ci(dependabot): add github-actions ecosystem with grouped updates

[wochinge]

• add GitHub actions to dependabot updates

Disclaimer: Experimental PR review

Greptile Summary

This PR extends the existing dependabot.yml configuration to include GitHub Actions dependency updates. The new github-actions ecosystem block mirrors the style of the existing uv block (daily schedule, rebase disabled, chore commit prefix, and grouped updates) and groups all action updates into a single PR via the wildcard "*" pattern.

• Adds package-ecosystem: "github-actions" with directory: "/", which is the correct path for Dependabot to discover .github/workflows/ files
• Groups all GitHub Actions updates under a single github-actions group, reducing PR noise
• Configuration is consistent with the existing uv ecosystem block
• The existing dependabot-merge.yml workflow auto-merges patch-level Dependabot PRs; for grouped GitHub Actions updates, the update type will often be semver-minor or semver-major, meaning auto-merge will likely not trigger automatically — this is the safe/expected behavior

Confidence Score: 5/5

This PR is safe to merge — it is a minimal, low-risk CI configuration change that adds GitHub Actions ecosystem tracking to Dependabot.

The change is a straightforward addition to dependabot.yml, fully consistent with the existing configuration style. There are no code logic changes, no runtime behavior changes, and the configuration syntax is correct for the github-actions ecosystem. No issues were found.

No files require special attention.

Important Files Changed

Filename	Overview
.github/dependabot.yml	Adds a new github-actions ecosystem block to dependabot, grouping all actions into a single update PR on a daily schedule — consistent with the existing uv ecosystem configuration.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[Dependabot daily schedule] --> B{Ecosystem}
    B --> C[uv - Python packages]
    B --> D[github-actions - NEW]

    C --> E[Check pyproject.toml / uv.lock]
    D --> F[Check .github/workflows/*.yml]

    E --> G[Group: langchain*]
    E --> H[Group: llama-index*]
    E --> I[Other packages - individual PRs]

    F --> J[Group: all actions - single PR]

    G --> K[Open grouped Dependabot PR]
    H --> K
    I --> K
    J --> K

    K --> L{dependabot-merge.yml update-type == semver-patch?}
    L -- Yes --> M[Auto-merge via gh pr merge --squash]
    L -- No --> N[Requires manual review & merge]

    K --> O[dependabot-rebase-stale.yml rebases stale PRs on push to main]

Loading

_{Reviews (1): Last reviewed commit: "ci(dependabot): add github-actions ecosy..." | Re-trigger Greptile}

[github-actions]

@claude review