Configure Dependabot to monitor GitHub Actions workflow dependencies

[Copilot]

Description

Enables automated dependency updates for GitHub Actions used in CI/CD workflows. Dependabot will now create PRs when newer versions of actions (e.g., actions/checkout, github/codeql-action) are available.

Resolves #292

Changes

• Added github-actions package ecosystem to .github/dependabot.yml
• Configured weekly update schedule (consistent with existing Maven configuration)

Checklist:

• Public methods are documented
• Public methods are tested
• New and existing tests pass when run locally
• There are no new warnings or errors

Original prompt

---

This section details on the original issue you should resolve

<issue_title>[Enhancement]: Monitor and update GitHub Actions workflow dependencies with Dependabot</issue_title>
<issue_description>### What

Dependabot should be configured to monitor and automatically update dependencies used in GitHub Actions workflows (files in .github/workflows). This allows action versions to stay up-to-date and secure without manual intervention. The change involves updating .github/dependabot.yml to include the github-actions package-ecosystem, ensuring workflow actions are checked for updates regularly.

Why

Automated updates for workflow actions improve the security, reliability, and maintainability of the CI/CD process. It reduces the risk of using outdated or insecure GitHub Actions, helps catch security vulnerabilities quickly, and keeps our workflows in line with best practices through automatic PRs.

Notes

Example of what to add to .github/dependabot.yml:

- package-ecosystem: "github-actions"
  directory: "/"
  schedule:
    interval: "weekly"

Further reference: https://docs.github.com/en/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/configuration-options-for-dependency-updates

Previously discussed as a bug due to the risk to CI/CD from outdated workflows.</issue_description>

Comments on the Issue (you are @copilot in this section)

• Fixes [Enhancement]: Monitor and update GitHub Actions workflow dependencies with Dependabot #292

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud