ci: enable Dependabot version updates for pnpm and actions

[swkeever]

Summary

Part of VOL-1094 (epic VOL-1077). Related: VOL-929 (volcano-docs Dependabot alerts).

volcano-docs had no Dependabot config, so pnpm-lock.yaml and the pinned actions only moved when someone bumped them by hand. This adds .github/dependabot.yml.

npm

• One root entry (directory: "/") for the docs site's pnpm project (packageManager: pnpm@10.16.1, no workspace file).
• The examples under content/platform/examples/ stay out of scope. They are synced from volcano-hosting (docs.config.yaml), so VOL-929 fixes them upstream, and a local bump would be overwritten by the next sync. The root entry doesn't read them.
• Runs weekly with open-pull-requests-limit: 5. Minor and patch updates are grouped into one npm-minor-patch PR, and each major gets its own PR.
• Known Dependabot limitation: majors only get individual PRs on runs where the group has no open PR (dependabot-core#14202; the fix, #16113, is still open). Merging the group PR lets majors through. Upstream reports no config workaround, and the config comments say so.
• Cooldown is 5 days, or 14 for majors.
• Titles are fix(deps): … when a runtime dependency changes and chore(deps-dev): … for dev-only updates, matching the commitlint config-conventional hook.
• Major updates of @types/node are ignored because it tracks the Node major in .nvmrc.

github-actions

• Covers / (workflows) and /.github/actions/*, which includes the reusable lint-docs composite action.
• Weekly, limit 5, 5-day cooldown (Actions supports default-days only). Minor and patch updates are grouped, majors get their own PRs, and titles are ci(deps): ….
• scripts/lint-docs-action.test.mjs checks that the action's pnpm version: input equals packageManager. Dependabot changes neither: it only parses dependencies, devDependencies and optionalDependencies, and it doesn't treat with: inputs as versions.
• Source repos call lint-docs at @main, and CI here doesn't run the action itself. Review major bumps to it (separate PRs) against those callers.

Labels: this repo has no dependency labels, so labels: [] stops Dependabot creating its defaults.

Status (read-only, not changed here)

• Dependabot alerts are enabled. There are 26 open alerts: 12 on the root pnpm-lock.yaml and 14 on the two synced example yarn.lock files.
• Dependabot security updates are disabled. Version updates for npm only bump direct dependencies, so the transitive alerts (brace-expansion, fast-uri, js-yaml, nanoid, source-map-js) still need security updates or a manual lockfile refresh.

Validation

• check-jsonschema --schemafile https://json.schemastore.org/dependabot-2.0.json .github/dependabot.yml: ok.
• Sample titles (fix(deps): bump the npm-minor-patch group with 23 updates, chore(deps-dev): bump eslint from 9.39.1 to 10.0.0, ci(deps): bump actions/checkout from 5.1.0 to 6.0.0) pass commitlint config-conventional.
• Dependabot PRs need no secrets for the required validate job.

🤖 Generated with Claude Code

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[swkeever]

@codex review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-07T14:00:35.093769Z	0756398	Manual request
🔒 Security Review	✅ Completed 2026-10-07T14:01:30.458293Z	0756398	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Another round soon, please!

Reviewed commit: 8fbb3866bb

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

🛡️ Codex Security Review · Automatically triggered

Security review completed. No security issues were found in this pull request.

Reviewed commit: 8fbb3866bb

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

[swkeever]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. 🚀

Reviewed commit: 0756398a6f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

🛡️ Codex Security Review · Automatically triggered

Security review completed. No security issues were found in this pull request.

Reviewed commit: 0756398a6f

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.