[IAmJSD]

Why

Owner decision D19 (acting owner, 2026-10-26), from the CI-policy question in #1307: add Dependabot version updates and a CODEOWNERS file. Snyk, Trivy and the coverage threshold stay advisory. This PR doesn't touch them.

What

.github/dependabot.yml: weekly version updates for:

Ecosystem	Directory	Notes
gomod	/	root module
gomod	/tests/e2e	separate, standard-library-only module
npm	/frontend
github-actions	/	actions are pinned by SHA with a version comment, and Dependabot bumps both
docker	/	Dockerfile, Dockerfile.dev and Dockerfile.test pin base images by tag and digest

Every entry:

• groups minor and patch updates into one PR per ecosystem. Major updates still come one PR per dependency.
• sets open-pull-requests-limit: 5.
• sets cooldown.default-days: 7, so Dependabot only proposes a release once it is a week old. zizmor's dependabot-cooldown audit reports this as medium severity when it's missing, and the delay gives a compromised or yanked release time to be caught.
• uses a conventional-commit prefix (chore(deps), or chore(ci) for actions) and the type/chore label.

.github/CODEOWNERS: * @cristim. Code-owner review is not required by the branch ruleset, so this file only auto-requests a review from the code owner on new PRs. It doesn't block or gate merges.

Verification

• .github/dependabot.yml passes the Dependabot JSON schema (check-jsonschema --builtin-schema vendor.dependabot).
• zizmor 1.29.0 (--offline --persona=pedantic) on .github/dependabot.yml: no findings at any severity. The CI invocation (--min-severity=medium .github/workflows/) is unchanged and still clean.
• actionlint: clean.
• pre-commit hooks that apply to these files (trailing whitespace, EOF, check-yaml, large files, merge conflict, private key, case conflict, git-secrets): pass. trivy-config v0.69.3 (Docker, same flags as the hook): exit 0.
• No repo script or ci.yml check validates top-level .github/ files beyond the above. I grepped scripts/ and ci.yml, and the workflow checks only look at .github/workflows/.
• go build/go vet (plus the integration and e2e tags), secrets scan and scripts/test-git-secrets-allowlist.sh: pass. No Go code changed.

After merge

Dependabot PRs will start appearing weekly, at most 5 open per ecosystem, with minor and patch bumps grouped into one PR each. They go through the same CI and review as any other PR.

🤖 Generated with Claude Code

[coderabbitai]

Caution

Review failed

The pull request is closed.

Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[IAmJSD]

Independent review (IAmJSD's agent, fresh context, given only the diff, the issue and the PR text): VERDICT: APPROVE 326b8a907a2b70ed195c66061498eaa950ede368

Blocking:

• none

Non-blocking:

• .github/dependabot.yml: no terraform ecosystem (provider pins under terraform/) and no docker-compose ecosystem (docker-compose.yml has nginx:alpine and dpage/pgadmin4:9.2 unpinned by digest). Outside D19's stated scope, so a follow-up rather than a gap in this PR.
• .github/dependabot.yml:34: the /tests/e2e entry will never open a PR today: that module's go.mod has no require at all (stdlib-only by design). Harmless and future-proof, just noting it.
• Operational, not code: Dependabot pushes its branches to the base repo, and deploy-azure.yml / deploy-gcp.yml run on every push to main, so each merged Dependabot PR deploys like any other merge. Worth making sure the merge train never picks up dependabot[bot] PRs automatically.
• .github/CODEOWNERS: * @cristim will auto-request cristim on every PR while he is away. That's harmless (require_code_owner_review is false in ruleset 24469860, and cristim has admin on the repo, so the owner entry is valid), but it adds a lot of review-request noise for him.

Attacked: Validated the file with check-jsonschema --builtin-schema vendor.dependabot: ok. Inventoried what Dependabot should cover: find for go.mod (root + tests/e2e, both present in go.work), Dockerfile* (3, all at /, all matched by the docker ecosystem), package.json (only /frontend), and .github/actions (none, so / for github-actions is enough). Checked label type/chore exists. Read the ruleset via gh api .../rulesets/24469860: only CI Success and Run pre-commit hooks are required, and code-owner review is off, which matches the PR body. Checked workflow triggers for Dependabot-PR hazards: no pull_request_target, and ci.yml's only secret (SNYK_TOKEN) is on a continue-on-error step, so secret-less Dependabot runs won't fail CI. Config-only diff, so no Go tests apply.

Body-stale: none

_{Reviewer: rD2. Bar while the maintainers are away (set by IAmJSD as acting owner): one approving independent review on the head, two for money, auth and security paths.}

[IAmJSD]

Local verification at 326b8a907a2b70ed195c66061498eaa950ede368 merged onto main (01fb35a6), together with #1447, #1453, #1455 in that order (combined tree 92b7f1db, Linux, Go 1.26.10): go build ./..., go vet with and without -tags integration, the full go test -race -short -count=1 ./..., and go test -race -tags integration -count=1 on every changed package, against Docker Postgres. All pass. CI Success and pre-commit are green on this head, with 1 approving independent review(s) on it. Nothing was run against any cloud.

[IAmJSD]

Merged by IAmJSD's agent at IAmJSD's request (IAmJSD is acting owner while the maintainers are away), under the bar IAmJSD set: 1 approving independent review(s) on 326b8a90, green CI, and the combined-tree verification above. Squash-merged at exactly 326b8a907a2b70ed195c66061498eaa950ede368.