sfc-gh-lmasuch · Oct 16, 2026 · Oct 16, 2026
@@ -1,76 +1,15 @@
 # Dependabot configuration.
 #
-# Every frontend package.json in this repo is entangled in a cross-manifest
-# equality check, and Dependabot updates one directory per PR and cannot
-# coordinate across manifests. That shapes what we let it watch:
+# Frontend package.json files are not watched. Rendered templates must stay
+# identical to their cookiecutter sources
+# (`./dev.py templates-check-not-modified`), so a lone npm bump cannot merge.
+# Update the cookiecutter source and refresh the rendered templates with
+# `./dev.py templates-update` instead.
 #
-#   - examples-check-deps requires each example's shared toolchain versions
-#     (vite, react, typescript, ...) to match the v1 template exactly.
-#   - templates-check-not-modified requires each rendered template to match its
-#     cookiecutter source.
-#
-# So we only point npm at the examples. For deps the template does NOT declare
-# (baseui, lodash, styletron, ...), Dependabot PRs are independent and merge
-# cleanly. For the shared toolchain, a lone example bump will fail
-# examples-check-deps by design: treat that PR as a signal, then land the bump
-# holistically by editing the cookiecutter source and running
-#   ./dev.py templates-update && ./dev.py examples-update-deps && ./dev.py all-npm-install
-#
-# Rendered templates and cookiecutter sources are intentionally NOT watched: a
-# lone bump there would break the checks above.
+# GitHub Actions have no cross-manifest constraint, so these PRs are always
+# mergeable on their own. Keeps actions/checkout, actions/setup-node, etc. current.
 version: 2
 updates:
-  - package-ecosystem: "npm"
-    directories:
-      - "/examples/**/frontend"
-    schedule:
-      interval: "weekly"
-    open-pull-requests-limit: 10
-    # v1 is legacy (new components should use v2), so keep it on security and
-    # minor/patch updates only. Major bumps (e.g. @mui 5->9, yup 0->1) require
-    # hand-migrating the example source, and shared-toolchain majors need the
-    # holistic cookiecutter+templates+examples pass anyway, so a lone Dependabot
-    # major PR can never merge cleanly. We land those deliberately instead.
-    ignore:
-      # React is pinned to 18.x. We standardize on React 18 across the repo, so
-      # never bump it here. (Dependabot only watches these v1 example manifests;
-      # v2 stays on React 18 at the source level, since nothing auto-bumps it.)
-      # The blanket major rule below already blocks 18 -> 19, but we call React
-      # out explicitly so the lock survives even if that rule is ever relaxed.
-      - dependency-name: "react"
-        versions: [">=19"]
-      - dependency-name: "react-dom"
-        versions: [">=19"]
-      - dependency-name: "@types/react"
-        versions: [">=19"]
-      - dependency-name: "@types/react-dom"
-        versions: [">=19"]
-      - dependency-name: "*"
-        update-types: ["version-update:semver-major"]
-    groups:
-      # Collapse the shared build toolchain into one PR per example so a Vite
-      # bump arrives as a single coordinated change instead of one PR each for
-      # vite, @vitejs/plugin-react-swc, esbuild, and friends.
-      frontend-toolchain:
-        patterns:
-          - "vite"
-          - "@vitejs/*"
-          - "esbuild"
-          - "rollup"
-          - "rolldown"
-          - "postcss"
-          - "typescript"
-          - "prettier"
-          - "@types/node"
-      react:
-        patterns:
-          - "react"
-          - "react-dom"
-          - "@types/react"
-          - "@types/react-dom"
-
-  # GitHub Actions have no cross-manifest constraint, so these PRs are always
-  # mergeable on their own. Keeps actions/checkout, actions/setup-node, etc. current.
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:

@@ -9,81 +9,27 @@ on:
       - "master"
 
 jobs:
-  build-examples-templates-and-run-dockerized-e2e-tests:
+  build-frontends:
     runs-on: ubuntu-latest
-
-    strategy:
-      fail-fast: false
-      matrix:
-        node_version:
-          # For details, see: https://github.com/nodejs/release#release-schedule
-          # Maintenance LTS 2025-10-21 - 2027-04-30
-          - 22.x
-          # Active LTS 2025-10-28 - 2026-10-20
-          - 24.x
-        component_lib_version:
-          - current
-          - develop
-        streamlit_version:
-          - latest
-          - nightly
-
-    env:
-      NODE_VERSION: ${{ matrix.node_version }}
-      PYTHON_VERSION: '3.10'  # Oldest version supported by Streamlit
-      STREAMLIT_VERSION: ${{ matrix.streamlit_version }}
-      COMPONENT_LIB_VERSION: ${{ matrix.component_lib_version }}
-
-    name: Examples + Templates / node_version=${{ matrix.node_version }} / streamlit_version=${{ matrix.streamlit_version }}  / component_lib_version=${{ matrix.component_lib_version }}
+    name: Vite build
 
     steps:
-    - uses: actions/checkout@v7
-      with:
-        persist-credentials: false
-        path: component-template
-
-    - name: Use Node.js ${{ env.NODE_VERSION }}
-      uses: actions/setup-node@v7
-      with:
-        node-version: ${{ env.NODE_VERSION }}
-
-    - name: Check dependencies for examples
-      run: ./dev.py examples-check-deps
-      working-directory: ./component-template/
-
-    - name: Check e2e utils files
-      run: ./dev.py e2e-utils-check
-      working-directory: ./component-template/
-
-    - name: Pack Streamlit Component Library
-      uses: ./component-template/.github/actions/pack_streamlit_component_library
-      if: matrix.component_lib_version == 'develop'
-      id: streamlit_component_library
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
 
-    - name: Build components wheels
-      uses: ./component-template/.github/actions/build_component_wheels
-      id: component_wheels
-      with:
-        custom_streamlit_component_lib_file: >-
-          ${{ matrix.component_lib_version == 'develop' && steps.streamlit_component_library.outputs.output_file || '' }}
+      - uses: actions/setup-node@v7
+        with:
+          node-version: 24
 
-    - name: Upload wheel packages
-      uses: actions/upload-artifact@v7
-      with:
-        name: all-wheel-${{ matrix.node_version }}-${{ matrix.component_lib_version }}-${{ matrix.streamlit_version }}
-        path: ${{ steps.component_wheels.outputs.output_directory }}/*.whl
-        if-no-files-found: error
+      - name: Install frontend dependencies
+        run: ./dev.py all-npm-install
 
-    - name: Run E2E tests
-      if: matrix.node_version == '24.x'
-      uses: ./component-template/.github/actions/run_e2e
-      with:
-        python_version: ${{ env.PYTHON_VERSION }}
-        streamlit_version: ${{ env.STREAMLIT_VERSION }}
+      - name: Build frontends with Vite
+        run: ./dev.py all-npm-build
 
-  build-cookiecutter:
+  check-cookiecutter:
     runs-on: ubuntu-latest
-
     name: Cookiecutter
 
     steps:
@@ -93,12 +39,12 @@ jobs:
 
       - name: Install cookiecutter
         run: |
-          pip install pipx
+          pip install uv
           # Cookiecutter 2.2.3 has broken replay file support used in our regression check.
-          # It should still works for end-user.
+          # It should still work for end users.
           # See: https://github.com/cookiecutter/cookiecutter/issues/1900
-          pipx install 'cookiecutter==2.2.2'
+          uv tool install 'cookiecutter==2.2.2'
+          echo "$HOME/.local/bin" >> "$GITHUB_PATH"
 
-      - name: Checks that templates have been generated by cookiecutter and have no unwanted changes.
-        run: |
-          ./dev.py templates-check-not-modified
+      - name: Check that rendered templates match the cookiecutter sources
+        run: ./dev.py templates-check-not-modified
@@ -24,8 +24,9 @@ test-reports
 # Test fixtures
 cffi_bin
 
-# Pyenv Stuff
+# Virtual environments
 .python-version
+.venv/
 
 ########################################################################
 # OSX - https://github.com/github/gitignore/blob/master/Global/macOS.gitignore
@@ -53,11 +54,11 @@ node_modules/
 # Coverage directory used by tools like istanbul
 coverage/
 
-# Lockfiles
-template/**/yarn.lock
-template/**/package-lock.json
-template-reactless/**/yarn.lock
-template-reactless/**/package-lock.json
+# Lockfiles generated inside rendered templates and cookiecutter sources
+templates/**/yarn.lock
+templates/**/package-lock.json
+cookiecutter/**/yarn.lock
+cookiecutter/**/package-lock.json
 
 ########################################################################
 # JetBrains
@@ -67,5 +68,4 @@ template-reactless/**/package-lock.json
 ########################################################################
 # VSCode
 ########################################################################
-.vscode/
-buildcontext/
+.vscode/