Create dependabot.yml

[jauderho]

Summary

Enable Dependabot

Ticket Link

Fixes

This adds .github/dependabot.yml and enables Dependabot monitoring of GitHub Actions versions. Dependabot will create new PRs as necessary.

Release Note

Signed-off-by: Jauder Ho jauderho@users.noreply.github.com

[cpanato]

thanks!

[bobcallaway]

FYI this merge broke the action from running:

https://github.com/sigstore/cosign-installer/actions/runs/1811197864

Invalid workflow file: .github/workflows/test-action.yml#L263
You have an error in your yaml syntax on line 263

[jauderho]

@bobcallaway

Looks like I incorrectly created .github/workflows/dependabot.yml initially when it was supposed to be .github/dependabot.yml. That got fixed but there was a separate indent issue which it looks like you have fixed.

This particular PR did not touch .github/workflows/test-action.yml though.

I think fbb87b5 broke .github/workflows/test-action.yml but it is odd since it's the first time I have seen an issue from using https://app.stepsecurity.io/ to convert workflows to use commit hashes.

Thanks for fixing it and I'll make sure to verify any indent issues going forward.

[bobcallaway]

@bobcallaway

Looks like I incorrectly created .github/workflows/dependabot.yml initially when it was supposed to be .github/dependabot.yml. That got fixed but there was a separate indent issue which it looks like you have fixed.

This particular PR did not touch .github/workflows/test-action.yml though.

I think fbb87b5 broke .github/workflows/test-action.yml but it is odd since it's the first time I have seen an issue from using https://app.stepsecurity.io/ to convert workflows to use commit hashes.

Thanks for fixing it and I'll make sure to verify any indent issues going forward.

no problem, thanks for checking into it :)