I found out that dependabot can update the generated `~.lock.yml` files, bumping dependencies (usually github action versions). Will that work or should this be flagged within the dependabot team to ignore those files?