Files
watermarks-remover/.github/dependabot.yml
T
Guillaume Meyer (The Opinionated Man) bd1dd6016c feat: split skill from service, add HTTP API and Docker distribution
The agent skill (skills/remove-ai-marks/) is now a code-free remote client:
all implementation moved to service/scripts/ and runs behind a stdlib HTTP
service (server.py) with /health, /capabilities, /inspect, /clean and a
dynamically generated OpenAPI 3.0.3 spec at /openapi.json.

- Move scripts/ and the backend Dockerfiles under service/
- server.py: JSON/base64 HTTP entrypoint with size caps, binary guard,
  atomic writes, loopback default, optional bearer auth
- Core Dockerfile (exiftool/qpdf/c2patool preinstalled) and a GHCR publish
  workflow for the core/markllm/markdiffusion images
- compose.yaml (wr-* services, harness/heavy profiles) + compose-check.sh
  to validate the running stack (exit code only)
- Fix markllm image build (tokenizers 0.22.2, CPU-only torch) and ctrlregen
  build (python:3.11 base for the 2023-era research pins)
- Fix markllm/markdiffusion harness images missing common.py at runtime
2026-08-14 14:29:31 -07:00

42 lines
1.4 KiB
YAML

# Dependabot configuration (https://docs.github.com/code-security/dependabot)
version: 2
updates:
# GitHub Actions: keeps the SHA pins in .github/workflows/ fresh. All action
# references are SHA-pinned, so dependabot is the mechanism that rotates them
# when upstream releases new versions.
- package-ecosystem: "github-actions"
directory: "/"
schedule:
interval: "weekly"
day: "monday"
open-pull-requests-limit: 5
# Root dev/test dependencies (requirements-dev.txt: pytest, pip-audit).
- package-ecosystem: "pip"
directory: "/"
schedule:
interval: "weekly"
day: "monday"
open-pull-requests-limit: 10
# Optional reverse-SynthID scorer dependencies. NOTE: these pins are
# compatibility-coupled to the upstream checkout pinned in
# setup_synthid.sh / Dockerfile.synthid (REVERSE_SYNTHID_REF). Before merging
# a bump, re-verify the scorer against that upstream commit — CI's pip-audit
# step will flag any security regression, but functional compatibility must
# be checked by a human.
- package-ecosystem: "pip"
directory: "/service/scripts"
schedule:
interval: "weekly"
day: "monday"
open-pull-requests-limit: 10
# Docker base image (Dockerfile.synthid): tracks the digest-pinned
# python:3.11-slim base. Monthly — digest churn is low-signal weekly.
- package-ecosystem: "docker"
directory: "/"
schedule:
interval: "monthly"
open-pull-requests-limit: 5