CI: Make sure dependabot can target the backport branch too (#1706)

* Initial plan

* Update dependabot.yml to add GitHub Actions updates for 12.9.x branch

Co-authored-by: leofang <5534781+leofang@users.noreply.github.com>

* fix: update comment to say 'main' instead of 'master'

Co-authored-by: leofang <5534781+leofang@users.noreply.github.com>

* docs: add sync note for target-branch referencing ci/versions.yml

Co-authored-by: leofang <5534781+leofang@users.noreply.github.com>

* docs: cross-reference dependabot.yml in ci/versions.yml

Co-authored-by: leofang <5534781+leofang@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: leofang <5534781+leofang@users.noreply.github.com>

Author: leofang

.github/dependabot.yml

@@ -4,6 +4,7 @@
 
 version: 2
 updates:
+  # GitHub Actions updates targeting the default branch (main)
   - package-ecosystem: github-actions
     directory: /
     schedule:
@@ -19,3 +20,21 @@ updates:
         applies-to: version-updates
         patterns: ["*"]
         update-types: ["major", "minor", "patch"]
+
+  # GitHub Actions updates targeting the 12.9.x branch
+  - package-ecosystem: github-actions
+    directory: /
+    target-branch: "12.9.x"  # keep in sync with backport_branch in ci/versions.yml
+    schedule:
+      interval: "monthly"
+      time: "09:00"
+      timezone: "America/Los_Angeles"
+
+    # Keep churn down: only one open PR from this ecosystem at a time
+    open-pull-requests-limit: 1
+
+    groups:
+      actions-monthly:
+        applies-to: version-updates
+        patterns: ["*"]
+        update-types: ["major", "minor", "patch"]

ci/versions.yml

@@ -1,7 +1,7 @@
 # SPDX-FileCopyrightText: Copyright (c) 2024-2025 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
 # SPDX-License-Identifier: Apache-2.0
 
-backport_branch: "12.9.x"
+backport_branch: "12.9.x"  # keep in sync with target-branch in .github/dependabot.yml
 
 cuda:
   build: