chore: tweak dependabot configuration (#87)

* chore: get dependabot to honor the commit prefix for dev dependenies
This isn't obviously more correct, but trying to see if keeping version at the very top helps
* chore: dependabot validation in PRs

Author: activescott

.github/dependabot.yml

@@ -1,6 +1,6 @@
-# docs v2 https://docs.github.com/en/free-pro-team@latest/github/administering-a-repository/configuration-options-for-dependency-updates
 version: 2
 updates:
+  # docs v2 https://docs.github.com/en/free-pro-team@latest/github/administering-a-repository/configuration-options-for-dependency-updates
   - package-ecosystem: "npm"
     schedule:
       interval: "monthly"

.github/workflows/dependabot-validate.yml

@@ -0,0 +1,19 @@
+name: dependabot validate
+
+on:
+  pull_request:
+    paths:
+      - ".github/dependabot.yml"
+      - ".github/workflows/dependabot-validate.yml"
+jobs:
+  validate:
+    runs-on: ubuntu-20.04
+    steps:
+      - uses: actions/checkout@v2
+      - uses: marocchino/validate-dependabot@v1
+        id: validate
+      - uses: marocchino/sticky-pull-request-comment@v2
+        if: always()
+        with:
+          header: validate-dependabot
+          message: ${{ steps.validate.outputs.markdown }}