ci: configure Dependabot for npm and github-actions

[donny-devops]

Summary

• Adds .github/dependabot.yml scoped correctly to this repo: npm (package.json at root) and github-actions, both at /.
• Replaces ci: fix Dependabot config to match repo structure #21, which was accidentally opened from a branch based on donny-devops/docs instead of main. That base included ~16 unrelated files (AGENTS.md, pyproject.toml, Codex Installer.exe, agenticops-fastapi.zip, chart.png, etc.) that don't exist on main and have nothing to do with Dependabot config — flagged by Qodo's review on ci: fix Dependabot config to match repo structure #21. There is also no Python manifest on main, so the pip ecosystem entry from the earlier attempt was dropped.

Test plan

• Confirm .github/dependabot.yml parses (GitHub validates on merge)
• After merge, verify Dependabot opens npm update PRs on schedule

🤖 Generated with Claude Code

[qodo-code-review]

Qodo is busy working

Check back in a few minutes. Qodo's code review agents are on it.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[gemini-code-assist]

Code Review

This pull request adds a .github/dependabot.yml configuration file to set up weekly dependency updates for npm and GitHub Actions. There are no review comments, and I have no feedback to provide.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[amazon-q-developer]

Review Summary

This PR adds a valid Dependabot configuration for npm and GitHub Actions dependency management. The configuration is syntactically correct and will function as intended.

Key Changes:

• Adds .github/dependabot.yml with weekly update schedules for both npm and github-actions ecosystems
• Configures npm with a 10 PR limit (github-actions uses default of 5)
• Correctly targets root directory for both package ecosystems

No blocking issues identified. The configuration is ready to merge and will enable automated dependency updates.

---

You can now have the agent implement changes and create commits directly on your pull request's source branch. Simply comment with /q followed by your request in natural language to ask the agent to make changes.

[qodo-code-review]

PR Summary by Qodo

Configure Dependabot for npm and GitHub Actions at repo root

⚙️ Configuration changes 🕐 Less than 5 minutes

AI Description

• Add root-scoped Dependabot configuration for npm dependencies.
• Enable Dependabot updates for GitHub Actions workflows.
• Schedule weekly update PRs with a capped open-PR limit.

Diagram

graph TD
  R["GitHub Repo"] --> D["Dependabot"] --> N["npm updates"] --> P["PRs created"]
  D --> A["Actions updates"] --> P
  N --> REG[("npm registry")]
  A --> MAR[("GitHub Marketplace")]
  subgraph Legend
    direction LR
    _repo["Repo"] ~~~ _svc["Service"] ~~~ _db[("Registry")]
  end

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Use Renovate instead of Dependabot

• ➕ More flexible grouping/auto-merge policies and richer config options
• ➕ Can consolidate updates more aggressively to reduce PR noise
• ➖ Requires installing/configuring a GitHub App and maintaining a more complex config
• ➖ More operational overhead than GitHub-native Dependabot

Recommendation: Keep Dependabot for this repo: it’s GitHub-native, minimal configuration, and matches the stated goal (weekly npm + Actions updates at repo root). Consider Renovate only if you later need advanced grouping/auto-merge behavior beyond Dependabot’s capabilities.

Files changed (1) +12 / -0

Other (1) +12 / -0

dependabot.ymlAdd weekly Dependabot updates for npm and GitHub Actions +12/-0

Add weekly Dependabot updates for npm and GitHub Actions

• Introduces a Dependabot v2 configuration targeting the repository root. Enables weekly update PRs for the npm ecosystem (with an open PR cap) and GitHub Actions.

.github/dependabot.yml

[Copilot]

Pull request overview

Adds a Dependabot configuration aligned with the repository’s actual dependency ecosystems so automated dependency update PRs can be created on a weekly cadence.

Changes:

• Introduces .github/dependabot.yml with weekly checks for root-level npm dependencies.
• Adds weekly checks for github-actions updates at the repository root.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[donny-devops]

Closing as part of a portfolio-wide open-PR backlog cleanup to present a clean, reviewer-friendly repository. This action is fully reversible — reopen anytime if the work is still needed. (Dependabot PRs will be re-created on the next scan if still applicable.)