From 7e43837527d3f33498466bda8f96bd127f4b336c Mon Sep 17 00:00:00 2001
From: Maximilian Roos <5635139+max-sixty@users.noreply.github.com>
Date: Sun, 13 Sep 2026 23:28:35 -0700
Subject: [PATCH] Keep composite action pins current (#4101)

Dependabot only scanned workflow action references, so setup-uv in the
Tend composite setup action lagged behind. This aligns setup-uv at
v10.1.0 and extends the existing daily GitHub Actions update to every
composite action directory.

> _This was written by Codex on behalf of @max-sixty_
---
 .github/actions/tend-setup/action.yaml | 2 +-
 .github/dependabot.yaml                | 4 +++-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/.github/actions/tend-setup/action.yaml b/.github/actions/tend-setup/action.yaml
index b9d466ce1..507e8269d 100644
--- a/.github/actions/tend-setup/action.yaml
+++ b/.github/actions/tend-setup/action.yaml
@@ -55,7 +55,7 @@ runs:
         done
 
     - name: Install uv
-      uses: astral-sh/setup-uv@v7.6.0
+      uses: astral-sh/setup-uv@v10.1.0
       with:
         cache-dependency-glob: .pre-commit-config.yaml
 
diff --git a/.github/dependabot.yaml b/.github/dependabot.yaml
index 3a91b71c8..a55df5c50 100644
--- a/.github/dependabot.yaml
+++ b/.github/dependabot.yaml
@@ -15,7 +15,9 @@ updates:
     labels: []
 
   - package-ecosystem: "github-actions"
-    directory: "/"
+    directories:
+      - "/"
+      - "/.github/actions/*"
     commit-message:
       prefix: "chore: "
     schedule: