[bennedictbett]

What this changes

Closes #99

Adds .github/dependabot.yml with one github-actions entry: monthly schedule, at most 3 open version-update PRs (security updates have their own separate limit), and one group so action updates arrive together. Commit messages use the repo's chore prefix; grouped PR titles are named after the group (github-actions).

The group has no update-types filter, so major, minor and patch updates are all grouped. Narrowing that is a version-policy change, left for review.

Out of scope, as agreed on the issue: auto-merge, Python (pip) dependencies, publishing, secrets and any action-version policy changes.

Workflow references inspected

Covered (external, versioned):

• archive.yml: actions/checkout@v4, actions/attest-build-provenance@v4
• tests.yml: actions/checkout@v4, actions/setup-python@v5

Not covered: archive.yml has uses: ./, a local reference to this repo's own action, which has no version to update.

directory: "/" also makes Dependabot scan the root action.yml; it contains no uses: references.

Checks performed

• check-jsonschema --builtin-schema vendor.dependabot .github/dependabot.yml: ok -- validation done
• Parsed with PyYAML: loads as a single github-actions update entry with the intended keys and values
• Compared all six keys with GitHub's Dependabot options reference (package-ecosystem, directory, schedule.interval, open-pull-requests-limit, groups/patterns, commit-message.prefix)
• Listed every uses: line in .github/workflows/ (above)

Not done: Dependabot itself was not run, since it only runs from the default branch. The Dependabot tab under Insights → Dependency graph will show any config error after merge. No Python files changed, so the test suite was not run, as agreed on the issue.

Checklist

• python -m pytest passes — not applicable, configuration-only change
• Behaviour changes come with a test in the same commit (no behaviour change)
• No new runtime dependencies
• No invented data — nothing estimated or interpolated beyond what the API returns

[HafidIdrissi]

Reviewed the complete 13-line Dependabot configuration against #99 and GitHub's current options reference: https://docs.github.com/en/code-security/reference/supply-chain-security/dependabot-options-reference . It defines one github-actions ecosystem at /, a monthly schedule, a limit of three version-update PRs and one all-actions group. The chore commit prefix is valid; the PR correctly explains that grouped titles use the group identifier and that the security-update PR limit is separate. Grouping all version levels does not itself approve or merge those upgrades; action-version changes still need maintainer review.

Independently inventoried the external workflow references (actions/checkout, actions/setup-python and actions/attest-build-provenance); the local uses: ./ is not a versioned dependency, and root action.yml has no uses references. No pip updates, auto-merge, publishing or secret configuration are introduced. git diff --check passes and all four jobs in current-head Tests run 39226270825 succeed. I inspected the YAML and documented option semantics; I did not independently run the author's PyYAML/check-jsonschema commands or execute Dependabot. Its actual update behavior remains observable after this file reaches the default branch. No blocking finding. Approved.