[yunus-dev-codecrafter]

closes #210

Summary

This PR aligns Dependabot configuration and contributor documentation for grouping policy. The dependency policy doc is updated with precise cadence/group details (weekly on Mondays in Africa/Lagos, npm at 08:00 and GitHub Actions at 08:30, open PR limit 5 each, group names npm-minor-and-patch and github-actions-minor-and-patch for minor/patch only, major updates isolated, no auto-merge). A new policy test enforces the alignment so future changes keep the config and docs synchronized.

Related Issue

Closes #210

Scope

• Updated docs/contributing/dependency-policy.md to document exact Dependabot schedule, times, timezone, limits, group names, major isolation, and no auto-merge.
• Added tests/dependabot-policy.test.ts to assert both .github/dependabot.yml structure and documentation alignment.

Excluded: changes to .github/dependabot.yml itself (already matches policy), dependency additions, workflow changes, or changesets (not required).

Testing

• Tests added/updated where applicable
• Existing relevant tests pass
• Lint/type/build checks pass where available

Performed locally:

• npx vitest run tests/dependabot-policy.test.ts → 6 passed
• npx vitest run tests/dependabot-policy.test.ts tests/release-workflow.test.ts tests/static-quality.test.ts tests/critical-path.test.ts → 13 passed
• npm run format:check, npm run lint, npm run typecheck, npm run build → all passed

Security Impact

• No security-sensitive behavior is changed

No new runtime code, no dependency changes, no credential/workflow behavior changes. The new test only reads config/docs.

Release Impact

• No published/user-visible behavior change

• Changeset included where required

• Changeset not required; reason explained below

No user-facing changes; documentation and tests only. No Changeset needed per contributing guidance.

Documentation

• Documentation updated where applicable
• No documentation change required

docs/contributing/dependency-policy.md updated for accuracy and specificity.

Checklist

• I read docs/contributing/wave-architecture.md for Stellar Wave work
• I stayed within the agreed issue scope
• I checked for overlapping open contributor PRs
• I did not include secrets or sensitive data
• I reviewed new/updated dependencies if any
• I considered failure/error paths, not only the happy path
• I am not disclosing an unresolved vulnerability publicly

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: aafd1690-bfbf-45ff-a59b-ef57fe00c74d

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}