Added the Dependabot configuration the pinned actions need

[fdesbiens]

Follow-up to #660, and the last piece of the GitHub Actions track.

#660 pinned all 19 action references to commit SHAs. A SHA pin with nothing moving it is worse than a floating tag — it holds CI on whatever was current the day it was written. That is how actions/cache@v1 came to sit in ci_cortex_m.yml until GitHub began auto-failing every request that used it, and nobody was told. The drift measured on 24 August, before the catch-up: download-artifact four majors behind, checkout and upload-artifact three each, cache and upload-pages-artifact two.

This adds .github/dependabot.yml — weekly, github-actions only — and closes the reference to that path which #660 left in each workflow's pinning comment.

Dependabot understands the SHA form and rewrites the trailing version comment together with the pin, so the comment cannot drift away from the SHA it describes.

Shape

Patch and minor are grouped into a single pull request: they are the routine traffic, and a queue reviewed one item at a time is a queue that gets ignored — which is the failure mode this file exists to prevent. Majors stay ungrouped, one pull request each, because every breaking change this repository has met in an action has been a major (download-artifact v8 defaulting digest-mismatch to error; upload-artifact v6 requiring runner ≥ 2.327.1).

The update pull requests are a real test here, and would not have been before this month: since #652 the regression suites run on pull requests to dev, so a Dependabot pull request exercises the bumped action against the full suite rather than two static checks.

Two choices worth stating rather than leaving to be rediscovered

target-branch: dev. Dependabot reads this file from the default branch, which is master — but master is deliberately kept behind dev, and pull requests belong where the suites gate them. So this arms on merge without firing: nothing happens until a release merge carries the file to master. Setting target-branch also opts out of Dependabot security updates, which only ever run against the default branch. For this ecosystem the cost is small — an action advisory arrives as an ordinary bump on the weekly run — but it is a real trade.

open-pull-requests-limit: 10, up from the default 5. Nine distinct actions are in use, and 5 would hold majors back with nothing saying that it had.

What is deliberately absent

No other ecosystem is configured: external dependencies are forbidden, there are no submodules, and the one pinned tool — gcovr in scripts/install.sh — lives in a shell script that no Dependabot ecosystem can parse, so that pin keeps moving by hand.

Dependabot also correctly leaves the five local reusable-workflow references in regression_test.yml alone; they carry no version to move.

Notes

• Ordering was deliberate: this lands after Pinned every action to a commit SHA, and moved them off Node 20 #660. With three to four majors outstanding it would have opened a wall of pull requests against the backlog instead of holding a clean line.
• Dependabot reports drift, not silence. actions/cache@v1 rotted because nothing ran, not because nobody was told; the trigger fixes in Ran the regression suites on dev, where the pull requests actually are #652 and Revived the Cortex-M build, which had compiled nothing since June #653 are the cure for that half.
• No sibling eclipse-threadx repository has a Dependabot configuration, so this sets the pattern rather than following one. The dependencies label it uses already exists in this repository.
• Node 20 is removed from the GitHub runners on 16 September 2026. Pinned every action to a commit SHA, and moved them off Node 20 #660 cleared that backlog; this keeps it cleared.

Assisted-by: Claude Opus 5 noreply@anthropic.com