Update Dependabot GitHub packages

[opslevel]

Summary of Changes

Overview

Successfully added GitHub Actions ecosystem monitoring to the Dependabot configuration for the active_model_serializers repository.

Changes Made

Created File

• .github/dependabot.yml - New Dependabot configuration file

File Content

version: 2
updates:
- package-ecosystem: github-actions
  directory: /
  schedule:
    interval: weekly

Requirements Fulfilled

✅ Located/Created .github/dependabot.yml file

• File was not present initially and has been created

✅ Added github-actions package ecosystem

• Configured to monitor GitHub Actions workflows

✅ Set directory to "/"

• Monitors all workflow files in the repository

✅ Configured weekly update schedule

• Set interval: "weekly" as specified

✅ Maintained proper YAML formatting

• Valid YAML syntax
• Proper indentation using spaces
• Follows Dependabot schema requirements

✅ Validated configuration

• Version set to 2 (current Dependabot schema version)
• Updates configured as a list
• All required fields present

Testing Performed

1. Initial State Check: Verified that .github/dependabot.yml did not exist
2. File Creation: Created the configuration file with the required settings
3. Validation: Confirmed all requirements are met:
   • File exists at correct location
   • github-actions ecosystem is configured
   • Directory is set to "/"
   • Schedule interval is "weekly"
   • YAML is valid and properly formatted
4. Idempotency Test: Re-ran the update script to ensure it correctly detects existing configuration
5. Edge Cases: Tested various scenarios including:
   • No file exists (handled ✓)
   • Empty file (handled ✓)
   • File with other ecosystems (handled ✓)
   • File already has github-actions (handled ✓)

Benefits

• Automated Security Updates: Dependabot will now automatically create PRs to update GitHub Actions versions
• Improved Maintenance: Weekly checks ensure actions stay current with latest versions
• Security Posture: Reduces risk of using outdated or vulnerable action versions
• Low Overhead: Weekly schedule balances staying current with manageable PR frequency

Notes

• The repository currently uses Travis CI (.travis.yml present) but the Dependabot configuration is future-proof
• If GitHub Actions workflows are added in the future, they will automatically be monitored
• Configuration follows GitHub's official Dependabot schema and best practices
• The implementation is minimal and non-invasive to existing repository structure