ci: Dependabot pull requests regenerate THIRD-PARTY-LICENSES.txt; num-bigint moves with num-rational

Every Cargo update changes the licences file, which Dependabot cannot regenerate, so all its pull
requests failed the licences check before testing anything. CI regenerates it for them and a new
workflow commits it. num-bigint 0.5 alone cannot build: the predicates' BigInt is num-rational's.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NmAttHhUZTokgPeEJia8sm

.github/dependabot.yml

@@ -35,6 +35,12 @@ updates:
         update-types: ["version-update:semver-major", "version-update:semver-minor"]
       # The shared Craft components follow VectorCraft's rev.
       - dependency-name: craft-ui
+      # The exact predicates' BigInt must be num-rational's (0.4 uses num-bigint 0.4): both move
+      # together, by hand.
+      - dependency-name: num-bigint
+        update-types: ["version-update:semver-major", "version-update:semver-minor"]
+      - dependency-name: num-rational
+        update-types: ["version-update:semver-major", "version-update:semver-minor"]
 
   - package-ecosystem: github-actions
     directory: /

.github/workflows/ci.yml

@@ -60,6 +60,12 @@ jobs:
       - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
         with:
           save-if: ${{ github.ref == 'refs/heads/develop' }}
+      # A dependency update changes THIRD-PARTY-LICENSES.txt, which Dependabot cannot regenerate:
+      # regenerate it here so the gate checks everything else, and dependabot-licences.yml commits
+      # it to the pull request.
+      - name: Regenerate THIRD-PARTY-LICENSES.txt (Dependabot)
+        if: github.event.pull_request.user.login == 'dependabot[bot]'
+        run: cargo xtask licences
       - run: cargo xtask ci
 
   heavy:

.github/workflows/dependabot-licences.yml

@@ -0,0 +1,38 @@
+# Dependabot's Cargo updates change THIRD-PARTY-LICENSES.txt (`cargo xtask licences`), which
+# Dependabot cannot regenerate: this commits the regenerated file to its pull request. CI's own
+# run on the pull request regenerates it too, so its result covers everything else.
+name: Dependabot licences
+
+on:
+  pull_request:
+    branches: [develop]
+    paths: [Cargo.lock]
+
+permissions:
+  contents: write
+
+concurrency:
+  group: dependabot-licences-${{ github.head_ref }}
+  cancel-in-progress: true
+
+jobs:
+  licences:
+    if: github.event.pull_request.user.login == 'dependabot[bot]'
+    runs-on: ubuntu-24.04
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.head_ref }}
+      - uses: dtolnay/rust-toolchain@stable
+      - run: cargo xtask licences
+      - name: Commit the regenerated file
+        run: |
+          if git diff --quiet -- THIRD-PARTY-LICENSES.txt; then
+            echo "THIRD-PARTY-LICENSES.txt is up to date"
+            exit 0
+          fi
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git commit -m "deps: regenerate THIRD-PARTY-LICENSES.txt" -- THIRD-PARTY-LICENSES.txt
+          git push origin "HEAD:${GITHUB_HEAD_REF}"