chore(dependabot): cap open pull requests per ecosystem

[hyperpolymath]

Adds open-pull-requests-limit to the Dependabot blocks in this repository
that did not have one.

Why. Without an explicit limit, Dependabot defaults to 5 open PRs per
ecosystem. Across the estate that produced a large, permanently-refreshing
backlog that costs more to triage than the updates are worth. An estate-wide
audit found 3,024 uncapped blocks across 1,429 config files.

The cap applied here follows the per-ecosystem doctrine already recorded in
rsr-template-repo, not a single flat number: github-actions 2, cargo 0,
mix/npm/pip 3.

How this commit was built. The change was made with git plumbing against
origin/<default branch>, not by staging a working tree. The branch therefore
contains exactly one commit touching exactly one file, and carries none of the
unrelated local state present in this checkout. A per-repository assertion
required git diff --name-only <base> <commit> to equal the expected path set
exactly, or the branch was never created.

Repositories whose HEAD already differed from the base on this file were
skipped, not overwritten, so no unpushed local work is discarded or
silently folded into this PR.

This PR is opened as a draft on purpose. It is part of a bulk campaign and
is not requesting a merge. Review and merge at your discretion.

🤖 Generated with Claude Code

https://claude.ai/code/session_011eQ7hibx92N7fBDtwgReWk

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 167ea787-e65a-4475-81f5-bf4fc0045864

📥 Commits

Reviewing files that changed from the base of the PR and between 8a05fd6 and 07c8be5.

📒 Files selected for processing (1)

• .github/dependabot.yml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details

⏰ Context from checks skipped due to timeout. (32)

• GitHub Check: hypatia / Hypatia Neurosymbolic Analysis
• GitHub Check: rust-ci / Detect Cargo.toml
• GitHub Check: governance / Check Workflow Staleness
• GitHub Check: governance / Licence consistency
• GitHub Check: governance / Trusted-base reduction policy
• GitHub Check: governance / Language / package anti-pattern policy
• GitHub Check: governance / Guix primary / Nix fallback policy
• GitHub Check: governance / Well-Known (RFC 9116 + RSR)
• GitHub Check: governance / Security policy checks
• GitHub Check: governance / Workflow security linter
• GitHub Check: scan / gitleaks
• GitHub Check: scan / rust-secrets
• GitHub Check: governance / Code quality + docs
• GitHub Check: scan / shell-secrets
• GitHub Check: analyze (actions, none)
• GitHub Check: recompute-wasm — clippy / tests
• GitHub Check: vcltotal-parse — panic-free / clippy / tests
• GitHub Check: Hypatia neurosymbolic scan
• GitHub Check: attest — clippy / tests
• GitHub Check: idris2 0.8.0 --build vclut-core
• GitHub Check: openssf-compliance
• GitHub Check: E2E structural validation
• GitHub Check: Root workspace tests
• GitHub Check: panic-attack assail
• GitHub Check: reuse-lint
• GitHub Check: Validate A2ML manifests
• GitHub Check: Empty-linter (invisible characters)
• GitHub Check: Derive matrix from echidna provers.a2ml
• GitHub Check: Aspect tests
• GitHub Check: Groove manifest check
• GitHub Check: Validate eclexiaiser manifest
• GitHub Check: Validate K9 contracts

⚠️ CI failures not shown inline (2)

GitHub Actions: REUSE compliance / 0_reuse-lint.txt: chore(dependabot): cap open pull requests per update block

Conclusion: failure

View job details

##[group]Run reuse lint
 �[36;1mreuse lint�[0m
 shell: /usr/bin/bash -e {0}
 ##[endgroup]
 # UNUSED LICENSES
 The following licenses are not used:
 * AGPL-3.0-or-later
 # MISSING COPYRIGHT AND LICENSING INFORMATION
 The following files have no copyright and licensing information:
 * MAINTAINERS
 * mise.toml
 The following files have no copyright information:
 * guix.scm
 # SUMMARY
 * Bad licenses: 0
 * Deprecated licenses: 0
 * Licenses without file extension: 0
 * Missing licenses: 0
 * Unused licenses: AGPL-3.0-or-later
 * Used licenses: CC-BY-SA-4.0, MPL-2.0
 * Read errors: 0
 * Invalid SPDX License Expressions: 0
 * Files with copyright information: 469 / 472
 * Files with license information: 470 / 472
 Unfortunately, your project is not compliant with version 3.3 of the REUSE Specification :-(
 # RECOMMENDATIONS
 * Fix unused licenses: At least one of the license text files in 'LICENSES' is
   not referenced by any file, e.g. by an 'SPDX-License-Identifier' tag. Please
   make sure that you either tag the accordingly licensed files properly, or
   delete the unused license text if you are sure that no file or code snippet is
   licensed as such.
 * Fix missing copyright/licensing information: For one or more files, the tool
   cannot find copyright and/or licensing information. You typically do this by
   adding 'SPDX-FileCopyrightText' and 'SPDX-License-Identifier' tags to each
   file. The tutorial explains additional ways to do this:
   <https://reuse.software/tutorial/>
 ##[error]Process completed with exit code 1.

---

GitHub Actions: REUSE compliance / reuse-lint: chore(dependabot): cap open pull requests per update block

Conclusion: failure

View job details

##[group]Run reuse lint
 �[36;1mreuse lint�[0m
 shell: /usr/bin/bash -e {0}
 ##[endgroup]
 # UNUSED LICENSES
 The following licenses are not used:
 * AGPL-3.0-or-later
 # MISSING COPYRIGHT AND LICENSING INFORMATION
 The following files have no copyright and licensing information:
 * MAINTAINERS
 * mise.toml
 The following files have no copyright information:
 * guix.scm
 # SUMMARY
 * Bad licenses: 0
 * Deprecated licenses: 0
 * Licenses without file extension: 0
 * Missing licenses: 0
 * Unused licenses: AGPL-3.0-or-later
 * Used licenses: CC-BY-SA-4.0, MPL-2.0
 * Read errors: 0
 * Invalid SPDX License Expressions: 0
 * Files with copyright information: 469 / 472
 * Files with license information: 470 / 472
 Unfortunately, your project is not compliant with version 3.3 of the REUSE Specification :-(
 # RECOMMENDATIONS
 * Fix unused licenses: At least one of the license text files in 'LICENSES' is
   not referenced by any file, e.g. by an 'SPDX-License-Identifier' tag. Please
   make sure that you either tag the accordingly licensed files properly, or
   delete the unused license text if you are sure that no file or code snippet is
   licensed as such.
 * Fix missing copyright/licensing information: For one or more files, the tool
   cannot find copyright and/or licensing information. You typically do this by
   adding 'SPDX-FileCopyrightText' and 'SPDX-License-Identifier' tags to each
   file. The tutorial explains additional ways to do this:
   <https://reuse.software/tutorial/>
 ##[error]Process completed with exit code 1.

🔇 Additional comments (1)

.github/dependabot.yml (1)

40-40: LGTM!

---

📝 Summary

Summary by CodeRabbit

• Chores
  • Limited the number of concurrently open automated dependency update pull requests to two.

Walkthrough

The Dependabot configuration now limits the GitHub Actions ecosystem to two open pull requests.

Changes

Dependabot configuration

Layer / File(s)	Summary
Configure pull request limit .github/dependabot.yml	Sets open-pull-requests-limit to 2 for GitHub Actions updates.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk: ⚪ Minimal · up to 07c8b

GitHub Actions Dependabot updates are capped at two concurrent pull requests as intended. No current merge-readiness risk is identified.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description explains the purpose, scope, policy, and implementation details. However, it does not use the required Summary, Changes, RSR Quality Checklist, Testing, or Screenshots sections, and it…	Restructure the description using the repository template. Add the required headings, list the file change under Changes, complete the RSR Quality Checklist, describe testing under Testing, and state whether Screenshots are applicable.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly and concisely describes the main change: limiting Dependabot pull requests per ecosystem.

Full details: Description check

Explanation

The description explains the purpose, scope, policy, and implementation details. However, it does not use the required Summary, Changes, RSR Quality Checklist, Testing, or Screenshots sections, and it does not document test or checklist status.

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit checks the workflow queue
Two bright update hops will do
No crowded burrows, neat and light
Dependabot keeps the queue right
Ears up for the next pull request}

_{Comment @coderabbitai help to get the list of available commands.}