Set up Dependabot version updates for pip, github-actions, and docker

[x3ek]

Description

Add .github/dependabot.yml so Dependabot opens weekly PRs to bump our dependencies. Currently we have security alerts on but no automated version-update PRs — meaning GitHub will tell us about CVEs but won't help us stay current ahead of them.

Why

• Ahead of 1.0 — same theme as the release-please work in Set up release-please for automated versioning and CHANGELOG generation #86: ship the project with a healthy maintained-dependency story rather than letting deps rot and scrambling pre-release.
• CVE prevention beats CVE response — security alerts catch known vulns reactively; version bumps reduce the window where we're sitting on outdated code.
• Low cost, high signal — Dependabot PRs land already-CI'd; merging is usually one click. The infrastructure pays back almost immediately.
• Multi-ecosystem repo — we have three update channels (pip, github-actions, docker) and none of them are tracked today.

Current state

• .github/dependabot.yml — does not exist
• Security alerts (CVE notifications) — enabled (verified via GET /repos/.../vulnerability-alerts → 204)
• Existing workflows that would consume Dependabot PRs — .github/workflows/ci.yml, conventional-commits.yml (with release-please.yml to come from Set up release-please for automated versioning and CHANGELOG generation #86)

Scope

.github/dependabot.yml

• pip — package-ecosystem: pip, directory: /, weekly schedule. Source-of-truth for Python deps is pyproject.toml.
• github-actions — package-ecosystem: github-actions, directory: /, weekly schedule. Keeps action versions (actions/checkout@vX, actions/setup-python@vX, etc.) current.
• docker — package-ecosystem: docker, directory: /, weekly schedule. Catches base-image updates on the Dockerfile.

Configuration choices

• Schedule — interval: weekly (daily is noisy for low-traffic dep ecosystems; monthly drifts too far between checks)
• Grouping — group minor and patch updates into one PR per ecosystem to reduce PR volume; let major bumps land as individual PRs since they're more likely to need code changes
• Commit message prefix — match conventional-commits format so Set up release-please for automated versioning and CHANGELOG generation #86's release-please doesn't choke on Dependabot's PRs. prefix: "chore" with prefix-development: "chore" produces messages like chore(deps): bump foo from 1.0 to 1.1 — clean.
• Open-PR limit — open-pull-requests-limit: 10 per ecosystem (default 5) — generous but bounded
• Labels — auto-label Dependabot PRs with dependencies (create the label if it doesn't exist)
• Reviewers / assignees — TBD; can start without auto-assignment and add later if the PRs need triaging

Documentation

• One-line mention in README's Development section noting deps are auto-updated weekly

Acceptance criteria

• .github/dependabot.yml exists, valid YAML, lints in GitHub's UI (badge under repo Insights → Dependency Graph → Dependabot)
• Within a week of merge, Dependabot has opened at least one PR (or confirmed nothing needs updating, visible in the Dependabot tab)
• Dependabot PR commit messages use the conventional-commits format — verified by inspecting an opened PR
• Conventional-commits workflow passes on a Dependabot PR (no incompatibility with Set up release-please for automated versioning and CHANGELOG generation #86's release-please consumption)
• Existing CI (ci.yml) runs against Dependabot PRs without auth/secret issues

Out of scope

• Auto-merge of Dependabot PRs — possible later (e.g. via a separate workflow that merges patch-level updates after CI green), but a manual-review default is safer for a pre-1.0 project
• npm / other ecosystems — we don't have those yet; revisit if/when a JS bundle lands
• Renovate — alternative to Dependabot with more knobs; not worth the migration cost given Dependabot is built into GitHub and covers our needs

References

• https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file — full config reference
• https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuring-dependabot-version-updates — overview / quick start

— Claude