ci: weekly Dependabot updates for Cargo and GitHub Actions, tested by CI

Dependabot opens one grouped pull request a week per ecosystem against
develop: compatible Cargo updates together (a breaking release on its
own) and every action together, keeping the SHA pins and their version
comments. The SolidCraft pins, the truck and egui-wgpu patches taken
from that commit and craft-ui's rev move by hand; egui and eframe take
patch releases only, since their line follows SolidCraft's.

CI skips same-repo pull requests, so Dependabot's would merge untested:
the gate, the oracle and the advisories now also run on pull requests
opened by dependabot[bot]. The heavy job stays off pull requests.

Closes #120

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NmAttHhUZTokgPeEJia8sm

.github/dependabot.yml

@@ -0,0 +1,53 @@
+# Weekly dependency updates against develop, the trunk, grouped so each ecosystem opens one pull
+# request a week. Security updates are switched on in the repository settings and open their own
+# pull requests as advisories appear. CI runs the full gate on Dependabot's pull requests
+# (.github/workflows/ci.yml).
+version: 2
+updates:
+  - package-ecosystem: cargo
+    directory: /
+    target-branch: develop
+    schedule:
+      interval: weekly
+      day: monday
+      time: "05:00"
+      timezone: Etc/UTC
+    open-pull-requests-limit: 5
+    commit-message:
+      prefix: deps
+    groups:
+      # Compatible updates (Cargo.lock only) in one pull request; a breaking release of a
+      # dependency comes on its own, since it usually needs code changes.
+      cargo-compatible:
+        update-types: [minor, patch]
+    ignore:
+      # Pinned to the SolidCraft commit FieldCraft builds against, together with the truck and
+      # egui-wgpu patches from that commit ([patch.crates-io] in Cargo.toml); moved by hand.
+      - dependency-name: "solidcraft-*"
+      - dependency-name: "truck-*"
+      - dependency-name: matext4cgmath
+      - dependency-name: egui-wgpu
+      # The egui line follows SolidCraft's (its egui-wgpu fixes are patched in): patch releases
+      # come with the group, a new line (0.36 -> 0.37) moves by hand with SolidCraft.
+      - dependency-name: egui
+        update-types: ["version-update:semver-major", "version-update:semver-minor"]
+      - dependency-name: eframe
+        update-types: ["version-update:semver-major", "version-update:semver-minor"]
+      # The shared Craft components follow VectorCraft's rev.
+      - dependency-name: craft-ui
+
+  - package-ecosystem: github-actions
+    directory: /
+    target-branch: develop
+    schedule:
+      interval: weekly
+      day: monday
+      time: "05:00"
+      timezone: Etc/UTC
+    open-pull-requests-limit: 3
+    commit-message:
+      prefix: ci
+    groups:
+      # Actions are pinned by commit SHA with a version comment; Dependabot updates both.
+      actions:
+        patterns: ["*"]

.github/workflows/ci.yml

@@ -4,7 +4,8 @@ name: CI
 # team's pull requests are checked locally on the crates they touch and merged; a red trunk is
 # fixed forward. `main` holds released code only (docs/releasing.md).
 # Pull requests from forks (outside contributors) run the full gate, once the maintainer approves
-# the run, so the review sees it.
+# the run, so the review sees it; so do Dependabot's (.github/dependabot.yml), which nobody tests
+# locally. The heavy job stays off pull requests.
 on:
   pull_request:
     paths:
@@ -47,7 +48,7 @@ env:
 jobs:
   ci:
     name: cargo xtask ci
-    if: github.event.schedule != '41 4 * * 0' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.repository)
+    if: github.event.schedule != '41 4 * * 0' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.repository || github.event.pull_request.user.login == 'dependabot[bot]')
     runs-on: ubuntu-24.04
     timeout-minutes: 60
     steps:
@@ -80,7 +81,7 @@ jobs:
     # its fixture, and docs/oracle.md must be the table the cases produce. Cases marked `slow`
     # run here too while the whole set stays within a few minutes; `--quick` skips them.
     name: cargo xtask oracle
-    if: github.event.schedule != '41 4 * * 0' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.repository)
+    if: github.event.schedule != '41 4 * * 0' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.repository || github.event.pull_request.user.login == 'dependabot[bot]')
     runs-on: ubuntu-24.04
     timeout-minutes: 45
     steps:
@@ -114,7 +115,7 @@ jobs:
 
   advisories:
     name: Dependency advisories and sources
-    if: github.event.schedule != '41 4 * * 0' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.repository)
+    if: github.event.schedule != '41 4 * * 0' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.repository || github.event.pull_request.user.login == 'dependabot[bot]')
     runs-on: ubuntu-24.04
     timeout-minutes: 20
     steps: