fix: stabilize Dependabot — restore missing package.json, add dependabot.yml, regenerate lockfiles

[Copilot]

All Dependabot runs were failing due to a combination of three independent root causes found in CI logs.

Root causes

• dependency_file_not_found for /tests/types — directory had a package-lock.json but no package.json; Dependabot auto-detected it via lockfile scan and then crashed on the missing manifest
• security_update_dependency_not_found on root — .npmrc contained package-lock = false, silently preventing lockfile updates; the committed package-lock.json was stuck at lockfileVersion 1, too old for Dependabot's security resolution logic
• tests/typescript dep tree invisible to Dependabot — its package-lock.json was explicitly gitignored

Changes

• .github/dependabot.yml — added explicit config targeting /, /tests/types, /tests/typescript (npm) and / (github-actions) with weekly schedule and grouped PRs; replaces fragile auto-detection
• tests/types/package.json — restored the missing manifest reconstructed from the existing lockfile's embedded metadata
• .npmrc removed — sole content was package-lock = false; contradicted the checked-in lockfile and broke npm audit fix
• Lockfiles regenerated — root package-lock.json upgraded from lockfileVersion 1 → 3; tests/types lockfile regenerated; tests/typescript lockfile generated and unignored
• CI guardrail added (check-dependency-files job in lint.yml) — fails if any Dependabot-managed npm directory is missing its package.json or package-lock.json, preventing this class of regression

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 complexity · 0 duplication

Metric	Results
Complexity	0
Duplication	0

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes. Give us feedback}

[Copilot]

Pull request overview

Stabilizes Dependabot runs by making npm dependency sources explicit, restoring missing manifests, regenerating lockfiles, and adding CI guardrails to prevent future dependency-file regressions.

Changes:

• Added explicit .github/dependabot.yml configuration for /, /tests/types, /tests/typescript, plus GitHub Actions updates.
• Restored tests/types/package.json and regenerated/added npm lockfiles for test packages (and updated other lockfile metadata).
• Removed .npmrc that disabled lockfile updates, un-ignored tests/typescript/package-lock.json, and added a CI job to assert package.json/package-lock.json pairs exist.

Reviewed changes

Copilot reviewed 6 out of 11 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
.github/dependabot.yml	Explicit Dependabot configuration for npm workspaces and GitHub Actions to avoid fragile auto-detection.
.github/workflows/lint.yml	Adds a CI job to verify each Dependabot-managed npm directory has both manifest + lockfile.
tests/types/package.json	Restores missing npm manifest for the types test directory.
tests/types/package-lock.json	Regenerated lockfile for tests/types (lockfile v3, updated local package metadata).
tests/typescript/package-lock.json	Adds a committed lockfile for tests/typescript so Dependabot can see the dependency tree.
.gitignore	Stops ignoring tests/typescript/package-lock.json so it can be committed/managed.
.npmrc	Removes config that prevented lockfile generation/updates.
build/two.js	Updates generated build output (PublishDate and related identifier renames).
build/two.module.js	Updates generated build output (PublishDate and related identifier renames).

Files not reviewed (2)

• tests/types/package-lock.json: Language not supported
• tests/typescript/package-lock.json: Language not supported

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.