chore: add Dependabot config for NuGet and GitHub Actions

[WomB0ComB0]

Every version in this repo is pinned by hand, and nothing was set up to move any of it — 47 NuGet packages under Central Package Management, 11 actions pinned to commit SHAs, no dependabot.yml, no Renovate config. Pins without an updater are pins that rot, security pins included.

That risk is already visible in-tree. Directory.Packages.props carries a hand-written transitive pin:

<!-- Transitive security pin: force System.Text.Json off the vulnerable <=8.0.4 line
     (CVE-2024-43485 / GHSA-8g4q-xg66-9fp4). -->
<PackageVersion Include="System.Text.Json" Version="9.0.19" />

Someone had to notice that by hand. This automates noticing the next one.

Three update streams

Stream	Why separate
nuget /	Root CPM — all versions in one Directory.Packages.props, so bumps are edits to a single file
nuget /templates/resq-service	Template ships its own Directory.Packages.props and restores outside the root tree (see NuGet.config), so the root scan never reaches it. Bumps here change what downstream services scaffold with, so they deserve their own review
github-actions /	SHA pins. Dependabot updates them in place and rewrites the trailing # vX.Y.Z comment, so pins stay pins

Grouping is deliberate

• microsoft — Microsoft.Extensions.* / EF Core / AspNetCore ship as one versioned wave; split into separate PRs they fail to restore against each other. System.Text.Json rides along for the same reason.
• resq-buildingblocks — these are this repo's own published packages, referenced by the template and versioned together off one MinVer tag. Ungrouped, every release would open eight near-identical template PRs.
• opentelemetry, testing, analyzers — same-wave families.

github/gh-aw-actions* is ignored: it is version-locked to the gh-aw compiler and rewritten into the *.lock.yml files by gh aw compile, so a bump here is reverted on the next compile.

Verification

• Config parses as valid YAML v2 (3 update entries, 7 groups).
• Every group pattern was matched against the 47 package ids actually present — zero dead patterns. This caught two I had guessed wrong: Shouldly and Verify* are not used here (the repo uses FluentAssertions), so those patterns were removed rather than shipped as dead config.
• The chore and deps labels were created first. A config naming labels that do not exist makes Dependabot refuse to label its PRs — exactly what happened in chore(deps): bump actions/stale from 10 to 11 in the github-actions group across 1 directory docs#117.

Judgment calls worth a look

1. Template bumps. I opted the template directory in. It means the template tracks current package versions, but it will generate PRs that change scaffolding output. Reasonable to drop that entry if you would rather pin template content to a known-good set.
2. 17 packages stay ungrouped (FluentValidation, Polly.Core, Scrutor, MinVer, Npgsql*, Scalar.AspNetCore, …) and will get individual PRs. That is intentional — they version independently — but the weekly limit of 5 will throttle them.
3. Schedule is Monday 06:17 UTC, matching the convention already used in resq-software/docs.

[github-actions]

Audit Results: PASS

The Dependabot configuration is thorough and correctly targets both the root solution (CPM) and the dotnet new template. Grouping strategies are well-reasoned and align with the versioning waves of the underlying frameworks.

Minor Observations:

• Grouping Consistency: In the template-deps group for /templates/resq-service, NSubstitute and FluentAssertions are missing from the patterns, whereas they are included in the testing group for the root solution. Adding them would ensure that test dependency updates in the template are also grouped.
• OpenTelemetry: OpenTelemetry has its own group in the root but is merged into template-deps in the template. This is likely acceptable given the smaller dependency set in the template.

No security vulnerabilities or logic bugs were identified.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• localhost

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "localhost"

See Network Configuration for more information.

Generated by ai-auditor for #14 · age00 · 26.2 AIC · ⌖ 1.15 AIC · ⊞ 7.6K · ◷