隆拿不到标签
           fetch-depth: 0
           persist-credentials: false
 
-      - uses: actions/setup-python@v7
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
           python-version: '3.13'
 
@@ -114,7 +114,7 @@ jobs:
           /tmp/venv-check/bin/python -m pip install --no-deps dist-python/*.whl
           /tmp/venv-check/bin/python -c "import importlib.metadata as m; print('metadata ok:', m.version('Awespykit'))"
 
-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: python-dist
           path: dist-python/*
@@ -129,12 +129,12 @@ jobs:
     outputs:
       version: ${{ steps.actual.outputs.value }}
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           persist-credentials: false
 
-      - uses: actions/setup-python@v7
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
           # 固定版本：exe 一旦发布出去就该是可复现的，
           # 换 Python 小版本会改变打包结果与体积。
@@ -222,7 +222,7 @@ jobs:
           sha256sum Awespykit.exe > Awespykit.exe.sha256
           cat Awespykit.exe.sha256
 
-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: windows-exe
           path: |
@@ -241,10 +241,10 @@ jobs:
       contents: write
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: actions/download-artifact@v8
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           path: artifacts
       - name: 整理附件并检查版本一致