ci: enable Dependabot version updates for pnpm and actions

[swkeever]

Summary

Part of VOL-1094 (epic VOL-1077). volcano-agentic-plugins had no Dependabot config, so pnpm-lock.yaml and the pinned actions only moved when someone bumped them by hand. This adds .github/dependabot.yml.

npm (pnpm workspace)

• One root entry (directory: "/"). Dependabot reads pnpm-workspace.yaml (packages/*, plugins/*), so it covers the root, packages/core and plugins/vscode against the single lockfile.
• pnpm 10.33.0 is within Dependabot's supported v7–v10. Its npm updater image runs Node 24, which satisfies engines.node.
• Runs weekly with open-pull-requests-limit: 5. Minor and patch updates are grouped into one npm-minor-patch PR, and each major gets its own PR.
• Known Dependabot limitation: majors only get individual PRs on runs where the group has no open PR (dependabot-core#14202; the fix, #16113, is still open). Merging the group PR lets majors through. Upstream reports no config workaround, and the config comments say so.
• Cooldown is 5 days, or 14 for majors.
• Titles are fix(deps): … when a runtime dependency changes, because it ships in the bundled plugins and release-please releases fix. Build and test tooling gets chore(deps-dev): …, which release-please hides, so tooling bumps stay out of releases and the changelog. Today every third-party dependency is a devDependency, so updates arrive as chore(deps-dev).
• Ignored dependencies:
  • @types/vscode must not exceed engines.vscode (^1.85.0). Dependabot's default increase strategy would rewrite it to ^1.140.0, vsce would refuse to package, and the grouped PR would fail validate. Raise both together when the minimum VS Code version moves.
  • Major updates of @types/node, which tracks the Node 24 engine.
• The esbuild override in package.json is a range (>=0.25.0), not a pin, so Dependabot bumps still move the lockfile and are not no-ops.

Synced and vendored content is not bumped

• There's no gitsubmodule entry. sync-skills.yml moves sources/volcano-skills together with the materialized copies, and a bare gitlink bump would fail check:skill-drift.
• plugins/<ide>/skills are byte-identical copies of volcano-skills with no manifests. They aren't workspace packages, and the Actions entry only reads .github/workflows. volcano-skills' own .github/ (including its new dependabot.yml) is excluded by sync-skills-from-source.mjs.
• tests/e2e-agent-eval is local test tooling outside the workspace with no lockfile. Its ^1.4.1 SDK range already resolves to the latest 1.x on install.

github-actions

• Covers / (there are no composite actions under .github/actions).
• Weekly, limit 5, 5-day cooldown (Actions supports default-days only). Minor and patch updates are grouped, majors get their own PRs, and titles are ci(deps): ….

Labels: this repo has no dependency labels, so labels: [] stops Dependabot creating its defaults.

Status (read-only, not changed here)

• Dependabot alerts and security updates are both enabled. There are 37 open alerts, all transitive in pnpm-lock.yaml (brace-expansion, braces, fast-uri, js-yaml, linkify-it, markdown-it, qs, undici), and Dependabot has never opened a PR here. The security-update runs may be failing; Insights → Dependency graph → Dependabot shows their logs. Version updates for npm only bump direct dependencies, so they won't clear these on their own.

Validation

• check-jsonschema --schemafile https://json.schemastore.org/dependabot-2.0.json .github/dependabot.yml: ok.
• Sample titles (chore(deps-dev): bump @vscode/vsce from 3.9.2 to 4.0.0, fix(deps): bump next from 16.3.8 to 17.0.0, ci(deps): bump actions/checkout from 5.1.0 to 6.0.0) pass commitlint config-conventional.
• Dependabot doesn't bump packageManager: it parses only dependencies, devDependencies and optionalDependencies (plus pnpm catalogs). The pinned version: 10.33.0 inputs to pnpm/action-setup therefore stay in step with it.

Notes for reviewers

• Whenever a Dependabot PR fails validate, ci.yml's auto-fix-skill-drift job also runs. It mints its token before checking the cause, and Dependabot-triggered runs can't read secrets.VOLCANO_APP_KEY, so it adds a second red job. If the failure is skill drift because volcano-skills moved upstream, comment @dependabot rebase after the daily sync lands on main.
• The esbuild override is a range, so bumps aren't no-ops. In a copy of this workspace, Dependabot's command sequence (pnpm update esbuild@0.28.2 --lockfile-only --no-save -r, then pnpm install --lockfile-only) moved the lockfile from 0.28.1 to 0.28.2.
• @types/vscode already resolves to 1.125.0 under the ^1.85.0 range, so typecheck allows APIs newer than the minimum VS Code. Pinning it to ~1.85.0 would enforce the engine floor, but that's a separate change.

🤖 Generated with Claude Code

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[swkeever]

@codex review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-07T14:01:16.065458Z	ee8eca6	Manual request
🔒 Security Review	✅ Completed 2026-10-07T14:02:04.476845Z	ee8eca6	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. You're on a roll.

Reviewed commit: 54b1dc3984

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

🛡️ Codex Security Review · Automatically triggered

Security review completed. No security issues were found in this pull request.

Reviewed commit: 54b1dc3984

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

[swkeever]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Nice work!

Reviewed commit: ee8eca669d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

🛡️ Codex Security Review · Automatically triggered

Security review completed. No security issues were found in this pull request.

Reviewed commit: ee8eca669d

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

[github-actions]

⚠️ Post-merge check:skill-submodules failed on main: sources/volcano-skills is behind the canonical repo's HEAD. The scheduled sync workflow will open a submodule-bump PR into main — merge it to restore the pin.