v1.44.0

Dependabot leaves the family's pins alone (#97). A pin moves when the owner decides, in the resync, with everything its move rewrites, and a bot that proposes one moves the line alone: companygraph/meta-model#76 moved its conventions workflow past conventions.json, and meta-model#294 moved one copy of markdownlint-cli2 past the two others. PINS.md now says that each block of a member's .github/dependabot.yml ignores every family repository it would watch, and every tool whose version a conventions release pins, today markdownlint-cli2. conventions-check holds it: it reads the member's workflows, package.json files and Terraform module sources in each block's directory and names every family pin a block watches. A dependency-name is a glob, so "*robertblust/conventions*" covers every workflow of the repository.

What breaks. A member with a dependabot.yml fails conventions-check until it ignores the pins the check names, and every such member watches at least the conventions workflow. A member without the file sees nothing change.

How to take it. Set the tag in conventions.json and every check.yml@ line to v1.44.0, run sh conventions/conventions-sync sync, then sh conventions/conventions-check: each ✗ line names a block of dependabot.yml and the entry to add to its ignore, for example - dependency-name: "*robertblust/conventions*" in the github-actions block. A member whose dependabot.yml is vendored, as guestgraph/engine and guestgraph/connector-apaleo take theirs from guestgraph/service-conventions, takes the entry from a release of the file's source first. On the sites, the Dependabot group that kept @robertblust/design apart has nothing left to hold once the package is ignored.