chore: add Dependabot config and minimal CI build workflow

[tylerkron]

Adds .github/dependabot.yml and a minimal .github/workflows/ci.yml.

Dependabot

• Ecosystems: nuget (the single Daqifi.Core PackageReference in Daqifi.Core.Cli.csproj) and github-actions (for the workflow this PR adds).
• Schedule: weekly, both ecosystems.
• Grouping: minor + patch bumps collapse into one minor-and-patch PR per ecosystem. Major bumps still open individually so they get reviewed on their own.

CI

Runs on pull_request only. dotnet restore + dotnet build -c Release on ubuntu-latest, pinned to the 9.0.x SDK to match the project's net9.0 target. There's no test project, so this is build-only for now — it exists mainly so Dependabot's grouped bumps have something to go green against instead of merging with zero signal.

Verified before opening: Daqifi.Core resolves from public nuget.org (no feed credentials needed in CI), a clean dotnet build -c Release passes with 0 warnings / 0 errors, both YAML files parse, and the actions/checkout@v7 / actions/setup-dotnet@v6 tags resolve.

🤖 Generated with Claude Code

[qodo-code-review]

PR Summary by Qodo

Add Dependabot config for weekly NuGet updates

⚙️ Configuration changes 🕐 Less than 5 minutes

AI Description

• Add Dependabot v2 configuration to automate weekly NuGet dependency updates.
• Group minor and patch updates into a single PR to reduce noise.
• Keep major version updates as separate PRs for explicit review.

Diagram

graph TD
  DB(["Dependabot"]) --> CFG[".github/dependabot.yml"] --> CSPROJ["Daqifi.Cli.csproj"] --> PRS["Update PRs"]

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Use Renovate instead of Dependabot

• ➕ More powerful grouping/custom rules and automerge options
• ➕ Can manage additional ecosystems and non-standard versioning patterns more flexibly
• ➖ Additional setup/maintenance overhead (app install, config complexity)
• ➖ Less “native” than Dependabot for GitHub-only workflows

2. Add PR throttling + metadata in Dependabot config

• ➕ Avoids PR spam as dependencies grow (open-pull-requests-limit)
• ➕ Improves triage via labels/commit-message conventions/reviewers
• ➖ Adds upfront config decisions that may be premature for a small dependency set

Recommendation: The current Dependabot approach is appropriate and minimal for a NuGet-only repo, and the minor/patch grouping is a good default to reduce PR noise while keeping majors explicit. Consider adding open-pull-requests-limit and labels if the dependency surface grows, and add a github-actions updater entry once workflows exist.

Files changed (1) +12 / -0

Other (1) +12 / -0

dependabot.ymlAdd weekly NuGet Dependabot updates with minor/patch grouping +12/-0

Add weekly NuGet Dependabot updates with minor/patch grouping

• Introduces a Dependabot v2 configuration for the NuGet ecosystem at the repo root. Schedules weekly updates and groups minor + patch bumps into a single PR while leaving majors ungrouped.

.github/dependabot.yml

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

_{To customize comments, go to the Qodo configuration screen, or learn more in the docs.}