chore: enable Dependabot weekly GitHub Actions bumps

[hf-dependantbot-rollout]

Summary

Adds .github/dependabot.yml so this repo's pinned GitHub Action SHAs
get bumped automatically once a week.

All action updates are grouped into one weekly PR (not one PR per
action) to keep the noise down, and Dependabot waits 7 days after a
release before opening the bump (cooldown). The 7-day cooldown is
aligned with the org's pinact min_age: 7 policy — so by the time
the Dependabot PR lands, the SHA is already old enough for the security
gate to accept it. The bot opens the PR; the org-wide security gate
(pinact + denylist + deny-packages + osv-scan) runs on it; a human
merges.

Why

GitHub Action SHAs that were safe when pinned can drift out of date —
missing security patches, bug fixes, or new features. Dependabot keeps
them current. Combined with the org-wide validation workflow (which
blocks compromised SHAs from landing), the bumps are safe by
construction.

Closes huggingface/tracking-issues#648

---

Note

Low Risk
CI-only dependency automation; no application runtime or auth/data paths change, with bumps still gated by existing org security workflows before merge.

Overview
Adds Dependabot configuration so pinned GitHub Actions SHAs are refreshed on a weekly schedule across the repo root and composite action directories under .github/actions/*.

Updates are batched into a single weekly PR (groups with patterns: ["*"]), and Dependabot applies a 7-day cooldown after a release before proposing bumps—intended to line up with org pinact min_age: 7 so security gates can accept the new SHAs when the PR is opened.

^{Reviewed by Cursor Bugbot for commit fbad2ab. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit d062a63. Configure here.}

[seanses]

@cursoragent Fix the problem you identified

[cursor]

Implemented the fix in .github/dependabot.yml.

What changed:

• Replaced directory: "/" with directories:
• Kept the root entry for workflow files
• Added all composite action directories under .github/actions:
  • /.github/actions/build-wasm
  • /.github/actions/cache-rust-build
  • /.github/actions/macos-codesign-notarize
  • /.github/actions/set-build-profile
  • /.github/actions/windows-codesign

Why:

• directory: "/" only covers .github/workflows
• Composite actions with pinned third-party SHAs live in their own folders and need to be listed explicitly for Dependabot to update them

Verification:

• Parsed the updated YAML successfully with python3/PyYAML
• Confirmed the branch is clean after commit and push

Commit:

• fbad2ab6 — fix: include composite action directories in dependabot

  

[rajatarya]

This enables Dependabot for weekly GitHub Actions SHA bumps via a new .github/dependabot.yml. The config is valid Dependabot v2 and sensible.

Verified:

• No pre-existing .github/dependabot.yml on main, so there's no conflict — this is a clean addition.
• All five composite-action directories listed under directories exist on main and each contains an action.yml (build-wasm, cache-rust-build, macos-codesign-notarize, set-build-profile, windows-codesign).
• Using directories (plural) is the right call here: the "/" entry covers root .github/workflows plus the root-level action.yml, but nested composite actions under .github/actions/* are not picked up by "/" alone, so listing them explicitly is what makes them get bumped.
• cooldown.default-days: 7, groups (patterns: ["*"]), and the weekly schedule are all valid keys. Grouping into one weekly PR is a good noise-reduction choice, and the 7-day cooldown aligning with the org pinact min_age: 7 gate is a nice touch.

No blocking issues. A couple of optional nits inline. LGTM.

[rajatarya]

nit: macos-codesign-notarize and set-build-profile currently have no external uses: in their action.yml (only run-steps / nested local action refs), so Dependabot will find nothing to bump in them today. Harmless to keep them listed — it just future-proofs in case they later pull in a pinned external action — but worth knowing they're no-ops right now.

[rajatarya]

nit: consider adding open-pull-requests-limit and labels for explicitness. With groups batching everything into one PR the default limit of 5 is effectively never hit, so this is purely cosmetic; and the repo already applies a dependabot label, so neither is required. Optional.