[j0sh]

Enable weekly Dependabot version updates for Go modules, GitHub Actions, and Docker images. Use GitHub's default three-day cooldown, group Go minor/patch updates and security updates separately, and group Actions and Docker updates by ecosystem. Go-ethereum follows the normal Go groups.

Read the Go version from go.mod in CI and release metadata, and check that the Docker builder uses that version. Documentation refers to go.mod, and the Go SDK integration fixture derives its version from the main module. Automatic toolchain switching stays disabled in CI and Docker builds.

Dependabot can propose Go image tag and digest updates. Go image and go.mod updates remain independent; both versions must match for Docker builds to pass. Keep Ubuntu image tags fixed while allowing digest refreshes because release changes are deliberate platform choices.

Dependabot security update PRs have also been enabled in the repository settings and verified through the GitHub API. Security updates bypass the version-update cooldown.

Validation:

• actionlint 1.7.12 passed with the existing Ubuntu 26.04 runner-label warnings excluded; YAML and workflow shell syntax checks passed.
• Executed the release metadata step and Docker compiler check against simulated module versions 1.27.3, 1.27.4, and 1.28.0; matching compiler versions pass and mismatches fail.
• go test ./cmd/livepeer -run '^TestRealBinaryOffchainFlow$' -count=1 -v passed with the pinned Go SDK fixture configured. The unrelated Python SDK fixture was unavailable locally; GitHub CI configures both fixtures.
• git diff --check passed. GitHub CI runs the complete Go suite and Linux release builds.

[Copilot]

🟢 Approval recommended

The configuration matches the stated maintenance policy and repository layout, with no blocking issues identified.

No open issues 🎉

What changed in this PR

Adds Dependabot configuration to automate dependency maintenance without changing application code or dependencies.

Changes:

• Schedules weekly updates for Go modules, GitHub Actions, and Docker images.
• Groups Go minor/patch updates separately from security updates, and groups Actions and Docker updates by ecosystem.
• Restricts Go and Ubuntu image tag upgrades while allowing digest refreshes.

File	Description
.github/​dependabot.yml	Defines update schedules, dependency groups, and Docker image tag restrictions.

_{Review effort: Balanced}

[Copilot]

🟢 Approval recommended

The changes consistently propagate the pinned compiler version, and no blocking issues were identified.

No open issues 🎉

_{Review effort: Balanced}

[Copilot]

🟢 Approval recommended

The changes consistently implement the stated dependency and Go-version policies, with no unresolved blocking findings.

No open issues 🎉

_{Review effort: Balanced}