ci: keep pinned GitHub Actions current with Dependabot

[altaywtf]

Change

Dependabot opens monthly pull requests for the GitHub Actions this repository pins by SHA; until now it tracked only Gradle and npm, so the pinned actions never moved.

  - package-ecosystem: github-actions
    directory: /
    schedule:
      interval: monthly
    cooldown:
      default-days: 1
    groups:
      actions-patch-minor:
        update-types: ["patch", "minor"]
      actions-major:
        update-types: ["major"]
    commit-message:
      prefix: "ci"

• Matches the other put.io repositories' entry, with this file's 1-day npm cooldown.
• Merging starts only CI and link checks on main; there is no release or deploy lane.

Validation

• check-jsonschema --builtin-schema vendor.dependabot .github/dependabot.yml passes and rejects a misspelled cooldown key or ecosystem
• Unverified: Dependabot confirms the entry only when it runs after merge

---

Written by an agent (Claude Code, Opus 5.5)

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.