fix(ci): ignore unresolvable pytest security update

.github/dependabot.yml

@@ -14,8 +14,18 @@ updates:
       interval: "monthly"
 
   # Maintain dependencies for pip/poetry
-  # NOTE: too noisy, easier to update by hand
-  #- package-ecosystem: "pip"
-  #  directory: "/"
-  #  schedule:
-  #    interval: "monthly"
+  # NOTE: version updates are too noisy and easier to update by hand.
+  # Security updates are still controlled by the repository security settings;
+  # this entry exists so Dependabot can attach the pytest ignore rule below.
+  - package-ecosystem: "pip"
+    directory: "/"
+    schedule:
+      interval: "monthly"
+    open-pull-requests-limit: 0
+    ignore:
+      # pytest 9.x is the first non-vulnerable line for the current alert, but
+      # it no longer supports Python 3.9. The release workflow still builds
+      # ActivityWatch with Python 3.9, so Dependabot cannot resolve that update
+      # until the build baseline moves to Python 3.10+.
+      - dependency-name: "pytest"
+        versions: [">=9"]

Makefile

@@ -132,7 +132,7 @@ test:
 	@for module in $(TESTABLES); do \
 		echo "Running tests for $$module"; \
 		if [ -f "$$module/pyproject.toml" ]; then \
-			(cd $$module && poetry run make test) || { echo "Error in $$module tests"; exit 2; }; \
+			(cd $$module && poetry install && poetry run make test) || { echo "Error in $$module tests"; exit 2; }; \
 		else \
 			make -C $$module test || { echo "Error in $$module tests"; exit 2; }; \
 		fi; \