ci: add dependabot configuration for dependency updates

[raghavendra-talur]

Configure Dependabot to open weekly PRs for gomod, pip, docker, and github-actions ecosystems. Include all module directories: gomod: /, /api, /e2e, /test/timestamp
pip: /, /test, /ramendev

Assisted-by: Claude Code/claude-opus-4-6

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: c229e758-8abc-458c-ac1c-c824d58415fc

📥 Commits

Reviewing files that changed from the base of the PR and between 1482673 and 4fa879b.

📒 Files selected for processing (1)

• .github/dependabot.yml

📜 Recent review details

⏰ Context from checks skipped due to timeout. (20)

• GitHub Check: test
• GitHub Check: drenv (ubuntu-24.04, 3.14-dev)
• GitHub Check: drenv (ubuntu-24.04, 3.10)
• GitHub Check: ramendev (ubuntu-24.04, 3.14-dev)
• GitHub Check: ramendev (ubuntu-24.04, 3.10)
• GitHub Check: drenv (ubuntu-24.04, 3.13)
• GitHub Check: drenv (ubuntu-24.04, 3.11)
• GitHub Check: ramendev (macos-14, 3.13)
• GitHub Check: drenv (ubuntu-24.04, 3.12)
• GitHub Check: ramendev (ubuntu-24.04, 3.12)
• GitHub Check: drenv (macos-latest, 3.13)
• GitHub Check: ramendev (ubuntu-24.04, 3.13)
• GitHub Check: Unit tests
• GitHub Check: E2E unit tests
• GitHub Check: Go compatibility
• GitHub Check: Golangci Lint (e2e)
• GitHub Check: Golangci Lint (api)
• GitHub Check: Build image
• GitHub Check: Linters
• GitHub Check: Golangci Lint (.)

🔇 Additional comments (2)

.github/dependabot.yml (2)

1-4: LGTM!

---

6-24: 🎯 Functional Correctness

No changes needed.

All configured Dependabot directories exist and contain dependency files for their selected ecosystems.

---

📝 Walkthrough

Summary by CodeRabbit

• Chores
  • Added automated weekly checks for dependency updates across Go, Python, Docker, and GitHub Actions components.

Walkthrough

The pull request adds a Dependabot version 2 configuration. It schedules weekly updates for four Go modules, three Python directories, Docker dependencies, and GitHub Actions. The file also includes SPDX metadata.

Changes

Dependabot configuration

Layer / File(s)	Summary
Weekly dependency update schedules .github/dependabot.yml	Adds weekly Dependabot update entries for Go modules, Python packages, Docker dependencies, and GitHub Actions. Includes SPDX metadata.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Suggested reviewers: shyamsundarr, benamarmk

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely describes the addition of Dependabot configuration for dependency updates.
Description check	✅ Passed	The description accurately explains the Dependabot ecosystems, update frequency, and configured module directories.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[nirs]

Can you explain each package echosystem? Which packages will be updated from each?

How unversioned packages will be handled (e.g. requirements.txt, github actions)?

Regarding weekly, this may create too much noise, and consume updates that are too new. We want to wait at least a week before we update any package to avoid compromised packages. Maybe start with monthy updates?