From c43aa336ae73a21db6f32a0fd73e4c282138a2c7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Jeanneret?= <cjeanner@redhat.com>
Date: Tue, 7 Jul 2026 13:35:13 +0200
Subject: [PATCH] feat(ci): add Dependabot configuration for automated
 dependency updates

Add comprehensive Dependabot configuration to automate dependency
updates across GitHub Actions, Python packages, and Docker images.

Configuration monitors:
- GitHub Actions workflows (weekly updates)
- Python dependencies in requirements.txt files (weekly updates)
- Container images in Job manifests (weekly updates)

Weekly schedule on Mondays provides regular security updates while
maintaining manageable PR volume for maintainers.

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
---
 .github/dependabot.yml | 79 ++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 79 insertions(+)
 create mode 100644 .github/dependabot.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..82b544c
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,79 @@
+---
+version: 2
+updates:
+  # GitHub Actions - weekly security updates
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    labels:
+      - "dependencies"
+      - "github-actions"
+    open-pull-requests-limit: 10
+
+  # Python dependencies - root directory
+  - package-ecosystem: "pip"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    labels:
+      - "dependencies"
+      - "python"
+    open-pull-requests-limit: 10
+
+  # Python dependencies - openshift-gitops.deploy
+  - package-ecosystem: "pip"
+    directory: "/openshift-gitops.deploy"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    labels:
+      - "dependencies"
+      - "python"
+    open-pull-requests-limit: 10
+
+  # Docker images in approve-installplan utility
+  - package-ecosystem: "docker"
+    directory: "/components/utilities/approve-installplan"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    labels:
+      - "dependencies"
+      - "docker"
+    open-pull-requests-limit: 5
+
+  # Docker images in controlplane post-delete hook
+  - package-ecosystem: "docker"
+    directory: "/components/argocd/hooks/postDelete/controlplane"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    labels:
+      - "dependencies"
+      - "docker"
+    open-pull-requests-limit: 5
+
+  # Docker images in dataplane post-delete hook
+  - package-ecosystem: "docker"
+    directory: "/components/argocd/hooks/postDelete/dataplane"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    labels:
+      - "dependencies"
+      - "docker"
+    open-pull-requests-limit: 5
+
+  # Docker images in observability post-delete hook
+  - package-ecosystem: "docker"
+    directory: "/components/argocd/hooks/postDelete/deploy-operators"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    labels:
+      - "dependencies"
+      - "docker"
+    open-pull-requests-limit: 5