[sec-check] No .github/dependabot.yml: all 8 SHA-pinned actions are frozen and can never float onto upstream security fixes

Start by reviewing the existing action pins in .github/workflows/ and confirming the repository's existing dependencies and labels. Add the specified .github/dependabot.yml configuration, then validate that it contains weekly github-actions and npm update entries with the documented grouping and limits; done means Dependabot can process the file without missing-label errors.

Security Finding

Severity: low
Type: supply-chain / hardening gap

.github/dependabot.yml does not exist in this repository, while every uses: across .github/workflows/ is pinned to a full commit SHA:

actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
actions/checkout@11d5960a326750d5838078e36cf38b85af677262
actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b
actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e
actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa
peter-evans/create-pull-request@22a9089034f40e5a961c8808d113e2c98fb63676

SHA pinning is the correct hardening choice — it is what stops a mutable tag being repointed at malicious code. But it has a direct cost: a SHA pin never moves on its own. The only supported mechanism that rewrites a pin and refreshes its trailing version comment is a Dependabot github-actions version-update entry, and that requires this config file. With no config, the github-actions ecosystem is entirely unmonitored and these eight pins are frozen at whatever commit they were set to.

The npm side is only half-covered: Dependabot security updates clearly work here (PRs #158–#162 landed recent bumps), but version updates — routine drift that keeps the tree close to upstream — are not scheduled.

Impact

If an upstream action publishes a security fix, nothing in this repository will ever notice. The pinned SHA keeps running the old, vulnerable code indefinitely, and the gap is silent — no alert, no PR, no failing check. Because these actions hold contents: write / pages: write in the deploy path, a compromised-then-fixed upstream action would leave this repo pinned to the compromised revision. Severity is low only because it requires an upstream event to become exploitable; the missing detection is the durable defect.

Recommendation

Add .github/dependabot.yml with a github-actions entry (this is what refreshes the pins) plus an npm version-update cadence. Exact file:

version: 2

updates:
  - package-ecosystem: 'github-actions'
    directory: '/'
    schedule:
      interval: 'weekly'
      day: 'monday'
    open-pull-requests-limit: 5
    labels:
      - 'dependencies'
    commit-message:
      prefix: 'chore(deps)'
    groups:
      actions:
        patterns:
          - '*'

  - package-ecosystem: 'npm'
    directory: '/'
    schedule:
      interval: 'weekly'
      day: 'monday'
    open-pull-requests-limit: 5
    labels:
      - 'dependencies'
      - 'javascript'
    commit-message:
      prefix: 'chore(deps)'
    groups:
      docusaurus:
        patterns:
          - '@docusaurus/*'
          - 'docusaurus-*'
      dev-dependencies:
        dependency-type: 'development'
      production-minor-patch:
        dependency-type: 'production'
        update-types:
          - 'minor'
          - 'patch'

Notes on the specifics: updates are grouped and capped at 5 open PRs each so the review queue stays shallow, and only labels that already exist in this repo (dependencies, javascript) are named — Dependabot fails a run outright if it is told to apply a label it cannot find.

This file lives at .github/dependabot.yml, not under .github/workflows/, so it is pushable by an agent — a PR implementing exactly this is opened against this issue.

Filed by sec-check agent (ACMM L4/L5 — hold-gated mode)

🐝 Hive Agent: security | Instance: hosted-available-lke648397-260827-5n31 | SHA: 00b44df

— hive: agent=sec-check backend=copilot model=claude-opus-5