Improve CI automation

[Ludy87]

Motivation

• Reduce Dependabot noise and enable safe auto-merges, add pre-commit checks on PRs, and speed up CI with caching and concurrency.

Description

• Updated .github/dependabot.yml to lower open-pull-requests-limit, add dependency labels and group patterns for GitHub Actions and pip updates.
• Added labels in .github/labels.yml for dependencies, python, and github_actions to match Dependabot labeling.
• Added .github/workflows/auto-merge-dependabot.yml to auto-merge non-major Dependabot updates when safe.
• Added .github/workflows/pre-commit.yml and updated .github/workflows/pytest.yml and .github/workflows/documentation.yml to enable concurrency, add pip caching, and upload coverage artifacts per matrix job.

Testing

• Validated all GitHub YAML files with python and yaml.safe_load, which completed successfully.
• Ran pytest --cov=src/pyecotrend_ista --cov-report=xml --cov-report=term-missing tests, which produced 444 passed and wrote coverage.xml (total coverage reported ~88%).
• tox -e py311 was skipped because the container does not provide a py311 interpreter.
• tox -e pre-commit could not complete due to an environment npm error (SELF_SIGNED_CERT_IN_CHAIN) while installing the prettier pre-commit dependency.

---

Codex Task

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 87.63%. Comparing base (aba68d1) to head (4811259).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #667   +/-   ##
=======================================
  Coverage   87.63%   87.63%           
=======================================
  Files           8        8           
  Lines         833      833           
=======================================
  Hits          730      730           
  Misses        103      103           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 4811259a93

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Grant Actions permission for workflow update PRs

When the new Dependabot github-actions group opens a non-major update, the PR changes files under .github/workflows, but this job enables auto-merge with a GITHUB_TOKEN that only has contents and pull-requests permissions. The GitHub CLI auto-merge call fails in that scenario with the workflow-file permission error (same gh pr merge --auto --squash/permissions combination is documented in cli/cli#11493), so action-update PRs will never get auto-merge enabled unless this adds actions: write or excludes github-actions updates from this workflow.

Useful? React with 👍 / 👎.

[sonarqubecloud]

Quality Gate failed

Failed conditions
C Security Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE