Enable dependency scanning with Dependabot

Summary

Enable Dependabot to automatically scan dependencies for known vulnerabilities and create PRs for updates.

Background

From the security threat model (T7: Supply Chain - Dependency Compromise), dependencies like go-github, go-yaml, and helm-docs could be compromised. Automated scanning helps detect known vulnerabilities quickly.

Acceptance Criteria

• Add .github/dependabot.yml configuration
• Enable scanning for Go modules
• Enable scanning for GitHub Actions
• Configure appropriate update schedule (weekly recommended)
• Consider grouping minor/patch updates to reduce PR noise

Example Configuration

version: 2
updates:
  - package-ecosystem: "gomod"
    directory: "/"
    schedule:
      interval: "weekly"
    groups:
      minor-and-patch:
        patterns:
          - "*"
        update-types:
          - "minor"
          - "patch"

  - package-ecosystem: "github-actions"
    directory: "/"
    schedule:
      interval: "weekly"

Priority

Medium - Supply chain security

Related

• SECURITY.md threat model (T7)

Review SECURITY.md for the T7 supply-chain context, then inspect the repository's Go module and GitHub Actions usage before creating .github/dependabot.yml. Configure weekly scanning for Go modules and GitHub Actions, with grouped minor and patch updates as appropriate. Done means the configuration covers both ecosystems and matches the listed acceptance criteria.