Dependabot: monthly version updates

.github/dependabot.yml

@@ -0,0 +1,20 @@
+# Keeps dependencies and CI actions current (security alerts are on separately). Once a month,
+# minor and patch updates are grouped into one pull request per ecosystem and folder; a major
+# version comes as its own pull request and is reviewed before merging. CI checks every update.
+version: 2
+updates:
+  - package-ecosystem: pip
+    directory: "/"
+    schedule:
+      interval: monthly
+    groups:
+      pip-minor-patch:
+        update-types: [minor, patch]
+
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: monthly
+    groups:
+      github-actions-minor-patch:
+        update-types: [minor, patch]

README.md

@@ -211,6 +211,8 @@ traces as an artifact. A manual run (Run workflow) can choose the `demo` markers
 CI. [Automation Coverage & Quality Intelligence](https://github.com/niranjankagri/automation-coverage-quality-intelligence) reads the
 `junit.xml` in these artifacts for its cross-repository dashboard.
 
+Dependabot proposes dependency and GitHub Actions updates once a month (minor and patch updates grouped, major versions as separate pull requests).
+
 `main` is protected by a ruleset: every change goes through a pull request, and the CI jobs above must pass before it is merged.
 
 ## Code quality