Add Dependabot configuration and stop committing composer.lock

.github/dependabot.yml

@@ -0,0 +1,22 @@
+version: 2
+
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      actions:
+        patterns:
+          - '*'
+    commit-message:
+      prefix: ci
+
+  - package-ecosystem: composer
+    directory: /
+    schedule:
+      interval: weekly
+    # Not a mistake: 0 disables version updates, leaving security updates only.
+    open-pull-requests-limit: 0
+    commit-message:
+      prefix: chore

.github/workflows/ci.yml

@@ -38,7 +38,7 @@ jobs:
           key: lint-composer-${{ hashFiles('**/composer.json') }}
           restore-keys: lint-composer-
       - name: Install dependencies
-        run: composer install --prefer-dist
+        run: composer update --prefer-dist
       - name: Run simple-phpunit version check
         run: ./vendor/bin/simple-phpunit --version
       - name: Run code style check

.gitignore

@@ -1,3 +1,4 @@
 .idea/
 /vendor/
 *.cache
+/composer.lock