chore(ci): add .github/dependabot.yml — stop recurring astro-major PR flood (closes #123)

[beeeku]

Summary

Closes #123. Adds an explicit .github/dependabot.yml so Dependabot stops re-opening the same Astro-major bump against apps/docs every couple of weeks (five recurrences so far: #110, #116, #119, #121, #122) — every one blocked on the same Starlight peer-dep wall tracked in #115. Same treatment pre-empts the workspace-wide Vitest v3 → v4 tracker in #120.

What ships

.github/dependabot.yml with two directory entries that mirror the repo's actual dependency graph:

• /apps/docs — its own manifest with astro + @astrojs/starlight + @astrojs/tailwind. Groups patch/minor into the existing implicit npm_and_yarn group PR, ignores astro majors until docs: Astro 6 upgrade tracker (apps/docs) — blocked on Starlight #115 lands.
• / — Bun workspace root; the shared root lockfile resolves every packages/*, integrations/*, and tooling/* transitive dep. Ignores vitest majors until chore(deps): Vitest 4 upgrade tracker — workspace-wide migration from v3 #120 lands.

Both ignore entries carry an inline comment pointing to their tracker issue, so the entry becomes obviously removable once the tracked migration lands.

One divergence from #123's proposed yaml

The issue's spec placed the vitest ignore under /apps/docs. I moved it to the root block after confirming apps/docs/package.json has no vitest dependency — an ignore there would never fire. Vitest lives in the root manifest and packages/*/devDependencies via @workkit/vitest-config, so / is where the ignore actually takes effect. Same behavioral outcome as the acceptance criteria demand: no new Vitest-major PRs until #120 removes the entry.

Sanity-checks from #123

1. "Does anything today rely on the implicit no-config behavior?" No — I checked. There is no existing .github/dependabot.yml. Adding one narrows Dependabot to the enumerated directories, which is exactly the intent. Root / and /apps/docs are the only two manifests where new-dep-version PRs are meaningful; workspace packages inherit through the root lockfile.
2. "Does declaring the npm_and_yarn group conflict with the auto-generated group name Dependabot has been using?" The group name matches what Dependabot has been emitting in the PR titles (npm_and_yarn group across N directories), so tracker automations keying on that name should keep working. Only /apps/docs declares the group here; the root block leaves per-dep PRs alone since there is no equivalent recurrence pattern to consolidate on that side.

Acceptance criteria (from #123)

• .github/dependabot.yml added with the two ignore entries (astro major on /apps/docs, vitest major on /).
• Both ignore entries include an inline comment naming the tracker so the removal condition is obvious.
• After merge, no new Astro-major PR opens until docs: Astro 6 upgrade tracker (apps/docs) — blocked on Starlight #115 removes the ignore entry — verifiable on the next Dependabot run.
• After merge, no new Vitest-major PR opens until chore(deps): Vitest 4 upgrade tracker — workspace-wide migration from v3 #120 removes the ignore entry — verifiable on the next Dependabot run.
• Existing patch/minor dep bumps still flow into the apps/docs npm_and_yarn group — verifiable on the next Dependabot run.

Follow-ups this unblocks

• chore(deps): bump astro from 5.18.2 to 7.1.3 in /apps/docs in the npm_and_yarn group across 1 directory #122 (open Astro 5.18.2 → 7.1.3 bump) can be closed once this merges; Dependabot will not re-open it. I've left an audit note there earlier; no need to re-comment until the config takes effect.
• docs: Astro 6 upgrade tracker (apps/docs) — blocked on Starlight #115 and chore(deps): Vitest 4 upgrade tracker — workspace-wide migration from v3 #120 now each own a well-defined "remove the ignore entry in .github/dependabot.yml" step as part of their close-out, so future me does not forget the migration is done.

Test plan

• bun run constitution:check --diff-only --base=origin/master (the diff is a single top-level config file — no packages/*/src/** or apps/*/src/** touched, so constitution gates should be a no-op)
• YAML lint passes (.github/dependabot.yml is 43 lines, well-formed YAML with only well-known Dependabot keys)
• After merge: watch for a lack of new Astro-major PR at the next Dependabot cadence; existing chore(deps): bump astro from 5.18.2 to 7.1.3 in /apps/docs in the npm_and_yarn group across 1 directory #122 can be closed with ·@·d·ependabot i·gnore t·his major version in the meantime.

---

Generated by Claude Code

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 5c3591a0-84b7-4aea-a888-a5a8aaf90617

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Bundle Size Report

Package	Base	PR	Delta
@workkit/agent	80KiB	80KiB	no change
@workkit/ai	93KiB	93KiB	no change
@workkit/ai-gateway	260KiB	260KiB	no change
@workkit/api	119KiB	119KiB	no change
@workkit/approval	106KiB	106KiB	no change
@workkit/astro	18KiB	18KiB	no change
@workkit/auth	48KiB	48KiB	no change
@workkit/browser	32KiB	32KiB	no change
@workkit/cache	39KiB	39KiB	no change
@workkit/chat	46KiB	46KiB	no change
@workkit/cli	312KiB	312KiB	no change
@workkit/cron	68KiB	68KiB	no change
@workkit/crypto	40KiB	40KiB	no change
@workkit/d1	90KiB	90KiB	no change
@workkit/do	58KiB	58KiB	no change
@workkit/env	43KiB	43KiB	no change
@workkit/errors	40KiB	40KiB	no change
@workkit/features	23KiB	23KiB	no change
@workkit/health	19KiB	19KiB	no change
@workkit/hono	36KiB	36KiB	no change
@workkit/kv	52KiB	52KiB	no change
@workkit/logger	24KiB	24KiB	no change
@workkit/mail	54KiB	54KiB	no change
@workkit/mcp	127KiB	127KiB	no change
@workkit/memory	41KiB	41KiB	no change
@workkit/notify	290KiB	290KiB	no change
@workkit/pdf	36KiB	36KiB	no change
@workkit/queue	54KiB	54KiB	no change
@workkit/r2	57KiB	57KiB	no change
@workkit/ratelimit	51KiB	51KiB	no change
@workkit/realtime	44KiB	44KiB	no change
@workkit/remix	34KiB	34KiB	no change
@workkit/testing	114KiB	114KiB	no change
@workkit/turnstile	14KiB	14KiB	no change
@workkit/types	21KiB	21KiB	no change
@workkit/workflow	46KiB	46KiB	no change