task: Scorecard — enable Dependabot/Renovate on upstream-images (Dependency-Update-Tool)

[mirzakopic]

Description

upstream-images is the only platform-mesh repo where Scorecard reports Dependency-Update-Tool: 0/10 — no Dependabot, Renovate, or equivalent is configured. Combined with its already-low overall score (6.2 — the lowest in the org), this is a quick win.

Steps

1. Add .github/dependabot.yml configured for the package ecosystems present in upstream-images (likely docker for Dockerfiles and github-actions for workflows).
2. Optionally: add Renovate instead if the org standardizes on it (check what helm-charts / account-operator use as a reference — most platform-mesh repos use Dependabot).
3. Verify next Scorecard run (weekly) shows Dependency-Update-Tool: 10/10.

Reference config

Sample .github/dependabot.yml:

version: 2
updates:
  - package-ecosystem: "docker"
    directory: "/"
    schedule:
      interval: "weekly"
  - package-ecosystem: "github-actions"
    directory: "/"
    schedule:
      interval: "weekly"

Objectives

• upstream-images reaches Dependency-Update-Tool: 10/10.
• Overall Scorecard score for the repo improves above 7.

Demo Required

None

Demo Steps

No response

---

Epic: #278