Timeline: tag Dependabot event stories with taxonomy data-* attributes

[janmaarten-a11y]

This tags the Dependabot Timeline event stories with the taxonomy data-* attributes, part of the Phase 3 tagging fan-out (github/primer#6664, epic github/primer#6654). It applies the same data-* contract proven by the License Compliance pilot (#8216), consuming the merged taxonomy module (#8180) and its docs (github/primer#6888).

Each cataloged Timeline.Item in Timeline.dependabot.features.stories.tsx spreads the output of a local dependabotAttrs helper, which projects toEventDataAttributes. The helper derives data-event-category and data-event-visibility from the DEPENDABOT_TAXONOMY catalog entry (never hand-typed) and resolves data-actor-type at runtime from each row's rendered actor login: Dependabot authored rows resolve to bot, user driven rows to user.

Per rendered <li> the contract is: data-event-scope="dependabot", data-event-type (the unscoped leaf), data-event-category, data-event-visibility (defaults primary), and data-actor-type. The event groups map as: Opened rows to opened, Fixed rows to fixed, all Dismissed and Auto-dismissed rows to dismissed, all Reopened, Reintroduced and Auto-reopened rows to reopened, and the delegated dismissal rows to dismissal_requested, dismissal_reviewed (approved and denied), and dismissal_cancelled.

The Assignment and Copilot-work event groups stay untagged. They are cross-surface shared events deliberately kept out of the per-surface Dependabot catalog (github/primer#6888), so they intentionally carry no data-* attributes. A code comment above each group records this.

This is a Storybook-only change with no visual difference and no runtime component change.

Changelog

New

• Taxonomy data-* attributes on the cataloged Dependabot Timeline event story
  rows.

Changed

• Nothing consumer-facing. Story markup only.

Removed

• Nothing.

Rollout strategy

• Patch release
• Minor release
• Major release; if selected, include a written rollout or migration plan
• None; if selected, include a brief description as to why

Storybook-only story changes with no published-package impact, so no release is needed. The PR carries the skip changeset label.

Testing & Reviewing

Validated against the repository's own gates with zero new errors: prettier, eslint, stylelint, and type-check. A temporary browser test rendered the tagged stories in real Chromium and asserted the rendered <li> rows:

• An EventOpened row carries data-event-scope="dependabot", data-event-type="opened", data-event-category="findings", data-event-visibility="primary", data-actor-type="bot".
• A manual EventDismissed row carries data-actor-type="user"; an auto-dismissed row carries data-actor-type="bot".
• The EventDismissalRequest cancelled row carries data-event-type="dismissal_cancelled" and data-event-category="reviews".
• EventAssignment and EventCopilotWork rows carry no data-event-* attributes.

The temporary test was removed after validation. Reviewers can confirm the attributes in Storybook via the browser inspector on any Dependabot event story.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 6097825

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR