fix: add Dependabot config for gomod + github-actions weekly updates (PILOT-384)

[matthew-pilot]

Summary

Add .github/dependabot.yml to enable automated weekly dependency updates for:

• Go modules (gomod) — limit 5 PRs, labeled dependencies + go
• GitHub Actions — limit 5 PRs, labeled dependencies + ci

Scope

• 1 file, +19/-0 lines (small tier)
• .github/workflows/notify-canary.yml is intentionally NOT included — blocked by global paths_denied policy (.github/workflows/**). Needs operator creation.

Verification

• go build ./... ✅
• go vet ./... ⚠️ pre-existing issues in internal/server (not from this change)
• go test ./... pending (cosift test suite is large)

Jira

https://vulturelabs.atlassian.net/browse/PILOT-384

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[matthew-pilot]

🤖 PR Status Check

PR #10: fix: add Dependabot config for gomod + github-actions weekly updates (PILOT-384)
State: open | Mergeable: MERGEABLE (clean) ✅
CI: 2/2 ✅ all passing
Changes: +19/−0 in 1 file(s)
Labels: (none)

---

matthew-pr-worker • 2026-06-02T22:18:00Z

[matthew-pilot]

🤖 PR Explanation

fix: add Dependabot config for gomod + github-actions weekly updates (PILOT-384)

Summary

Summary

Add .github/dependabot.yml to enable automated weekly dependency updates for:

• Go modules (gomod) — limit 5 PRs, labeled dependencies + go
• GitHub Actions — limit 5 PRs, labeled dependencies + ci

Scope

• 1 file, +19/-0 lines (small tier)
• .github/workflows/notify-canary.yml is intentionally NOT included — blocked by global paths_denied policy (.github/workflows/**). Needs operator creation.

Verification

• go build ./... ✅
• go vet ./... ⚠️ pre-existi...

Changes

+19/−0 lines across 1 file(s):

• .github/dependabot.yml (+19/−0): version: 2

Files Changed

.github/dependabot.yml

---

matthew-pr-worker • 2026-06-02T22:18:00Z

[matthew-pilot]

📊 PR Status — Self-Review

PR #10: fix: add Dependabot config for gomod + github-actions weekly updates (PILOT-384)
State: open · Mergeable: ✅ yes (clean)
CI: ✅ test passed · ✅ codecov/patch passed · ✅ snyk passed
Canary: not triggered (.github/workflows/** blocked by paths_denied)
Jira: PILOT-384
Created: 2026-06-02 22:09 UTC · Branch: openclaw/pilot-384-...
Scope: 1 file, +19/-0 (small tier — dependabot config)

Self-authored config-only PR. All CI green. Ready for operator review.