Add GitHub Actions to Dependabot updates

.github/dependabot.yml

@@ -0,0 +1,10 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions" 
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    groups:
+      github-actions:
+        patterns:
+          - "*"

.github/workflows/_setup.yml

@@ -0,0 +1,14 @@
+# SPDX-FileCopyrightText: 2026 The RISE Project
+# SPDX-License-Identifier: MIT
+
+name: Build workflow setup
+
+on:
+  workflow_call:
+
+jobs:
+  setup:
+    if: github.event_name != 'pull_request' || github.actor != 'dependabot[bot]'
+    runs-on: ubuntu-latest
+    steps:
+      - run: true

.github/workflows/build-amazon-ion.yml

@@ -30,7 +30,11 @@ env:
   MANYLINUX_RISCV64_IMAGE: quay.io/pypa/manylinux_2_39_riscv64
 
 jobs:
+  setup:
+    uses: $/.github/workflows/_setup.yml
+
   build_wheels:
+    needs: [setup]
     name: Build amazon-ion ${{ inputs.version || '0.14.6' }} ${{ matrix.python }}-manylinux_riscv64
     runs-on: ubuntu-24.04-riscv
     timeout-minutes: 120
@@ -101,7 +105,7 @@ jobs:
 
   publish:
     name: Publish amazon-ion ${{ inputs.version || '0.14.6' }} to GitLab
-    needs: [build_wheels]
+    needs: [setup, build_wheels]
     runs-on: ubuntu-latest
     permissions:
       contents: write

.github/workflows/build-apache-tvm-ffi.yml

@@ -33,7 +33,11 @@ env:
   MANYLINUX_RISCV64_IMAGE: quay.io/pypa/manylinux_2_39_riscv64
 
 jobs:
+  setup:
+    uses: $/.github/workflows/_setup.yml
+
   build_sdist:
+    needs: [setup]
     # The sdist is architecture-independent: it just packages the source tree,
     # the vendored submodules (dlpack, libbacktrace) and a setuptools-scm-derived
     # _version.py. Build it once on x86 instead of burning a scarce riscv runner
@@ -83,7 +87,7 @@ jobs:
           if-no-files-found: error
 
   build_wheels:
-    needs: build_sdist
+    needs: [setup, build_sdist]
     name: Build apache-tvm-ffi ${{ inputs.version || '0.1.12' }} ${{ matrix.python }}-manylinux_riscv64
     runs-on: ubuntu-24.04-riscv
     permissions:
@@ -175,7 +179,7 @@ jobs:
 
   publish:
     name: Publish apache-tvm-ffi ${{ inputs.version || '0.1.12' }} to GitLab
-    needs: [build_wheels]
+    needs: [setup, build_wheels]
     runs-on: ubuntu-latest
     permissions:
       contents: write

.github/workflows/build-array-record.yml

@@ -38,7 +38,11 @@ env:
   RULES_JAVA_VERSION: '7.6.5'
 
 jobs:
+  setup:
+    uses: $/.github/workflows/_setup.yml
+
   bazel:
+    needs: [setup]
     name: Bootstrap bazel (riscv64)
     runs-on: ubuntu-24.04-riscv
     timeout-minutes: 720
@@ -107,7 +111,7 @@ jobs:
     name: Build array-record ${{ inputs.version || '0.8.3' }} ${{ matrix.tag }}-manylinux_riscv64
     runs-on: ubuntu-24.04-riscv
     timeout-minutes: 720
-    needs: [bazel]
+    needs: [setup, bazel]
 
     strategy:
       fail-fast: false
@@ -308,7 +312,7 @@ jobs:
 
   publish:
     name: Publish array-record ${{ inputs.version || '0.8.3' }} to GitLab
-    needs: [build_wheels]
+    needs: [setup, build_wheels]
     runs-on: ubuntu-latest
     permissions:
       contents: write

.github/workflows/build-arro3-core.yml

@@ -29,7 +29,11 @@ env:
   MANYLINUX_RISCV64_IMAGE: quay.io/pypa/manylinux_2_39_riscv64
 
 jobs:
+  setup:
+    uses: $/.github/workflows/_setup.yml
+
   build_wheels:
+    needs: [setup]
     name: Build arro3-core ${{ inputs.version || '0.8.1' }} ${{ matrix.tag }}-manylinux_riscv64
     runs-on: ubuntu-24.04-riscv
     timeout-minutes: 360
@@ -299,7 +303,7 @@ jobs:
 
   publish:
     name: Publish arro3-core ${{ inputs.version || '0.8.1' }} to GitLab
-    needs: [build_wheels]
+    needs: [setup, build_wheels]
     runs-on: ubuntu-latest
     permissions:
       contents: write

.github/workflows/build-astropy.yml

@@ -33,9 +33,11 @@ env:
   EXTENSION_HELPERS_PY_LIMITED_API: 'cp311'
 
 jobs:
-  # Upstream also builds musllinux_x86_64, dropped here: numpy is a build and a
-  # runtime requirement and we publish no musllinux_riscv64 numpy wheel.
+  setup:
+    uses: $/.github/workflows/_setup.yml
+
   build_wheels:
+    needs: [setup]
     name: Build astropy ${{ inputs.version || '8.0.1' }} cp311-abi3-manylinux_riscv64
     runs-on: ubuntu-24.04-riscv
     timeout-minutes: 720
@@ -98,7 +100,7 @@ jobs:
 
   publish:
     name: Publish astropy ${{ inputs.version || '8.0.1' }} to GitLab
-    needs: [build_wheels]
+    needs: [setup, build_wheels]
     runs-on: ubuntu-latest
     permissions:
       contents: write

.github/workflows/build-asyncpg.yml

@@ -28,7 +28,11 @@ env:
   MANYLINUX_RISCV64_IMAGE: quay.io/pypa/manylinux_2_39_riscv64
 
 jobs:
+  setup:
+    uses: $/.github/workflows/_setup.yml
+
   build_wheels:
+    needs: [setup]
     name: Build asyncpg ${{ inputs.version || '0.31.0' }} ${{ matrix.python }}-manylinux_riscv64
     runs-on: ubuntu-24.04-riscv
     timeout-minutes: 180
@@ -80,7 +84,7 @@ jobs:
 
   publish:
     name: Publish asyncpg ${{ inputs.version || '0.31.0' }} to GitLab
-    needs: [build_wheels]
+    needs: [setup, build_wheels]
     runs-on: ubuntu-latest
     permissions:
       contents: write

.github/workflows/build-awscrt.yml

@@ -27,7 +27,11 @@ env:
   MANYLINUX_RISCV64_IMAGE: quay.io/pypa/manylinux_2_39_riscv64
 
 jobs:
+  setup:
+    uses: $/.github/workflows/_setup.yml
+
   build_wheels:
+    needs: [setup]
     name: Build awscrt ${{ inputs.version || '0.36.2' }} ${{ matrix.wheel_tag }}-manylinux_riscv64
     runs-on: ubuntu-24.04-riscv
     timeout-minutes: 360
@@ -103,7 +107,7 @@ jobs:
 
   publish:
     name: Publish awscrt ${{ inputs.version || '0.36.2' }} to GitLab
-    needs: [build_wheels]
+    needs: [setup, build_wheels]
     runs-on: ubuntu-latest
     permissions:
       contents: write

.github/workflows/build-bcrypt.yml

@@ -33,9 +33,11 @@ env:
   ABI3_FLOOR: cp312
 
 jobs:
-  # Build the sdist ourselves from the tag (never the prebuilt PyPI sdist); it's
-  # arch-independent, so build it once on x86 (gotcha 4).
+  setup:
+    uses: $/.github/workflows/_setup.yml
+
   build_sdist:
+    needs: [setup]
     name: Build bcrypt ${{ inputs.version || '5.0.0' }} sdist
     runs-on: ubuntu-latest
     outputs:
@@ -81,7 +83,7 @@ jobs:
   # One cp312-abi3 wheel: cibuildwheel builds it once and reuses+tests it on
   # cp313/cp314 (find_compatible_wheel), so all three tags share one wheel.
   build_abi3:
-    needs: [build_sdist]
+    needs: [setup, build_sdist]
     name: Build bcrypt ${{ inputs.version || '5.0.0' }} cp312-abi3-manylinux_riscv64
     runs-on: ubuntu-24.04-riscv
     timeout-minutes: 90
@@ -121,7 +123,7 @@ jobs:
   # Free-threaded wheel: per-interpreter, no abi3 (pyo3 disables abi3 under
   # Py_GIL_DISABLED). Only cp314t - the riscv64 image has no cp313t interpreter.
   build_freethreaded:
-    needs: [build_sdist]
+    needs: [setup, build_sdist]
     name: Build bcrypt ${{ inputs.version || '5.0.0' }} cp314t-manylinux_riscv64
     runs-on: ubuntu-24.04-riscv
     timeout-minutes: 90
@@ -155,7 +157,7 @@ jobs:
 
   publish:
     name: Publish bcrypt ${{ inputs.version || '5.0.0' }} to GitLab
-    needs: [build_sdist, build_abi3, build_freethreaded]
+    needs: [setup, build_sdist, build_abi3, build_freethreaded]
     runs-on: ubuntu-latest
     permissions:
       contents: write

.github/workflows/build-biopython.yml

@@ -28,7 +28,11 @@ env:
   MANYLINUX_RISCV64_IMAGE: quay.io/pypa/manylinux_2_39_riscv64
 
 jobs:
+  setup:
+    uses: $/.github/workflows/_setup.yml
+
   build_wheels:
+    needs: [setup]
     name: Build biopython ${{ inputs.version || '1.88' }} ${{ matrix.python }}-manylinux_riscv64
     runs-on: ubuntu-24.04-riscv
     timeout-minutes: 120
@@ -92,7 +96,7 @@ jobs:
 
   publish:
     name: Publish biopython ${{ inputs.version || '1.88' }} to GitLab
-    needs: [build_wheels]
+    needs: [setup, build_wheels]
     runs-on: ubuntu-latest
     permissions:
       contents: write

.github/workflows/build-bitarray.yml

@@ -28,7 +28,11 @@ env:
   MANYLINUX_RISCV64_IMAGE: quay.io/pypa/manylinux_2_39_riscv64
 
 jobs:
+  setup:
+    uses: $/.github/workflows/_setup.yml
+
   build_wheels:
+    needs: [setup]
     name: Build bitarray ${{ inputs.version || '3.10.1' }} ${{ matrix.python }}-manylinux_riscv64
     runs-on: ubuntu-24.04-riscv
     strategy:
@@ -76,7 +80,7 @@ jobs:
 
   publish:
     name: Publish bitarray ${{ inputs.version || '3.10.1' }} to GitLab
-    needs: [build_wheels]
+    needs: [setup, build_wheels]
     runs-on: ubuntu-latest
     permissions:
       contents: write

.github/workflows/build-black.yml

@@ -35,7 +35,11 @@ env:
   MANYLINUX_RISCV64_IMAGE: quay.io/pypa/manylinux_2_39_riscv64
 
 jobs:
+  setup:
+    uses: $/.github/workflows/_setup.yml
+
   build_wheels:
+    needs: [setup]
     name: Build black ${{ inputs.version || '26.5.1' }} ${{ matrix.python }}-manylinux_riscv64
     runs-on: ubuntu-24.04-riscv
     timeout-minutes: 120
@@ -69,7 +73,7 @@ jobs:
 
   publish:
     name: Publish black ${{ inputs.version || '26.5.1' }} to GitLab
-    needs: [build_wheels]
+    needs: [setup, build_wheels]
     runs-on: ubuntu-latest
     permissions:
       contents: write

.github/workflows/build-blis.yml

@@ -28,7 +28,11 @@ env:
   MANYLINUX_RISCV64_IMAGE: quay.io/pypa/manylinux_2_39_riscv64
 
 jobs:
+  setup:
+    uses: $/.github/workflows/_setup.yml
+
   build_wheels:
+    needs: [setup]
     name: Build blis ${{ inputs.version || '1.3.3' }} ${{ matrix.python }}-manylinux_riscv64
     runs-on: ubuntu-24.04-riscv
     timeout-minutes: 360
@@ -83,7 +87,7 @@ jobs:
 
   publish:
     name: Publish blis ${{ inputs.version || '1.3.3' }} to GitLab
-    needs: [build_wheels]
+    needs: [setup, build_wheels]
     runs-on: ubuntu-latest
     permissions:
       contents: write

.github/workflows/build-bluetooth-data-tools.yml

@@ -28,7 +28,11 @@ env:
   MANYLINUX_RISCV64_IMAGE: quay.io/pypa/manylinux_2_39_riscv64
 
 jobs:
+  setup:
+    uses: $/.github/workflows/_setup.yml
+
   build_wheels:
+    needs: [setup]
     name: Build bluetooth-data-tools ${{ inputs.version || '1.29.21' }} ${{ matrix.python }}-manylinux_riscv64
     runs-on: ubuntu-24.04-riscv
     timeout-minutes: 120
@@ -83,7 +87,7 @@ jobs:
 
   publish:
     name: Publish bluetooth-data-tools ${{ inputs.version || '1.29.21' }} to GitLab
-    needs: [build_wheels]
+    needs: [setup, build_wheels]
     runs-on: ubuntu-latest
     permissions:
       contents: write

.github/workflows/build-bottleneck.yml

@@ -28,9 +28,11 @@ env:
   MANYLINUX_RISCV64_IMAGE: quay.io/pypa/manylinux_2_39_riscv64
 
 jobs:
-  # Upstream also builds musllinux, dropped here: numpy is a build and a runtime
-  # requirement and we publish no musllinux_riscv64 numpy wheel.
+  setup:
+    uses: $/.github/workflows/_setup.yml
+
   build_wheels:
+    needs: [setup]
     name: Build bottleneck ${{ inputs.version || '1.6.0' }} ${{ matrix.python }}-manylinux_riscv64
     runs-on: ubuntu-24.04-riscv
     timeout-minutes: 120
@@ -99,7 +101,7 @@ jobs:
 
   publish:
     name: Publish bottleneck ${{ inputs.version || '1.6.0' }} to GitLab
-    needs: [build_wheels]
+    needs: [setup, build_wheels]
     runs-on: ubuntu-latest
     permissions:
       contents: write

.github/workflows/build-brotli.yml

@@ -29,7 +29,11 @@ env:
   MANYLINUX_RISCV64_IMAGE: quay.io/pypa/manylinux_2_39_riscv64
 
 jobs:
+  setup:
+    uses: $/.github/workflows/_setup.yml
+
   build_wheels:
+    needs: [setup]
     name: Build brotli ${{ inputs.version || '1.2.0' }} ${{ matrix.python }}-manylinux_riscv64
     runs-on: ubuntu-24.04-riscv
     timeout-minutes: 90
@@ -71,7 +75,7 @@ jobs:
 
   publish:
     name: Publish brotli ${{ inputs.version || '1.2.0' }} to GitLab
-    needs: [build_wheels]
+    needs: [setup, build_wheels]
     runs-on: ubuntu-latest
     permissions:
       contents: write