dependabot

# Dependabot Dependency Management Standard Canonical setup for **GitHub Dependabot**, an automated dependency update engine designed to keep dependencies and GitHub Actions pinned, secure, and current. ## 1. Principles 1. **Pin-Everything Strategy**: Pin GitHub Actions to a major-version tag (`actions/checkout@v7`) and Go, npm, and Python packages explicitly. Do not pin action SHAs — the tag already tracks security patches within the major, and SHAs turn every upstream patch into review noise. 1. **Reduce PR Noise**: Group minor, patch, and digest updates into single, consolidated pull requests using the Dependabot `groups` configuration (e.g., grouping GitHub Action updates or Go module updates) while leaving major updates separate. 1. **Local Validation**: Never merge automated updates blindly. Always run validation pipelines locally (`mise run check` and `mise run test`) before pushing/merging to verify compatibility and catch regressions. 1. **No Auto-Merge**: Do not configure auto-merge for dependencies. Automated systems cannot anticipate protocol, type-checking, or model drift. ## 2. Configuration Setup (`.github/dependabot.yml`) Place a `dependabot.yml` at `.github/dependabot.yml` at the root of target repositories to manage updates, commit styling, and dependency groupings. Example configuration for a repository with GitHub Actions and Go modules: ```yaml version: 2 updates: - package-ecosystem: github-actions directory: / schedule: interval: ...