[kurok]

Closes #24 for the in-tree part. Three checklist items need repository settings I cannot change; they are listed at the bottom.

Adds .github/dependabot.yml with maven, github-actions and docker, the BOM grouped into one PR rather than one per managed plugin.

The e2e base image needed more than pinning

The issue asked to replace the floating lts-jdk21 tag with an explicit one so Dependabot could bump it. But #30 had since put the image behind an ARG so the compatibility workflow could override it, and Dependabot's Dockerfile parser only matches a literal image:tag on the FROM line:

FROM_LINE = %r{^#{FROM}\s+(#{PLATFORM}\s+)?(#{REGISTRY}/)?#{IMAGE}#{TAG}?(?:@sha256:#{DIGEST})?#{NAME}?}x

No handling for ${VARIABLE} anywhere in docker/lib/dependabot/docker/file_parser.rb. Pinning the ARG default and adding a docker ecosystem would have produced zero PRs, forever — configuration that reads as covered while doing nothing. That is the failure I was trying to avoid by checking, and it is why the diff is bigger than the issue implies.

So the FROM is literal now (jenkins/jenkins:2.568.3-jdk21, a tag I confirmed exists), and the weekly job rewrites that line rather than passing --build-arg.

The second-order trap: just making it literal would silently turn the existing --build-arg into a no-op, and the weekly job would have retested LTS while still reporting itself as the weekly leg — a green check for work it did not do. So the rewrite is verified before the build:

grep -qx 'FROM jenkins/jenkins:latest-jdk21' .github/e2e/Dockerfile.weekly \
  || { echo "::error::the weekly base image rewrite did not take; this job would silently retest LTS"; exit 1; }

The compatibility workflow triggers on pull requests touching .github/e2e/**, so this PR exercises that path instead of me asserting it works.

What this does not do on its own

Nothing, until someone with admin enables it. Dependabot version updates are off by default on forks, so committing the file changes nothing by itself. From the issue's checklist, still outstanding and needing Settings → Code security:

• Dependabot alerts
• Dependabot security updates
• Dependabot version updates ← without this the file is inert

I created the dependencies label the config references, since it did not exist.

Two other things from the issue that are deliberately not done, both correctly so per the issue's own reasoning: jenkins.version stays manual (it is ${jenkins.baseline}.2, and Dependabot cannot reason about that), and the Maven wrapper has no ecosystem and stays a hand bump.