From 6812aa44028f18053c3bd0b3a26e850d24edbb1d Mon Sep 17 00:00:00 2001 From: Nick Josevski Date: Wed, 19 Aug 2026 14:21:17 +1000 Subject: [PATCH] ci: restore Dependabot for github-actions Reverses #8, which removed this during the 2022 GitHub malware-campaign investigation. We are using Dependabot again. Two deliberate differences from the file that was removed: weekly rather than daily, and updates grouped into a single pull request, so the repo stays quiet. Four years without it left every action pin four majors behind, including one whose upstream repo had been archived. Co-Authored-By: Claude Opus 5 (1M context) --- .github/dependabot.yml | 10 ++++++++++ 1 file changed, 10 insertions(+) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..f6faee6 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,10 @@ +version: 2 +updates: + - package-ecosystem: "github-actions" + directory: "/" + schedule: + interval: "weekly" + groups: + github-actions: + patterns: + - "*"