[Enhancement]: Monitor and update GitHub Actions workflow dependencies with Dependabot #292

What

Dependabot should be configured to monitor and automatically update dependencies used in GitHub Actions workflows (files in .github/workflows). This allows action versions to stay up-to-date and secure without manual intervention. The change involves updating .github/dependabot.yml to include the github-actions package-ecosystem, ensuring workflow actions are checked for updates regularly.

Why

Automated updates for workflow actions improve the security, reliability, and maintainability of the CI/CD process. It reduces the risk of using outdated or insecure GitHub Actions, helps catch security vulnerabilities quickly, and keeps our workflows in line with best practices through automatic PRs.

Notes

Example of what to add to .github/dependabot.yml:

- package-ecosystem: "github-actions"
  directory: "/"
  schedule:
    interval: "weekly"

Further reference: https://docs.github.com/en/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/configuration-options-for-dependency-updates

Previously discussed as a bug due to the risk to CI/CD from outdated workflows.