Add Dependabot for GitHub Actions

[skearnes]

The workflows here are pinned to commit SHAs, which is the right call — mutable version tags are what made the tj-actions/changed-files compromise so wide, and SHA pinning is what protected the repositories that had it. But nothing keeps those pins current, and the drift is already measurable: astral-sh/setup-uv sits at v5.4.2 while ord-data and ord-schema run v7, and actions/checkout is behind even within its own v4 major.

Dependabot understands SHA-pinned actions and rewrites the SHA together with its trailing # vN comment, so the pins keep their security property without freezing. That is the missing half of the pattern this repository already adopted.

Updates are grouped so this arrives as one pull request a month rather than one per action. Expect a first round of catch-up pull requests once this lands — that backlog is the point.

Part of an org-wide sweep: ord-schema#910, ord-data#264, and ord-interface#214 add the same config alongside the SHA pins those repositories were missing.

🤖 Generated with Claude Code

Greptile Summary

Adds Dependabot configuration for GitHub Actions.

• Runs monthly from the repository root.
• Groups all action dependency updates into one pull request.
• Preserves automated updates for SHA-pinned workflow actions.

Confidence Score: 5/5

The PR appears safe to merge with no identified correctness or security issues.

The configuration correctly targets GitHub Actions from the repository root and groups all existing SHA-pinned workflow dependencies into monthly updates.

Important Files Changed

Filename	Overview
.github/dependabot.yml	Adds a valid monthly, grouped GitHub Actions update configuration covering the repository workflows.

_{Reviews (1): Last reviewed commit: "Add Dependabot for GitHub Actions" | Re-trigger Greptile}