From 28b6fe33d5a961e848a3e1d40330225099ac9fb1 Mon Sep 17 00:00:00 2001
From: Stefan Zimmermann <5945920+StefanZ8n@users.noreply.github.com>
Date: Tue, 15 Sep 2026 14:02:26 +0200
Subject: [PATCH] Add CODEOWNERS and Dependabot version updates

CODEOWNERS makes the maintainer the reviewer of every pull request, which
turns the README's "sole active maintainer" statement into an automatic
review request. Dependabot version updates cover Go modules, the web UI's
npm packages, the GitHub Actions in the workflows and the Docker base
images, weekly and grouped per ecosystem so they arrive as one PR each.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 .github/CODEOWNERS     |  2 ++
 .github/dependabot.yml | 43 ++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 45 insertions(+)
 create mode 100644 .github/CODEOWNERS
 create mode 100644 .github/dependabot.yml

diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
new file mode 100644
index 0000000..fbfd1bb
--- /dev/null
+++ b/.github/CODEOWNERS
@@ -0,0 +1,2 @@
+# Every change is reviewed by the maintainer(s) listed in the README.
+* @StefanZ8n
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..9325c07
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,43 @@
+# Weekly, grouped dependency updates. Each ecosystem produces at most one PR
+# per week, so review stays cheap; security updates are configured in the
+# repository's Security settings and arrive separately.
+version: 2
+updates:
+  - package-ecosystem: gomod
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+    groups:
+      go-modules:
+        patterns: ["*"]
+
+  - package-ecosystem: npm
+    directory: /web
+    schedule:
+      interval: weekly
+      day: monday
+    groups:
+      web-dependencies:
+        patterns: ["*"]
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+    groups:
+      github-actions:
+        patterns: ["*"]
+
+  # Base images of the controller, netboot and tempos images. A bump of the
+  # tempos Alpine base changes the temp-OS kernel the ghost VMs boot, so test
+  # a fill in the lab before merging one of these.
+  - package-ecosystem: docker
+    directory: /deploy
+    schedule:
+      interval: weekly
+      day: monday
+    groups:
+      base-images:
+        patterns: ["*"]