🌱 Add dependabot for automated dependency updates

[clubanderson]

Summary

Adds dependabot.yml for automated dependency updates (GitHub Actions, Docker). Part of event readiness initiative for llm-d ecosystem.

Test plan

• Verify dependabot PRs appear within 24 hours

/cc @wseaton @zdtsw

[Copilot]

Pull request overview

This pull request adds a dependabot configuration file to enable automated dependency updates for GitHub Actions and Docker base images as part of the event readiness initiative for the llm-d ecosystem. The configuration sets up weekly checks for both ecosystems with appropriate labels and commit message prefixes.

Changes:

• Added .github/dependabot.yml configuration file
• Configured weekly automated updates for GitHub Actions dependencies
• Configured weekly automated updates for Docker base images

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The repository contains a Rust workspace with Cargo.toml and Cargo.lock files, but there is no cargo package ecosystem configured in dependabot. Consider adding a cargo configuration block to monitor Rust dependencies. This would help keep dependencies like serde, clap, tracing, and other workspace dependencies up to date.

Suggested change

	prefix: "deps(docker)"
	prefix: "deps(docker)"
	# Rust (Cargo) dependency updates
	- package-ecosystem: "cargo"
	directory: "/"
	schedule:
	interval: "weekly"
	labels:
	- "dependencies"
	- "release-note-none"
	commit-message:
	prefix: "deps(cargo)"

[Copilot]

The GitHub Actions ecosystem includes the "release-note-none" label, but the Docker ecosystem does not. For consistency, consider adding the "release-note-none" label to the Docker ecosystem configuration as well, since dependency updates typically don't require release notes.

Suggested change

	- "dependencies"
	- "dependencies"
	- "release-note-none"

[Copilot]

The Docker ecosystem is configured with directory: "/", which will only monitor the Dockerfile at the root level. However, there are additional Dockerfiles in subdirectories (e.g., hca-probe/Dockerfile and hca-probe/docker/Dockerfile). Consider adding separate entries for each directory containing a Dockerfile to ensure all Docker base images are monitored for updates.

[clubanderson]

👋 @wseaton @zdtsw PTAL — this adds standard governance workflows (typo checker, link checker, upstream dependency monitor) via GitHub Agentic Workflows. Ready for review.

[github-actions]

🔗 Link Check Results

✅ Summary

• 0 broken links found
• 1 possibly transient link found (may resolve on retry)
• 3 links checked successfully

⚠️ Possibly Transient (may be temporary)

File	Line	Link	Status
docs/upstream-versions.md	77	(pypi.org/redacted)	Network restricted (known flaky domain)

Note: The PyPI link appears to be blocked by network restrictions in the CI environment. This is not a broken link in the markdown files themselves, but a transient network issue. The link is valid and should work when accessed from other environments.

Generated by Link Checker for issue #6

[clubanderson]

👋 @smarterclayton @aavarghese PTAL — adds dependabot for automated dependency updates. Ready for review.

[clubanderson]

👋 @chcost @Gregory-Pereira PTAL — adds dependabot for automated dependency updates. Ready for review.