From 02a7048056e48e6b135f22a93de26d0fd3601e36 Mon Sep 17 00:00:00 2001
From: David Christensen <randomparity@gmail.com>
Date: Tue, 25 Aug 2026 16:05:12 -0700
Subject: [PATCH] feat: add dependabot config for github-actions ecosystem

No automated process tracked the repository's SHA-pinned GitHub Actions.
Add .github/dependabot.yml covering the sole detected ecosystem
(github-actions) with a weekly schedule, a 7-day cooldown, and grouped
updates, per the shape $restock's audit expects (skills/restock/SKILL.md,
backed by ADR 0012).

Bump the plugin version per ADR 0022.

Fixes #236
---
 .claude-plugin/plugin.json |  2 +-
 .github/dependabot.yml     | 12 ++++++++++++
 2 files changed, 13 insertions(+), 1 deletion(-)
 create mode 100644 .github/dependabot.yml

diff --git a/.claude-plugin/plugin.json b/.claude-plugin/plugin.json
index 561175a..d7580f9 100644
--- a/.claude-plugin/plugin.json
+++ b/.claude-plugin/plugin.json
@@ -1,6 +1,6 @@
 {
   "name": "adept",
-  "version": "2.9.12",
+  "version": "2.9.15",
   "description": "Development-workflow skills: design, TDD, adversarial review, shipping, and campaign orchestration for Claude Code and Codex.",
   "author": {
     "name": "David Christensen"
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..c77a359
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,12 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 7
+    groups:
+      github-actions-dependencies:
+        patterns:
+          - "*"