Add dependabot config

[yimsk]

Weekly dependency updates for gomod and github-actions

[claude]

PR Review: Add dependabot config

Summary

This PR adds a Dependabot configuration to automate dependency updates for Go modules and GitHub Actions. Overall, this is a well-structured and valuable addition that will help keep dependencies up-to-date and secure.

Code Quality & Best Practices ✅

Strengths:

• Clean, well-organized YAML structure
• Logical grouping of related dependencies (AWS SDK, Charm libraries, golang.org/x packages)
• Appropriate use of commit message prefixes (deps, ci) for automated commits
• Proper labeling for easy PR identification
• Weekly schedule is a good balance between staying current and avoiding notification fatigue

Configuration Details:

• .github/dependabot.yml:1-33 - Configuration is properly structured according to Dependabot v2 schema

Specific Feedback

1. Open Pull Requests Limit

Location: .github/dependabot.yml:10

This limit only applies to gomod ecosystem, not github-actions. Consider adding the same limit to the github-actions section for consistency.

2. Dependency Grouping Strategy

Location: .github/dependabot.yml:12-22

The grouping is excellent and aligns well with your dependencies in go.mod:

• aws-sdk group: Covers the extensive AWS SDK usage
• charm group: Covers Charm/Bubbletea TUI libraries
• golang-x group: Covers standard Go experimental packages

Potential Issues 🔍

No critical issues found. The configuration is solid.

Minor observations:

1. Charm dependencies use v2.0.0-rc versions - these might have more frequent updates
2. With 80+ AWS SDK packages, the aws-sdk group could generate large PRs - this is intentional and good

Performance Considerations ⚡

• Weekly schedule is appropriate
• Grouping strategy will reduce PR volume significantly
• Open PR limit of 5 prevents overwhelming maintainers

Security Considerations 🔒

Positive security impacts:

• Automated dependency updates help address CVEs quickly
• AWS SDK updates often include security patches
• GitHub Actions updates prevent supply chain vulnerabilities

Recommendation: Consider enabling security-only updates with a daily schedule

Final Recommendation

✅ APPROVE - This is a clean, well-thought-out configuration.

Optional enhancements:

1. Add open-pull-requests-limit to github-actions ecosystem
2. Consider adding assignees/reviewers
3. Consider a separate daily security-only update schedule

Great work on proactive dependency management!

---

Review generated by Claude Code