ci(dependabot): label npm and actions updates with dependencies only

[Astro-Han]

Summary

Dependabot applies its default labels to every update PR because neither block in .github/dependabot.yml sets labels: dependencies plus a language label, javascript for npm and github_actions for github-actions. The javascript label exists only because of this default. It appears on dependabot PRs (36 PRs, 2 issues) and nothing else: no workflow filters on it and no maintainer uses it. The github_actions label does not exist in the repository at all.

This PR sets labels: [dependencies] on both the npm and github-actions blocks so dependabot stops applying language labels. ignore, groups and everything else are untouched.

The config change has to land first: deleting the javascript label today would only get it recreated by dependabot on its next update.

Follow-up after merge

• A maintainer deletes the javascript label from the repository.

Verification

• npm run format and npm run lint run clean (YAML is outside Biome's scope, so this only confirms no side effects).
• Dependabot behavior cannot be exercised locally. The labels key follows the documented dependabot.yml schema.

AI use

Select exactly one:

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

Tool(s) and scope: Claude Code authored the entire change (config edit, commit message, PR description).

Checklist

• Tests cover the change and fail without it (not applicable: dependabot configuration has no test surface)
• Lint, format, typecheck and the affected suites pass locally

Does this PR entail a change in behavior?

• Yes — described under Summary above
• No

[jackwener]

Approving at exact head cd4e68733a9647425ec45667bd6cff8e793e344d. No findings.

Four lines, and the claims behind them check out. Nothing in .github/workflows/ filters on javascript or github_actions, so no automation loses an input when dependabot stops applying them. dependencies already exists as a repository label, so the replacement set is not creating one on the fly. github_actions is indeed absent from the label list, which matches the description.

Setting labels replaces dependabot's defaults rather than adding to them, which is what makes the language label go away, and ignore, groups and the schedules are untouched.

The ordering in the description is right and worth keeping: the config has to land before anyone deletes the javascript label, or dependabot recreates it on the next update.

This is still marked as a draft, and the approval covers the review gate only — a draft cannot merge regardless.

Evidence boundary: dependabot's behaviour cannot be exercised locally, so the effect of the labels key rests on its documented schema, not on an observed run.

简体中文

在 cd4e68733a9647425ec45667bd6cff8e793e344d 上批准。没有发现。

四行改动,背后的主张我核过了。.github/workflows/ 里没有任何地方以 javascript 或 github_actions 作为筛选条件,所以 dependabot 不再打这些标签时,没有自动化会因此少掉输入。dependencies 已经是仓库里既有的标签,所以替换后的集合不会临时新建标签。github_actions 确实不在标签列表中,与描述一致。

设置 labels 是替换 dependabot 的默认值而不是追加,这正是语言标签消失的原因;ignore、groups 和调度都没有被动到。

描述里的先后顺序是对的,值得保留:必须先合配置,再删 javascript 标签,否则 dependabot 会在下一次更新时把它重新创建出来。

这个 PR 目前仍标记为草稿,本批准只覆盖审查门禁——草稿无论如何都无法合并。

证据边界:dependabot 的行为无法在本地验证,所以 labels 键的效果依据的是它的文档化 schema,而不是一次实际观测到的运行。

---

Automated review notice: This comment was posted by an automated review agent operated by jackwener. It is not an independent human review and does not replace one.