build(ci): add Dependabot configuration for all package ecosystems

[DoDiODev]

Summary

Adds .github/dependabot.yml so that dependency updates arrive as reviewable
pull requests instead of periodic manual audits.

This is a configuration-only change. No source file, build step or runtime
behaviour is touched, and rolling it back means deleting one file.

The configuration covers six ecosystem entries across 14 directories:

Ecosystem	Directories	Manifests found
gomod	/backend	go.mod
npm	/config-ui	package.json + yarn.lock
npm	/e2e	package.json (no lockfile)
pip	/backend/python, /backend/python/pydevlake, /backend/python/plugins/azuredevops, /backend/python/test/fakeplugin, /grafana/scripts	2 × requirements.txt, 3 × pyproject.toml + poetry.lock
docker	/backend, /config-ui, /grafana, /devops/docker/lake-builder, /.devcontainer	6 Dockerfiles
github-actions	/	14 workflows + .github/actions/auto-cherry-pick

Design decisions

Weekly schedule, five open pull requests per ecosystem. Enough to keep the
tree moving without flooding review capacity.

Minor and patch updates are grouped, majors stay separate. A grouped pull
request keeps low-risk churn to a single review; a major change deserves its own
discussion. This mirrors how the recent manual dependency batches were split.

commit-message.prefix: build(deps). .github/workflows/commit-msg.yml
rejects any commit that does not match its conventional-commit pattern. The
prefix was verified against that exact regular expression, including the grouped
form (build(deps): bump the … group across 5 directories with 3 updates) and
the development-dependency form (build(deps-dev): …).

Language base images are pinned deliberately, so they are ignored. In Docker
tag semantics python:3.11 → python:3.14 and golang:1.26 → golang:1.27 are
minor updates. They are not dependency bumps, though: the Python tag has to
match what the Poetry lockfiles resolve against, and the Go tag has to match the
go directive in backend/go.mod and the toolchain used by CI. Both are
therefore ignored for minor as well as major updates and remain a conscious,
manual decision. node is ignored for majors only, because the build image
tracks the active LTS line and Node 26 is not an LTS release.

versioning-strategy: increase for /e2e. That directory declares
"@playwright/test": "^1.58.2" and has no lockfile. With the default strategy
Dependabot only rewrites a manifest once a release leaves the declared range, so
the entry would have produced nothing while still looking configured.

git2go is never bumped automatically. It is ABI-coupled to the libgit2
version installed in the builder image; a mismatch fails at link time.

Action pinning

Most workflows reference actions by tag. The docker/* actions are pinned to a
commit SHA with a # vX.Y.Z comment, for example:

uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f  # v7.1.0

Dependabot updates such a pin to the new commit SHA and rewrites the version
comment, so the pinning style is preserved rather than replaced by a tag.

Dependabot never proposes changing the namespace of an action. Moving to a
differently owned action stays a manual step, which matters here because ASF
infrastructure maintains an allow-list of permitted actions.

Files that are not valid workflows are not read at all — this includes
.github/workflows/codespell.yml.action-blocked-by-asf and
go-checklist.yml.bak. The blocked Codespell action is therefore left alone.

Deferred upgrades

Every ignore entry carries a comment explaining why it exists, so it can be
removed once the reason no longer applies:

Entry	Reason
typescript (major)	TypeScript 7 is the native-port compiler; adopting it means validating the whole build chain at once
node (major)	Node 26 is not an LTS release
github.com/swaggo/swag (major)	swag v2 is still a release candidate and requires regenerating every swagger annotation
github.com/libgit2/git2go/*	ABI-coupled to libgit2
go	the toolchain directive moves together with CI and the base images
python, golang, mcr.microsoft.com/devcontainers/go (major + minor)	runtime decisions, see above

Not covered

Stating this explicitly, because a configuration file can otherwise suggest more
coverage than it provides:

• docker-compose*.yml — the docker ecosystem reads Dockerfiles only, so
  the mysql and postgres service images stay on manual maintenance.
• devops/deployment/k8s/k8s-deploy.yaml and the Helm chart — images pinned
  in plain YAML are not a supported manifest format.
• backend/scripts/install-mockery.sh — a tool version inside a shell
  script.
• apache/skywalking-eyes@main — a branch reference rather than a version.
• Unpinned entries in backend/python/requirements.txt — without a version
  constraint there is nothing to raise.

Validation

• YAML parses cleanly.
• Validated against the SchemaStore dependabot-2.0.json schema (Draft 7) with
  no violations, which also confirms the plural directories key and every
  update-types value used.
• All 14 configured directories exist and contain the expected manifest.
• The commit message convention was checked against the regular expression in
  .github/workflows/commit-msg.yml for six representative bot commit forms.

Verified on a fork before opening this PR

This configuration was run against a fork with version updates enabled. On
2026-09-01 it produced 17 pull requests across five ecosystems, which
confirms the behaviour that matters here:

• Grouping works. js-minor-patch bundled 21 updates into a single PR,
  actions-minor-patch bundled 4, and python-minor-patch bundled 3 across two
  directories. Major bumps stayed outside the groups, as intended.
• Action pins stay pins. The github-actions group PR rewrote SHAs to new
  SHAs and carried the # vX.Y.Z comment along, e.g.
  docker/setup-qemu-action@ce36039… # v4.0.0 became
  docker/setup-qemu-action@96fe6ef… # v4.2.0. No pin was downgraded to a tag.
• versioning-strategy: increase is required for /e2e. It produced
  update @playwright/test requirement from ^1.58.2 to ^1.62.1 - a bump that
  would otherwise stay silent, because the new release already satisfies the
  declared caret range and that directory has no lockfile.
• The ignore rules hold. typescript is at 6.0.3 with 7.0.2 available and
  no PR was raised. The language images (node, golang, python) were
  likewise left alone.
• open-pull-requests-limit throttles. The github-actions ecosystem
  stopped exactly at its limit of 5.

Two issues surfaced during that run and are already fixed in this branch:

1. dependency-name: mcr.microsoft.com/devcontainers/go never matched, because
   Dependabot strips the registry host from the dependency name. Using
   devcontainers/go fixes it - after the change Dependabot closed the
   superfluous PR itself with "Looks like devcontainers/go is no longer being
   updated by Dependabot".
2. Explicit labels were dropped. Dependabot only creates its default labels
   automatically; labels named in the configuration must already exist, and none
   of the ones originally chosen exist in this repository. Every PR carried a
   "The following labels could not be found" warning. Without the key,
   Dependabot applies and creates its defaults, so no repository setup is
   required up front. Maintainers can add their own labels later if they want
   them.

Known limitation: the gomod ecosystem

The sixth ecosystem, gomod, could not be verified. It fails for a reason that
is independent of this configuration: backend/mocks/ is gitignored while
tracked sources such as helpers/unithelper import it, so go mod tidy cannot
resolve those packages and Dependabot aborts after every version bump.

The same failure reproduces on a plain checkout without Dependabot involved:

go: github.com/apache/incubator-devlake/helpers/unithelper imports
        github.com/apache/incubator-devlake/mocks/core/dal: no matching versions for query "latest"

Generating the mocks first makes go mod tidy exit cleanly and leaves go.mod
and go.sum byte-identical, so the module itself is consistent.

This is tracked separately in #9088. Until it is
resolved, the gomod block in this file will not produce pull requests. It is
kept in place so that Go updates start working as soon as the underlying issue
is fixed - reviewers may of course prefer to drop the block until then.

Rollback

Delete the file. Any pull requests Dependabot has already opened need to be
closed manually.