Add Dependabot updates for GitHub Actions

[silveltman]

What changed

Adds .github/dependabot.yml with a github-actions entry: weekly, all actions grouped into one PR.

Why

The workflows pin actions to commit SHAs with a version comment. Without automation those pins go stale and miss security fixes. Dependabot updates the SHA and the version comment together, and grouping keeps it to one PR (one Check and one CodeRabbit run) per week, which fits the Actions budget.

Verification

• Syntax follows the GitHub Dependabot options reference; the file parses as valid YAML.
• After merge, the Dependabot tab under Insights shows the github-actions job.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Added a weekly automated check for updates to the project’s GitHub Actions. Related updates are grouped together for easier review. This is a behind-the-scenes maintenance change and does not alter the app’s features or behavior.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 7574d705-04d5-45d8-9283-1ece345153d2

📥 Commits

Reviewing files that changed from the base of the PR and between 5d22144 and a1a936a.

📒 Files selected for processing (1)

• .github/dependabot.yml

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The repository adds a Dependabot v2 configuration for GitHub Actions. It schedules updates weekly and groups matching dependencies under github-actions.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to a1a93

Dependabot is configured to group weekly updates for the workflow actions. The change is ready to merge after normal checks.

Architecture Summary

Architecture risk: 🔵 Low · up to a1a93

The changed surface does not map to a changed system, dependency edge, entrypoint, or external dependency.

Changed systems: None identified.

Architecture concerns
No architecture-level concerns identified.

Review details

Before / after behavior

• observed — Modified behavior in .github/dependabot.yml: Adds Dependabot configuration for weekly GitHub Actions updates in the repository root, grouping all matching dependencies into one github-actions group.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description check	✅ Passed	The description clearly explains the addition of weekly, grouped Dependabot updates for GitHub Actions and its purpose.
Title check	✅ Passed	The title clearly and concisely describes the main change: adding Dependabot updates for GitHub Actions.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

_{Comment @coderabbitai help to get the list of available commands.}