infra: no Dependabot — action and Gradle pins drift silently #14

The library repo has .github/dependabot.yml; this one doesn't. The drift is already visible in the workflows — compare what each repo pins for the same actions:

Nobody chose that. The library's pins move because Dependabot opens the PR; here they stay wherever they were typed.

The Gradle side matters more. plugin/build.gradle.kts pins:

id("org.jetbrains.intellij.platform") version "2.1.0"
intellijIdeaCommunity("2024.3.5")

and core/build.gradle.kts pins JUnit 5.11.4 and AssertJ 3.27.0. The IntelliJ Platform Gradle Plugin ships fixes for exactly the kind of trap the CI in #13 had to work around, and nothing here surfaces that a newer one exists.

What to do

Add .github/dependabot.yml with two ecosystems:

version: 2
updates:
  - package-ecosystem: gradle
    directory: "/"
    schedule: { interval: weekly }
  - package-ecosystem: github-actions
    directory: "/"
    schedule: { interval: weekly }

Two things worth copying from stacktale/stacktale/.github/dependabot.yml rather than inventing:

• Group the minor/patch updates. Ungrouped, a weekly run on two ecosystems opens a handful of separate PRs, each burning a full CI run including the Plugin Verifier's IDE downloads. The library groups them into one PR for a reason.
• Keep major updates separate and unmerged by default. A major bump of the IntelliJ Platform Gradle Plugin can change task names and DSL shapes; that deserves its own review, not a rubber stamp.

Leave intellijIdeaCommunity("2024.3.5") alone for now — Dependabot can't reason about it as a dependency version, and bumping the compile target is a compatibility decision, not a maintenance one.

Verify

Open the PR, then check the Insights → Dependency graph → Dependabot tab shows both ecosystems with a "last checked" time. The real confirmation is the first grouped PR arriving and CI going green on it.