Remove Dependabot github-actions config to eliminate duplicate dependency PRs with Renovate

[fullsend-ai-retro]

What happened

PR #965 was a routine Tekton task digest update from Renovate (red-hat-konflux[bot]) that was auto-analyzed, auto-approved, and auto-merged in 37 minutes. While reviewing the broader dependency PR landscape, I found that the repo runs both Dependabot (.github/dependabot.yml for github-actions) and Renovate (.github/renovate.json with config:recommended which includes GitHub Actions). This creates duplicate PRs for the same dependency updates.

Current open duplicate pairs include:

• golangci-lint-action: Bump golangci/golangci-lint-action from 9.2.1 to 9.3.0 #959 (Dependabot) vs Update golangci/golangci-lint-action digest to ba0d7d2 #954 (Renovate)
• codeql-action: Bump github/codeql-action/upload-sarif from 4.36.2 to 4.36.3 #958 (Dependabot) vs chore(deps): update github/codeql-action action to v4.37.0 #957 (Renovate)
• actions/checkout v7: Bump actions/checkout from 6.0.2 to 7.0.0 #944 (Dependabot) vs Update actions/checkout action to v7 #943 (Renovate)
• codecov-action v7: Bump codecov/codecov-action from 6.0.1 to 7.0.0 #931 (Dependabot) vs Update codecov/codecov-action action to v7 #939 (Renovate)
• actions/setup-go: Bump actions/setup-go from 6.4.0 to 6.5.0 #953 (Dependabot, likely also tracked by Renovate)

Historically, Renovate PRs get merged via the deptriage+auto-merge pipeline, and the Dependabot duplicates are left open until manually closed (e.g., #952 was closed unmerged 2 minutes after its Renovate counterpart #955 was merged).

There are currently 5 open Dependabot PRs and 16 open Renovate PRs. The Dependabot PRs lack deptriage labels and cannot use the auto-merge pipeline.

What could go better

The duplicate PRs waste resources in multiple ways: (1) CI runs execute on both Dependabot and Renovate PRs for the same update, (2) the fullsend review agent reviews both copies, doubling token spend, (3) open Dependabot PRs add noise to the PR queue making it harder for maintainers to see what needs attention, and (4) someone must eventually close the Dependabot duplicates manually or wait for Dependabot to detect the branch is up-to-date.

The Renovate pipeline is strictly superior for this repo because it integrates with deptriage (AI risk analysis + auto-labeling), auto-approve, and auto-merge. Dependabot PRs get none of these automations — they sit open with requires-manual-review until a human acts.

Confidence: High. The overlap is clearly visible in the current PR list and the pattern is consistent across multiple dependency updates over the past month.

Proposed change

Remove or empty the .github/dependabot.yml file to stop Dependabot from creating GitHub Actions dependency update PRs. Renovate already covers this scope via config:recommended.

Specifically, either:

1. Delete .github/dependabot.yml entirely, or
2. Replace its contents with a minimal config that disables all ecosystems:

version: 2
updates: []

After removing Dependabot, close the 5 existing open Dependabot PRs (#931, #944, #953, #958, #959) that duplicate Renovate coverage.

No changes to .github/renovate.json are needed — it already covers GitHub Actions via config:recommended and has well-configured package rules for grouping and auto-merge.

Validation criteria

After the change: (1) no new Dependabot PRs are created for GitHub Actions updates — verify by waiting one week and confirming zero new PRs from dependabot[bot], (2) Renovate continues to create and manage GitHub Actions dependency PRs as before, (3) the existing 5 open Dependabot PRs are closed, (4) the total open PR count drops by approximately 5, reducing maintainer triage burden.

---

Generated by retro agent from #965

[fullsend-ai-triage]

🤖 Finished Triage · ✅ Success · Started 11:15 AM UTC · Completed 11:18 AM UTC
Commit: 14477fe · View workflow run →

[fullsend-ai-triage]

Triage Summary

Severity: Low · Category: CI/CD Configuration Cleanup

Problem

Both Dependabot and Renovate are configured to update GitHub Actions dependencies, producing duplicate PRs for the same updates. Verified by inspecting both config files and the current open PR list, which shows matching pairs (e.g., golangci-lint-action, codeql-action, actions/checkout, codecov-action).

Renovate PRs integrate with the deptriage + auto-merge pipeline and get merged automatically. Dependabot PRs lack these automations and accumulate until manually closed.

Recommended Fix

1. Delete .github/dependabot.yml (or replace with an empty updates config)
2. Close the 5 open Dependabot PRs that duplicate Renovate coverage: Bump codecov/codecov-action from 6.0.1 to 7.0.0 #931, Bump actions/checkout from 6.0.2 to 7.0.0 #944, Bump actions/setup-go from 6.4.0 to 6.5.0 #953, Bump github/codeql-action/upload-sarif from 4.36.2 to 4.36.3 #958, Bump golangci/golangci-lint-action from 9.2.1 to 9.3.0 #959
3. No changes to .github/renovate.json needed — it already covers GitHub Actions via config:recommended

Proposed Verification

1. Confirm dependabot.yml is removed or has empty updates array
2. Confirm renovate.json is unchanged
3. Wait one week and verify zero new PRs from dependabot[bot]
4. Verify Renovate continues creating GitHub Actions PRs normally

This is a straightforward config cleanup with clear evidence and no risk to existing automation.

---

Labels: This is a good-first-issue config cleanup affecting github_actions CI. Marking as enhancement since it improves the dependency management workflow. Removing ready-for-triage as triage is complete.