From 2b2301d06f7cfa3788ac1eb8783f77f6c814866c Mon Sep 17 00:00:00 2001
From: thewrz <adam@wrzeski.net>
Date: Sat, 1 Aug 2026 13:15:06 -0700
Subject: [PATCH] chore(ci): run Dependabot alongside Renovate for update
 coverage

Renovate has been this repo's only dependency-update tool, and every run was
suppressed by Mend's platform-level `mode=silent` -- no PRs, no Dependency
Dashboard. Meanwhile the repo accumulated 39 open Dependabot vulnerability
alerts, 30 of them high severity, across three npm workspaces and a uv-managed
Python service.

Adds a Dependabot config covering the full dependency surface: npm in /bridge,
/bridge-app and /dashboard, uv in /server, the three Dockerfiles, and the
workflow action pins. Group shapes and Conventional Commit prefixes mirror
renovate.json so the two tools' output is directly comparable, and the DJ
protocol libs (alphatheta-connect, stagelinq) stay out of grouped PRs so they
keep arriving individually for manual review.

Dependabot alerts and security updates are now enabled on the repo.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 .github/dependabot.yml | 104 +++++++++++++++++++++++++++++++++++++++++
 1 file changed, 104 insertions(+)
 create mode 100644 .github/dependabot.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 00000000..22e10b85
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,104 @@
+# Dependabot runs alongside Mend Renovate (renovate.json) on purpose.
+#
+# Every Renovate run in this org was suppressed by Mend's platform-level
+# `mode=silent`, which blocked all PRs and Dependency Dashboards. Dependabot is
+# enabled here so dependency updates stay visible, and so the two tools can be
+# compared side by side before we settle on one. Expect duplicate PRs until then
+# -- that is intentional, not a misconfiguration.
+#
+# Ecosystem coverage mirrors the repo layout: three npm workspaces, one uv-managed
+# Python service, three Dockerfiles, and the workflow pins.
+version: 2
+
+updates:
+  # --- npm workspaces ---
+  - package-ecosystem: "npm"
+    directory: "/bridge"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 20
+    commit-message:
+      prefix: "chore(deps)"
+    groups:
+      bridge-minor-patch:
+        update-types:
+          - "minor"
+          - "patch"
+        # DJ protocol libs are manual-review only (see renovate.json); keep them
+        # out of the grouped PR so each arrives on its own and gets read.
+        exclude-patterns:
+          - "alphatheta-connect"
+          - "stagelinq"
+
+  - package-ecosystem: "npm"
+    directory: "/bridge-app"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 20
+    commit-message:
+      prefix: "chore(deps)"
+    groups:
+      electron-forge:
+        patterns:
+          - "@electron-forge/*"
+      bridge-app-minor-patch:
+        update-types:
+          - "minor"
+          - "patch"
+        exclude-patterns:
+          - "@electron-forge/*"
+          - "alphatheta-connect"
+          - "stagelinq"
+
+  - package-ecosystem: "npm"
+    directory: "/dashboard"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 20
+    commit-message:
+      prefix: "chore(deps)"
+    groups:
+      dashboard-minor-patch:
+        update-types:
+          - "minor"
+          - "patch"
+
+  # --- Python service (uv.lock + pyproject.toml) ---
+  - package-ecosystem: "uv"
+    directory: "/server"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 20
+    commit-message:
+      prefix: "chore(deps)"
+    groups:
+      server-minor-patch:
+        update-types:
+          - "minor"
+          - "patch"
+
+  # --- container base images ---
+  - package-ecosystem: "docker"
+    directories:
+      - "/bridge"
+      - "/dashboard"
+      - "/server"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 10
+    commit-message:
+      prefix: "chore(docker)"
+
+  # --- workflow action pins ---
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 20
+    commit-message:
+      prefix: "chore(ci)"
+    groups:
+      github-actions-minor-patch:
+        update-types:
+          - "minor"
+          - "patch"