fix(ci,governance): remediate Dependabot, Hypatia, K9/DEED conformance, and actions.lock closure

.github/dependabot.yml

@@ -1,48 +1,42 @@
 # SPDX-License-Identifier: MPL-2.0
-# Dependabot configuration for RSR-compliant repositories
-# Covers common ecosystems - remove unused ones for your project
-
+# Dependabot v2 configuration for boj-server.
+# Scoped strictly to directories that actually hold standalone manifests/lockfiles:
+#   - /           -> GitHub Actions (.github/workflows/*.yml) + root JS package.json
+#   - /elixir     -> Mix (elixir/mix.exs + elixir/mix.lock)
+#   - /coord-tui  -> Cargo (coord-tui/Cargo.toml + coord-tui/Cargo.lock)
+# Note: /tray is intentionally omitted because tray/Cargo.toml references the
+# external sibling path `../../gossamer/bindings/rust`, which cannot resolve in
+# Dependabot's repository-only checkout.
 version: 2
 updates:
-  # GitHub Actions - always include
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
-      interval: "daily"
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 5
     groups:
       actions:
         patterns:
           - "*"
 
-  # Rust/Cargo
-  - package-ecosystem: "cargo"
-    directory: "/"
-    schedule:
-      interval: "daily"
-    ignore:
-      - dependency-name: "*"
-        update-types: ["version-update:semver-patch"]
-
-  # Elixir/Mix
-  - package-ecosystem: "mix"
-    directory: "/"
-    schedule:
-      interval: "daily"
-
-  # Node.js/npm
   - package-ecosystem: "npm"
     directory: "/"
     schedule:
-      interval: "daily"
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 5
 
-  # Python/pip
-  - package-ecosystem: "pip"
-    directory: "/"
+  - package-ecosystem: "mix"
+    directory: "/elixir"
     schedule:
-      interval: "daily"
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 5
 
-  # Guix flakes
-  - package-ecosystem: "guix"
-    directory: "/"
+  - package-ecosystem: "cargo"
+    directory: "/coord-tui"
     schedule:
-      interval: "daily"
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 5

.github/workflows/abi-drift.yml

@@ -47,7 +47,7 @@ jobs:
     outputs:
       run: ${{ steps.detect.outputs.run }}
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7.0.1
         with:
           fetch-depth: 0
       - id: detect
@@ -72,7 +72,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7.0.1
         with:
           # Need at least two commits so `git diff origin/<base>...HEAD`
           # can compute the changed-cartridge set on pull_request events.
@@ -92,7 +92,7 @@ jobs:
       # GADT-skip fix (iseriser#20, merged 2026-05-20) never reached CI.
       # Bumping ISERISER_REV invalidates the cache and forces a rebuild.
       - name: Cache cargo bin (iseriser install)
-        uses: actions/cache@v4.2.2
+        uses: actions/cache@v6.1.0
         env:
           ISERISER_REV: 741a3b63e7619b6e9cfe7f91b04d7ccfb130b1ca
         with: