[cristim]

Summary

Adds .github/dependabot.yml, the last item of #1594. It sets weekly checks with one grouped PR and at most two open PRs per ecosystem, for github-actions and gomod at the root. This repo has no npm, Docker or Terraform manifests.

It mirrors cloud-commitments-mcp's config and cloud-commitments-go's (LeanerCloud/cloud-commitments-go#604, merged).

#1594 left Dependabot vs CODEOWNERS open. The merged precedents (cloud-commitments-mcp#84 and LeanerCloud/cloud-commitments-go#604) both ship Dependabot without CODEOWNERS, and this PR follows them. Adding CODEOWNERS later is a separate, small change. The issue's other cli items landed in #2234 and #2241. The rest of the original findings were split to the other repos.

Tests

• pre-commit run --files .github/dependabot.yml passes, including check-yaml.
• The schema matches the two configs already running in go and mcp.

Closes #1594

🤖 Generated with Claude Code

[coderabbitai]

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: LeanerCloud/cloud-commitments-cli
• Branch: ci/dependabot
• File: .coderabbit.yaml
• Commit: 5a82750
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Essentials
• Run ID: 12060b83-bfe5-4b22-984e-8714fb38a715

Commits

Reviewing files that changed from the base of the PR and between 3d8e4cd and 5a82750.

Files selected for processing: 1

• .github/dependabot.yml

Included review availability: This review used your included allowance. 0 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 2 reviews per hour.

Walkthrough

Adds Dependabot version 2 configuration for weekly GitHub Actions and Go module updates. Each ecosystem has a limit of two open pull requests and groups matching updates under its ecosystem name.

Changes: Dependabot updates

Layer / File(s)	Summary
Configure ecosystem updates .github/dependabot.yml	Adds weekly update schedules for GitHub Actions and Go modules. Limits each ecosystem to two open pull requests and groups matching updates by ecosystem.

Priority: Low

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Other

Possibly related issues

• The issue describing missing Dependabot configuration in the CLI repository matches this change, which adds configuration for GitHub Actions and Go modules.

Merge Risk: Minimal · up to 5a827

The Dependabot configuration matches the stated update scope and is ready to merge.

Pre-merge checks: 4

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: adding Dependabot configuration for GitHub Actions and Go modules.
Linked Issues check		The reviewed head satisfies the coding requirements in #1594. .github/dependabot.yml adds weekly, grouped updates for github-actions and gomod at /, with open-pull-requests-limit: 2 for each…
Out of Scope Changes check		The whole-PR diff contains only .github/dependabot.yml. The file implements the Dependabot requirement in #1594. No unrelated production, test, or configuration changes are present.

Full details: Linked Issues check

Explanation

The reviewed head satisfies the coding requirements in #1594. .github/dependabot.yml adds weekly, grouped updates for github-actions and gomod at /, with open-pull-requests-limit: 2 for each ecosystem. Existing .pre-commit-config.yaml pins third-party repositories to full SHAs, runs check-yaml without excluding workflows, and defines an actionlint hook. Existing .golangci.yml sets gocyclo.min-complexity to 10. CODEOWNERS is conditional in #1594 and is not required by the selected Dependabot approach.

Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[cristim]

Cold review (claude-autospotting) at 5a82750: APPROVE

Schema. Valid: version: 2 and updates[], where each entry has package-ecosystem, directory, schedule.interval: weekly, open-pull-requests-limit and groups.<name>.patterns. The file parses cleanly as YAML.

Ecosystem inventory at the head.

• Go: a single go.mod at the root. go.work contains only use ., so gomod at / is enough.
• Actions: ci.yml and pre-commit.yml, covered by github-actions at /.
• Not present: Dockerfile, package.json, .tf, Python requirements and pyproject.
• .pre-commit-config.yaml hook revs: pinned to SHAs in chore(pre-commit): pin hook revisions to SHAs and align the gocyclo threshold #2241. Dependabot has no pre-commit ecosystem, so this is expected, not a gap.

Mirroring.

• cloud-commitments-mcp: same github-actions and gomod entries. mcp also has npm for its server-json validator, which cli has no equivalent of.
• cloud-commitments-go: same github-actions entry. go has one gomod entry per nested module, and cli has a single root module.
• Shared style across all three: limit 2, weekly, one ["*"] group per ecosystem.

#1594 (cli-scoped items).

• check-yaml workflow exclusion dropped: done by chore: prune monorepo residue from config and docs #2234 (merged).
• Pre-commit revs pinned to SHAs and gocyclo aligned to 10: done by chore(pre-commit): pin hook revisions to SHAs and align the gocyclo threshold #2241 (merged).
• actionlint hook: already on main.
• Dependabot for github-actions and gomod: done by this PR.
• CODEOWNERS: not done. chore(ci): medium/low findings from the 2026-07-28 full review #1594 asks for it only "if this repo wants review gating", and an earlier comment calls it an owner policy decision. If the owner declines it, "Closes chore(ci): medium/low findings from the 2026-07-28 full review #1594" is accurate. Otherwise, record the decision on the PR or change it to "Refs chore(ci): medium/low findings from the 2026-07-28 full review #1594".
• The items for other repos were split out to cloud-commitments-platform#349, cloud-commitments-go#121 and cloud-commitments-mcp#23, and do not block this PR.

No blocking findings.

[cristim]

Cold review (claude-cc-libs reviewer agent) at 5a82750: APPROVE

Findings:

1. Schema, .github/dependabot.yml:1-18. Each entry has the required keys from the docs.github.com Dependabot options reference: version: 2, package-ecosystem, directory, schedule.interval. open-pull-requests-limit and groups.<name>.patterns are valid optional keys. The file passes check-jsonschema --builtin-schema vendor.dependabot and check-yaml. Apart from the group name, it is identical to the github-actions and gomod entries in cloud-commitments-mcp's config. mcp also has an npm entry for .github/scripts/server-json-validator, which has no counterpart here. go's config uses one gomod entry per module directory because go has 5 modules.
2. Ecosystem coverage at the head is complete for what Dependabot can see: one go.mod at the root, no nested go.mod, no Dockerfile or compose file, no package.json, no .tf, and no Python manifests. .github/ holds only workflows/ (ci.yml and pre-commit.yml), plus this file.
3. Non-blocking: Dependabot now supports package-ecosystem: pre-commit. It would keep the SHA pins at .pre-commit-config.yaml:33 and :130 current, and chore(ci): medium/low findings from the 2026-07-28 full review #1594's own rationale for this item is that pins rot without automation. This is the same omission as in go and mcp, so it belongs in a cross-repo follow-up.
4. The chore(ci): medium/low findings from the 2026-07-28 full review #1594 scoped checklist (the "Scope after the split" section) is done on main plus this PR:
   • SHA pins: .pre-commit-config.yaml:33,130 (chore(pre-commit): pin hook revisions to SHAs and align the gocyclo threshold #2241, merged).
   • check-yaml covers workflows: :39-40 has no exclude (chore: prune monorepo residue from config and docs #2234, merged).
   • actionlint and zizmor hooks: :101, :120.
   • min-complexity: 10: .golangci.yml:43 (chore(pre-commit): pin hook revisions to SHAs and align the gocyclo threshold #2241).
   • Dependabot: this PR.
   • The Makefile fail-hard targets and gocyclo -ignore are also on main: Makefile:68,72-73,90.
5. Split verified:
   • platform#349 is open and carries the terraform, docker, deploy, Snyk, Trivy, coverage, .env.example and heredoc items, plus audit findings A13-013, A13-016/017, A13-021, A14-034, A14-037 and A14-041.
   • go#121 is open and is being closed by go#654.
   • mcp#23 was closed by mcp#84, merged.
6. Residual in this repo's own tree, outside the scoped checklist. The scope section marks these "resolved-by-split", but platform#349 tracks only platform's copy:
   • Snyk is continue-on-error: true (.github/workflows/ci.yml:450), and snyk-scan is not in ci-success's needs (:478-484).
   • The Trivy fs scan is advisory (:407, no exit-code).
   • The coverage threshold only warns (:274-275).
     The Snyk and Trivy choices carry in-code rationale (:446-447, :407), so they look deliberate. The coverage warning has no rationale. This does not block closing chore(ci): medium/low findings from the 2026-07-28 full review #1594 as scoped, but I'd file a small cli follow-up or an explicit owner "won't fix" for these three.
7. CODEOWNERS is not added. That is justified, because the item is conditional ("if this repo wants review gating") and the owner merged mcp#84, which explicitly omitted it. The PR body's "the owner chose" overstates the record: chore(ci): medium/low findings from the 2026-07-28 full review #1594's last comment leaves the choice to the owner, and no reply records one. The evidence is the mcp#84 merge.

What I attacked and how: I read the full #1594 body and its 3 comments, schema-validated the file, ran find for every manifest type, diffed against mcp's live config, grepped the split issues for each original item, and grepped cli's ci.yml for the original MEDIUM items.

CI at 5a82750: every check passes, including CI Success, Run pre-commit hooks, Lint Workflows, Unit Tests and Integration Tests. The Trivy and gosec code-scanning runs report "skipping".