From 3ec0b3b14a0525d39347b90ee662e21b7bdba00e Mon Sep 17 00:00:00 2001
From: Codex <codex@openai.com>
Date: Tue, 1 Sep 2026 02:24:36 +0000
Subject: [PATCH] chore: add Dependabot version updates for GitHub Actions only

Covers the actions/checkout@v4-class drift the app repo also has, without
touching the cargo ecosystem. This workspace builds --locked everywhere
and enforces a bit-determinism invariant (cross-target digest gates); an
automated Cargo dependency bump can move a shipped digest, which needs
guardrails this PR doesn't set up. See PR description for the full
reasoning and recommendation.

Monthly schedule (not weekly): every PR here triggers the full required
check suite, including cross-target digest gates and chromium/firefox/
webkit browser qualification, which is materially more expensive than
the app's CI. Actions bumps are low-urgency, so there's no reason to pay
that weekly.
---
 .github/dependabot.yml | 34 ++++++++++++++++++++++++++++++++++
 1 file changed, 34 insertions(+)
 create mode 100644 .github/dependabot.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 000000000..d165fe35d
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,34 @@
+version: 2
+
+updates:
+  # GitHub Actions versions only (e.g. actions/checkout@v4 -> v5). This is
+  # the same drift class as the app's Node-20-deprecation warnings, and it
+  # carries none of this repo's bit-determinism risk: Actions version pins
+  # never touch Cargo.lock or any digest the workspace ships.
+  #
+  # Deliberately NOT covering the `cargo` ecosystem here. This workspace
+  # builds `--locked` everywhere and enforces a bit-determinism invariant
+  # (see the "cross-target digest gates under wasmtime" required check) --
+  # an automated dependency bump can move a shipped digest, which is a much
+  # bigger deal than in an app repo. See the dependency-drift-detection
+  # writeup for the recommended guardrails before enabling that ecosystem.
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      # Monthly, not weekly: every PR here -- even an Actions-only bump --
+      # triggers the full required-check suite (cross-target digest gates,
+      # chromium/firefox/webkit browser qualification, host quality on an
+      # 8-vcpu runner), which is materially more expensive than a typical
+      # app CI run. Actions version bumps are low-urgency, so there's no
+      # reason to pay that cost weekly.
+      interval: "monthly"
+    open-pull-requests-limit: 3
+    labels:
+      - "dependencies"
+      - "github-actions"
+    commit-message:
+      prefix: "chore(ci)"
+    groups:
+      actions:
+        patterns:
+          - "*"