From a6e1bc7c4759c99f09caefaf31535ebaba724cce Mon Sep 17 00:00:00 2001
From: Dan Guido <dan@trailofbits.com>
Date: Mon, 16 Feb 2026 17:20:17 -0700
Subject: [PATCH] Update GitHub Actions guidelines for Python projects

Added recommendation to use 'uv' ecosystem for Python projects in GitHub Actions section.
---
 claude-md-template.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/claude-md-template.md b/claude-md-template.md
index 91db522..3a0d68c 100644
--- a/claude-md-template.md
+++ b/claude-md-template.md
@@ -182,7 +182,7 @@ All scripts must start with `set -euo pipefail`. Lint: `shellcheck script.sh &&
 
 ### GitHub Actions
 
-Pin actions to SHA hashes with version comments: `actions/checkout@<full-sha>  # vX.Y.Z` (use `persist-credentials: false`). Scan workflows with `zizmor` before committing. Configure Dependabot with 7-day cooldowns and grouped updates.
+Pin actions to SHA hashes with version comments: `actions/checkout@<full-sha>  # vX.Y.Z` (use `persist-credentials: false`). Scan workflows with `zizmor` before committing. Configure Dependabot with 7-day cooldowns and grouped updates. Use `uv` ecosystem (not `pip`) for Python projects so Dependabot updates `uv.lock`.
 
 ## Workflow