fix: extend Dependabot coverage to Python SDK and MCP server

.github/dependabot.yml

@@ -22,7 +22,7 @@ updates:
       - dependency-name: "eslint"
         versions: [">=10"]
 
-  # Python backend dependencies.
+  # Python backend dependencies (root pyproject.toml and requirements.txt).
   - package-ecosystem: "pip"
     directory: "/"
     schedule:
@@ -35,6 +35,20 @@ updates:
       interval: "weekly"
     open-pull-requests-limit: 10
 
+  # Python SDK dependencies.
+  - package-ecosystem: "pip"
+    directory: "/sdk/python"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 10
+
+  # MCP YouTube server dependencies (pyproject.toml and uv.lock).
+  - package-ecosystem: "uv"
+    directory: "/docs/knowledge_prototypes/mcp-servers/mcp_youtube-0.2.0"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 10
+
   # GitHub Actions versions.
   - package-ecosystem: "github-actions"
     directory: "/"

tests/unit/test_dependabot_automation_workflow.py

@@ -1,9 +1,5 @@
 from __future__ import annotations
 
-import json
-import re
-import shutil
-import subprocess
 from pathlib import Path
 
 import pytest
@@ -27,6 +23,31 @@ def _load_dependabot_config() -> dict:
     return yaml.safe_load(DEPENDABOT_CONFIG_PATH.read_text())
 
 
+@pytest.mark.parametrize(
+    ("directory", "ecosystem"),
+    [
+        ("/", "pip"),
+        ("/src/youtube_extension/backend", "pip"),
+        ("/sdk/python", "pip"),
+        ("/docs/knowledge_prototypes/mcp-servers/mcp_youtube-0.2.0", "uv"),
+    ],
+)
+def test_dependabot_tracks_python_packages_weekly(
+    directory: str, ecosystem: str
+) -> None:
+    updates = [
+        update
+        for update in _load_dependabot_config()["updates"]
+        if update["directory"] == directory
+        and update["package-ecosystem"] in {"pip", "uv"}
+    ]
+
+    assert len(updates) == 1, f"Expected exactly one entry for {directory}"
+    assert updates[0]["package-ecosystem"] == ecosystem
+    assert updates[0]["schedule"]["interval"] == "weekly"
+    assert updates[0]["open-pull-requests-limit"] == 10
+
+
 def test_dependabot_workflow_uses_safe_triggers_and_permissions() -> None:
     workflow = _load_workflow()