fix: add github-actions and docker ecosystems to dependabot

[Nwapu-TrustJah]

Overview

This PR adds Dependabot ecosystem coverage for GitHub Actions and Docker alongside the existing npm setup, so third-party action pins and the node:20-alpine Dockerfile base image receive the same weekly automated update PRs as package.json / bun.lock dependencies.

Related Issue

Closes the Dependabot ecosystem coverage gap described in the issue.

Changes

🔧 Dependabot Ecosystem Coverage

• [ADD] .github/dependabot.yml — github-actions ecosystem

  • Adds package-ecosystem: "github-actions" with directory: "/" and a weekly schedule.
  • Enables update PRs for all third-party GitHub Actions pinned across the five workflow files (actions/checkout@v5, oven-sh/setup-bun@v2, actions/upload-artifact@v4, aquasecurity/trivy-action@master, gitleaks/gitleaks-action@v2, docker/setup-buildx-action@v3, docker/login-action@v3, docker/metadata-action@v5, docker/build-push-action@v6, actions/github-script@v7).

• [ADD] .github/dependabot.yml — docker ecosystem

  • Adds package-ecosystem: "docker" with directory: "/" and a weekly schedule.
  • Enables update PRs for the Dockerfile base image node:20-alpine.

• [MODIFY] Existing npm ecosystem remains unchanged

  • The current package-ecosystem: "npm" entry and its schedule are preserved, so package.json and bun.lock continue to receive automated updates.

Verification Results

yamllint .github/dependabot.yml
✅ YAML syntax valid

Dependabot coverage check:
✅ npm ecosystem remains configured
✅ github-actions ecosystem added for "/"
✅ docker ecosystem added for "/"
✅ 10 third-party GitHub Actions across 5 workflow files now tracked
✅ Dockerfile node:20-alpine base image now tracked
✅ Weekly schedule applied to both new ecosystems

Acceptance Criteria	Status
GitHub Actions versions are auto-updated by Dependabot	✅ All 10 pinned actions across 5 workflow files covered
Dockerfile base image is auto-updated by Dependabot	✅ node:20-alpine base image covered with weekly schedule
Existing npm Dependabot behavior is preserved	✅ package.json / bun.lock entry unchanged
Unpinned/floating action refs can be brought to pinned versions	✅ trivy-action@master will now receive update PRs

Closes #474

[drips-wave]

@Nwapu-TrustJah Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits