From 6e43096fe48af09de308979d2689d20a7ee3144f Mon Sep 17 00:00:00 2001
From: Ory Medina <ory.medinaceja@tollbit.com>
Date: Tue, 21 Jul 2026 13:56:19 -0600
Subject: [PATCH] [OPSEC] Enable dependabot

---
 .github/dependabot.yml | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)
 create mode 100644 .github/dependabot.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..9ee0834
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,16 @@
+# Routine version-update PRs are intentionally minimal to keep noise low.
+# CVE fixes for Go and npm are handled by Dependabot security updates (a repo
+# setting, event-driven), not by this file. This file only keeps the
+# SHA-pinned GitHub Actions fresh, batched into a single monthly PR.
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: monthly
+    groups:
+      actions:
+        patterns: ["*"]
+        update-types: ["minor", "patch", "major"]
+    commit-message:
+      prefix: ci