From f9b4713abbedf1db08e9396bfb618b61e778e495 Mon Sep 17 00:00:00 2001
From: Carlo D'Ambrosio <carlo@ql4b.net>
Date: Tue, 20 Oct 2026 14:50:07 +0200
Subject: [PATCH] chore(ci): add Dependabot config for release toolchain

Group all npm (semantic-release) bumps into one weekly PR, plus grouped
GitHub Actions updates. Keeps the dev toolchain current with minimal noise.
---
 .github/dependabot.yml | 29 +++++++++++++++++++++++++++++
 1 file changed, 29 insertions(+)
 create mode 100644 .github/dependabot.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..3b35776
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,29 @@
+version: 2
+updates:
+  # Release toolchain (semantic-release + conventional-changelog).
+  # All deps are devDependencies; the runtime is shell with no Node runtime
+  # deps. Group every bump into a single weekly PR to keep noise low and to
+  # keep the toolchain current (which prevents advisories like the handlebars
+  # criticals from re-accruing).
+  - package-ecosystem: npm
+    directory: "/"
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+    groups:
+      release-toolchain:
+        patterns:
+          - "*"
+    commit-message:
+      prefix: "chore(deps)"
+
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: weekly
+    groups:
+      actions:
+        patterns:
+          - "*"
+    commit-message:
+      prefix: "chore(ci)"