xarmian 8d33dcbfc8 chore(ci): add Dependabot configuration (TASK-678) (#202) ...

Add .github/dependabot.yml covering four ecosystems:
  - gomod (root) — Go modules for cmd/pad + internal/*
  - npm (/web) — SvelteKit frontend dependencies
  - github-actions (root) — pairs with TASK-677 SHA pinning
  - docker (root) — both Dockerfile and Dockerfile.goreleaser

Strategy:
  - Weekly schedule on Monday 06:00 PT (off-hours, avoids PR flood
    on weekdays)
  - Minor + patch updates grouped per ecosystem → one PR/week
  - Major version bumps get their own PRs so breaking changes are
    reviewed in isolation
  - open-pull-requests-limit: 5 per ecosystem (3 for docker) keeps
    backlog manageable
  - Commit prefixes follow the conventional-commit style the project
    already uses (chore(deps) / chore(ci) / chore(docker))

Pairs with TASK-677: for SHA-pinned Actions, Dependabot updates both
the commit SHA and the trailing '# vX.Y.Z' comment in one PR, so the
human-readable version label stays in sync.

Parent: PLAN-644.

2026-04-22 15:33:26 -04:00

..

ISSUE_TEMPLATE

docs: Update README, SKILL.md, CLAUDE.md, and add GitHub templates

2026-03-28 13:55:40 +00:00

workflows

security(ci): pin all GitHub Actions to commit SHAs (TASK-677) (#201)

2026-04-22 15:27:37 -04:00

CLA.md

Initial release

2026-03-26 01:52:36 +00:00

dependabot.yml

chore(ci): add Dependabot configuration (TASK-678) (#202)

2026-04-22 15:33:26 -04:00

PULL_REQUEST_TEMPLATE.md

docs: Update README, SKILL.md, CLAUDE.md, and add GitHub templates

2026-03-28 13:55:40 +00:00