fix: cap config.num_retries and keep host only

.dockerignore

@@ -1,7 +1,11 @@
 .venv/
 venv/
 pr_agent/settings/.secrets.toml
+pr_agent/settings_prod/.secrets.toml
 pics/
 pr_agent.egg-info/
 build/
 **/.env
+docs/node_modules/
+docs/build/
+docs/.docusaurus/

.github/dependabot.yml

@@ -0,0 +1,113 @@
+version: 2
+
+updates:
+  # Python. `uv` rather than `pip`: it resolves through the uv CLI and rewrites
+  # pyproject.toml alongside uv.lock, so the declared pins here — which carry
+  # policy, not just versions — do not drift away from the lock file.
+  - package-ecosystem: uv
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+    open-pull-requests-limit: 5
+    groups:
+      python-minor-and-patch:
+        applies-to: version-updates
+        patterns:
+          - "*"
+        update-types:
+          - minor
+          - patch
+      python-major:
+        applies-to: version-updates
+        patterns:
+          - "*"
+        update-types:
+          - major
+    commit-message:
+      prefix: chore(deps)
+
+  # Documentation site. The Docusaurus toolchain is the repository's only Node
+  # dependency surface; without this it would sit outside security updates.
+  - package-ecosystem: npm
+    directory: /docs
+    schedule:
+      interval: weekly
+      day: monday
+    open-pull-requests-limit: 5
+    groups:
+      docs-minor-and-patch:
+        applies-to: version-updates
+        patterns:
+          - "*"
+        update-types:
+          - minor
+          - patch
+      docs-major:
+        applies-to: version-updates
+        patterns:
+          - "*"
+        update-types:
+          - major
+    commit-message:
+      prefix: chore(deps)
+
+  # GitHub Actions. Every `uses:` here is `@<sha>  # vX.Y.Z` on one line, which
+  # is the format Dependabot rewrites, comment included.
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+    open-pull-requests-limit: 5
+    groups:
+      actions-minor-and-patch:
+        applies-to: version-updates
+        patterns:
+          - "*"
+        update-types:
+          - minor
+          - patch
+      actions-major:
+        applies-to: version-updates
+        patterns:
+          - "*"
+        update-types:
+          - major
+    ignore:
+      # .github/workflows/pr-agent-review.yaml pins this action to a commit on
+      # `main`, not to a release. There is no version to bump to, and the
+      # documented behaviour for an untagged sha is to move it to whatever HEAD
+      # happens to be. Moving the self-review action is a deliberate act.
+      - dependency-name: Codium-ai/pr-agent
+    commit-message:
+      prefix: chore(ci)
+
+  # Base images. The docker file fetcher matches any file whose name contains
+  # "dockerfile", so `/` picks up Dockerfile.github_action_dockerhub and
+  # `/docker` picks up both Dockerfile and Dockerfile.lambda.
+  - package-ecosystem: docker
+    directories:
+      - /
+      - /docker
+    schedule:
+      interval: weekly
+      day: monday
+    open-pull-requests-limit: 3
+    ignore:
+      # Dockerfile.github_action_dockerhub builds FROM this project's own
+      # published image, tracked by a stage tag rather than a version.
+      - dependency-name: pragent/pr-agent
+    commit-message:
+      prefix: chore(docker)
+
+  # Hook revisions in .pre-commit-config.yaml. The `local` repo has no upstream
+  # and is left alone by the ecosystem.
+  - package-ecosystem: pre-commit
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+    open-pull-requests-limit: 3
+    commit-message:
+      prefix: chore(pre-commit)

.github/release-drafter.yml

@@ -10,30 +10,64 @@ template: |
 
 categories:
   - title: '🚀 Features'
-    labels:
-      - feature
-      - enhancement
+    when:
+      labels:
+        - feature
+        - enhancement
   - title: '🐛 Bug Fixes'
-    labels:
-      - bug
-      - 'Bug fix'
-      - 'Bug fix with tests'
+    when:
+      labels:
+        - bug
+        - 'Bug fix'
+        - 'Bug fix with tests'
   - title: '⚡ Performance'
-    labels:
-      - performance
+    when:
+      labels:
+        - performance
   - title: '📚 Documentation'
-    labels:
-      - documentation
-      - 'Includes Documentation'
+    when:
+      labels:
+        - documentation
+        - 'Includes Documentation'
   - title: '🧹 Maintenance'
-    labels:
-      - chore
-      - Refactoring
-      - Configuration
-      - 'Configuration changes'
+    when:
+      labels:
+        - chore
+        - Refactoring
+        - Configuration
+        - 'Configuration changes'
   - title: '⬆️ Dependencies'
-    labels:
-      - dependencies
+    when:
+      labels:
+        - dependencies
+  - type: version-resolver
+    semver-increment: major
+    when:
+      labels:
+        - breaking
+  - type: version-resolver
+    semver-increment: minor
+    when:
+      labels:
+        - feature
+        - enhancement
+  - type: version-resolver
+    semver-increment: patch
+    when:
+      labels:
+        - bug
+        - 'Bug fix'
+        - 'Bug fix with tests'
+        - documentation
+        - 'Includes Documentation'
+        - chore
+        - Refactoring
+        - Configuration
+        - 'Configuration changes'
+        - performance
+        - dependencies
+  - type: version-resolver
+    semver-increment: patch
 
 change-template: '- $TITLE by @$AUTHOR in #$NUMBER'
 change-title-escapes: '\<*_&'
@@ -64,26 +98,3 @@ autolabeler:
   - label: breaking
     title:
       - '/^[a-z]+(\(.+\))?!:/i'
-
-version-resolver:
-  major:
-    labels:
-      - breaking
-  minor:
-    labels:
-      - feature
-      - enhancement
-  patch:
-    labels:
-      - bug
-      - 'Bug fix'
-      - 'Bug fix with tests'
-      - documentation
-      - 'Includes Documentation'
-      - chore
-      - Refactoring
-      - Configuration
-      - 'Configuration changes'
-      - performance
-      - dependencies
-  default: patch

.github/workflows/build-and-test.yaml

@@ -8,21 +8,36 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+
 jobs:
   build-and-test:
     runs-on: ubuntu-latest
+    timeout-minutes: 30
 
     steps:
       - id: checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+
+      - id: uv
+        uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e  # v10.3.2
+        with:
+          resolution-strategy: lowest
+
+      - name: Check uv.lock
+        run: uv lock --check
+
+      - name: Test package artifacts
+        run: uv run pytest -q tests/packaging/test_help_docs_package.py
 
       - id: dockerx
         name: Setup Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f  # v3.12.0
+        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069  # v4.4.1
 
       - id: build
         name: Build dev docker
-        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8  # v6.19.2
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc  # v7.4.0
         with:
           context: .
           file: ./docker/Dockerfile
@@ -47,15 +62,15 @@ jobs:
             exit 1
           fi
       - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@75cd11691c0faa626561e295848008c8a7dddffe  # v5.5.4
+        uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5  # v7.1.1
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
 
       # Unit tests override CMD, so a broken server launcher never fails CI.
       # Smoke-start github_app (gunicorn + uvicorn) with no secrets; GET / → 200.
       - id: build-smoke
         name: Build github_app docker
-        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8  # v6.19.2
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc  # v7.4.0
         with:
           context: .
           file: ./docker/Dockerfile
@@ -82,3 +97,40 @@ jobs:
           docker logs pr-agent-smoke
           docker rm -f pr-agent-smoke
           exit 1
+
+  # The job above runs entirely inside docker/Dockerfile, whose base moved to
+  # python:3.14.7-slim in #3294. That leaves neither interpreter pyproject
+  # actually claims support for exercised there: not the `requires-python`
+  # floor of 3.12, and not the 3.13 the google-cloud-storage pin applies at.
+  # Installing from PyPI on either was an untested combination. Deliberately
+  # separate from the docker build rather than a matrix over it: the shipped
+  # images track one interpreter on purpose, and matrixing would rebuild every
+  # layer and re-run the smoke test and coverage upload for no extra signal.
+  unit-tests-native:
+    name: Unit tests (Python ${{ matrix.python-version }})
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.12", "3.13", "3.14"]
+
+    steps:
+      - id: checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+
+      # Same uv release the Dockerfile pulls from ghcr.io/astral-sh/uv, via pipx
+      # so there is no additional action to pin. uv provisions the interpreter
+      # itself, so setup-python is not needed either.
+      - id: uv
+        name: Install uv
+        run: pipx install uv==0.13.5
+
+      - id: test
+        name: Test on Python ${{ matrix.python-version }}
+        env:
+          PYTHONPATH: .
+          # See docker/Dockerfile's base stage: pin litellm's bundled cost map so
+          # a remote change to it cannot redden the suite without a version bump.
+          LITELLM_LOCAL_MODEL_COST_MAP: "True"
+        run: uv run --frozen --python ${{ matrix.python-version }} pytest -v tests/unittest

.github/workflows/codeql.yml

@@ -19,6 +19,7 @@ jobs:
   analyze:
     name: Analyze (${{ matrix.language }})
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     permissions:
       security-events: write
       packages: read
@@ -31,14 +32,14 @@ jobs:
           - language: python
             build-mode: none
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4.3.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
-      - uses: github/codeql-action/init@7fd177fa680c9881b53cdab4d346d32574c9f7f4  # v3.35.4
+      - uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370  # v4.39.1
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
           queries: security-extended,security-and-quality
 
-      - uses: github/codeql-action/analyze@7fd177fa680c9881b53cdab4d346d32574c9f7f4  # v3.35.4
+      - uses: github/codeql-action/analyze@9b3254085494b55a0f7c4c2b3d2d52cc712ce370  # v4.39.1
         with:
           category: "/language:${{ matrix.language }}"