ci: 添加 dependabot 配置，所有依赖更新合并为一个 PR

[solarhell]

改动

新增 .github/dependabot.yml，参考 wolotech 各仓库（wolowork-backend、temp-email、wolowork-admin-frontend）的约定：

• 版本更新合并为一个 PR：backend/（gomod）与 frontend/（pnpm）通过 multi-ecosystem-groups 的 dependencies 组合并，含大版本升级，一个 PR 提所有。
• 安全更新单独成组：每个生态各一个 security-dependencies 组（dependabot 的跨生态组只支持版本更新，安全更新按生态分组）。
• 每日 09:00（Asia/Shanghai）检查，提交前缀 chore(deps)，标签 dependencies + go / javascript。

验证

• 通过 SchemaStore 的 dependabot-2.0.json 校验（check-jsonschema）。
• 合并后可在 Insights → Dependency graph → Dependabot 查看配置解析结果和分组。

现有 4 个 dependabot PR

#9、#10、#11、#12 是配置生效前的单包 PR（其中 #10、#11、#12 是安全更新）。合并本 PR 后，dependabot 下次运行会按分组重新生成 PR 并关闭旧的；不想等到明早可在 Insights → Dependabot 页面点「Check for updates」。

Summary by CodeRabbit

• Chores
  • Configured automated daily dependency update checks for the backend and frontend.
  • Grouped regular dependency updates into a single pull request and security updates separately.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: e2a3a8ab-f568-4cef-a778-ba79cf1513ce

📥 Commits

Reviewing files that changed from the base of the PR and between f74833c and 3cd629a.

📒 Files selected for processing (1)

• .github/dependabot.yml

---

📝 Walkthrough

Walkthrough

The PR adds Dependabot configuration for daily Go backend and pnpm frontend updates. Regular updates use one labeled group. Security updates use a separate group.

Changes

Dependency automation

Layer / File(s)	Summary
Dependabot schedule and update groups .github/dependabot.yml	Dependabot checks /backend Go modules and /frontend npm packages daily at 09:00 Asia/Shanghai. Regular updates share one dependencies group and security updates use security-dependencies groups.

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Other

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/dependabot-grouping

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}