Configure Dependabot for vendored Go dependencies

Configure Dependabot to keep dependencies current.

Scope:

Enable Go module updates for go.mod and go.sum.
Enable GitHub Actions updates for pinned action revisions.
Ensure Go dependency pull requests regenerate and include vendor/ (for example, with go mod tidy && go mod vendor).
Keep CI running with GOFLAGS=-mod=vendor so inconsistent vendor metadata fails validation.

This is follow-up work to the initial dependency vendoring setup.

@t-lo

@t-lo @elmiko Can we enable Dependabot Alerts? Currently I see:

Dependabot alerts are inactive.

I don't have the permission myself. This was approved by tormath1

@t-lo

i don't have permissions here to enable it (i don't think), but @t-lo or @tormath1 should be able to help.

Navigation Menu