ci: path-patch freemkv-unlock; dependabot ignores org workflow refs

libfreemkv now deps freemkv-unlock by version with a git-tag override, so every root that reaches it patches it. Dependabot config unified; it no longer proposes freemkv/.github v1->v2.

.github/dependabot.yml

@@ -2,10 +2,11 @@ version: 2
 
 # Dependency updates land on `dev`, never on `main`.
 #
-# `main` here is a RELEASE POINTER that release.sh moves to each tag. A bot
+# `main` here is a RELEASE POINTER that freemkv's release-orchestrate.yml
-# commit on it would put work there that no tag contains, which is exactly the
+# moves to each tag. A bot commit on it would put work there that no tag
-# state that aborted the 1.6.2 cascade at the last step -- so pointing
+# contains, which is exactly the state that aborted the 1.6.2 cascade at the
-# Dependabot at main would recreate that failure on a schedule.
+# last step -- so pointing Dependabot at main would recreate that failure on a
+# schedule.
 updates:
   - package-ecosystem: cargo
     directory: /
@@ -13,9 +14,7 @@ updates:
     schedule:
       interval: weekly
     open-pull-requests-limit: 5
-    # One PR per week for the routine bumps instead of one per crate. Eight
+    # One PR per week for the routine bumps instead of one per crate.
-    # repos times a handful of crates is a volume nobody reads, and an
-    # unread PR queue is indistinguishable from no updates at all.
     groups:
       minor-and-patch:
         update-types:
@@ -23,18 +22,14 @@ updates:
           - patch
     ignore:
       # The freemkv crates depend on each other by GIT TAG, re-pinned by
-      # release.sh as part of the release commit. Dependabot cannot see that
+      # release-orchestrate.yml in the release commit. A bot bump would fight
-      # cascade, so a PR bumping one of these would fight the release process
+      # the release cascade and could pin a tag that does not exist yet.
-      # and could pin a version whose tag does not exist yet.
       - dependency-name: freemkv-unlock
       - dependency-name: libfreemkv
       - dependency-name: freemkv-keysources
       - dependency-name: freemkv-i18n
       - dependency-name: freemkv-engine
 
-  # The workflows are now real infrastructure -- the release cascade, the
-  # cross-platform hash matrix, the disc gate -- so their actions need the same
-  # attention as the crates.
   - package-ecosystem: github-actions
     directory: /
     target-branch: dev
@@ -47,17 +42,11 @@ updates:
           - minor
           - patch
     ignore:
-      # NOT a dependency: `dtolnay/rust-toolchain` is versioned by the RUST
+      # Versioned by the Rust release it installs; CI picks the toolchain via
-      # release it installs, and the tag we pin is the toolchain CI is pinned
+      # `toolchain:` on @master/@stable. Dependabot proposes Rust versions that
-      # to on purpose -- precommit.sh runs the same one locally so a lint that
+      # do not exist. Toolchain bumps are a deliberate all-repo change.
-      # passes on a developer's newer default cannot pass CI by accident.
-      #
-      # Dependabot reads those tags as semver and proposed 1.97.0 -> 1.100.0,
-      # a Rust version that does not exist. Every such PR 404s on toolchain
-      # download across all eight repos, and they regenerate weekly -- eight
-      # permanently-red PRs that promote.yml then has to special-case when it
-      # decides whether dev is green.
-      #
-      # Bumping the toolchain is a deliberate, all-eight-repos change, made by
-      # hand together with precommit.sh. There is nothing here for a bot.
       - dependency-name: dtolnay/rust-toolchain
+      # The org's own reusable workflows/actions. @v1 and @v2 are independent
+      # moving tags (v2 is only the comment guard), not semver releases: a
+      # "bump" from v1 to v2 would move a caller onto an OLDER guard.
+      - dependency-name: "freemkv/.github*"

.github/workflows/ci.yml

@@ -94,7 +94,7 @@ jobs:
       - uses: freemkv/.github/.github/actions/checkout-siblings@v1
         with:
           checkout: libfreemkv freemkv-unlock
-          patch: libfreemkv
+          patch: libfreemkv freemkv-unlock
           self: freemkv-keysources
       # fmt runs on the MSRV pin; clippy runs on stable so new-lint debt is a
       # blocking gate the pinned toolchain would hide. Stable is installed first
@@ -125,7 +125,7 @@ jobs:
       - uses: freemkv/.github/.github/actions/checkout-siblings@v1
         with:
           checkout: libfreemkv freemkv-unlock
-          patch: libfreemkv
+          patch: libfreemkv freemkv-unlock
           self: freemkv-keysources
       - uses: dtolnay/rust-toolchain@master
         with:
@@ -149,7 +149,7 @@ jobs:
       - uses: freemkv/.github/.github/actions/checkout-siblings@v1
         with:
           checkout: libfreemkv freemkv-unlock
-          patch: libfreemkv
+          patch: libfreemkv freemkv-unlock
           self: freemkv-keysources
       - uses: dtolnay/rust-toolchain@stable
       - uses: EmbarkStudios/cargo-deny-action@v2
@@ -182,7 +182,7 @@ jobs:
       - uses: freemkv/.github/.github/actions/checkout-siblings@v1
         with:
           checkout: libfreemkv freemkv-unlock
-          patch: libfreemkv
+          patch: libfreemkv freemkv-unlock
           self: freemkv-keysources
       - uses: dtolnay/rust-toolchain@master
         with:
@@ -209,7 +209,7 @@ jobs:
       - uses: freemkv/.github/.github/actions/checkout-siblings@v1
         with:
           checkout: libfreemkv freemkv-unlock
-          patch: libfreemkv
+          patch: libfreemkv freemkv-unlock
           self: freemkv-keysources
       - uses: dtolnay/rust-toolchain@master
         with:
@@ -250,7 +250,7 @@ jobs:
       - uses: freemkv/.github/.github/actions/checkout-siblings@v1
         with:
           checkout: libfreemkv freemkv-unlock
-          patch: libfreemkv
+          patch: libfreemkv freemkv-unlock
           self: freemkv-keysources
       - uses: dtolnay/rust-toolchain@master
         with:

.github/workflows/qa.yml

@@ -96,7 +96,7 @@ jobs:
       - uses: freemkv/.github/.github/actions/checkout-siblings@v1
         with:
           checkout: libfreemkv freemkv-unlock
-          patch: libfreemkv
+          patch: libfreemkv freemkv-unlock
           self: freemkv-keysources
       - uses: dtolnay/rust-toolchain@master
         with:
@@ -119,7 +119,7 @@ jobs:
       - uses: freemkv/.github/.github/actions/checkout-siblings@v1
         with:
           checkout: libfreemkv freemkv-unlock
-          patch: libfreemkv
+          patch: libfreemkv freemkv-unlock
           self: freemkv-keysources
       - uses: dtolnay/rust-toolchain@stable
         with:
@@ -145,7 +145,7 @@ jobs:
       - uses: freemkv/.github/.github/actions/checkout-siblings@v1
         with:
           checkout: libfreemkv freemkv-unlock
-          patch: libfreemkv
+          patch: libfreemkv freemkv-unlock
           self: freemkv-keysources
       - uses: dtolnay/rust-toolchain@master
         with:

Cargo.toml

@@ -50,6 +50,7 @@ codegen-units = 1
 # config-level [patch.crates-io] wins over this manifest one for the same crate).
 [patch.crates-io]
 libfreemkv = { git = "https://github.com/freemkv/libfreemkv", tag = "v1.7.7" }
+freemkv-unlock = { git = "https://github.com/freemkv/freemkv-unlock", tag = "v1.7.7" }
 
 [lints.clippy]
 uninlined_format_args = "allow"