From 02d10ff64fa84b2c6eac8b5bb761f1156945a88b Mon Sep 17 00:00:00 2001 From: phil Date: Tue, 6 Oct 2026 10:07:12 +0900 Subject: [PATCH] ci: add Dependabot for gomod, actions, docker The 0.9.x HIGH findings were fixed upstream weeks before anyone noticed. Weekly grouped PRs (limit 5 per ecosystem) keep Go modules, SHA-pinned actions and digest-pinned base images current, each gated by the existing CI checks. Co-Authored-By: Claude Opus 5.5 Signed-off-by: phil --- .github/dependabot.yml | 28 ++++++++++++++++++++++++++++ 1 file changed, 28 insertions(+) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..473d405 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,28 @@ +version: 2 +updates: + - package-ecosystem: gomod + directory: / + schedule: + interval: weekly + open-pull-requests-limit: 5 + groups: + gomod: + patterns: ["*"] + + - package-ecosystem: github-actions + directory: / + schedule: + interval: weekly + open-pull-requests-limit: 5 + groups: + github-actions: + patterns: ["*"] + + - package-ecosystem: docker + directory: / + schedule: + interval: weekly + open-pull-requests-limit: 5 + groups: + docker: + patterns: ["*"]