[byjg]

What

An entry in the configuration can now carry a dependabot block:

dependabot:
  alerts: true            # RepositoryVulnerabilityAlerts
  security_updates: true  # RepositoryDependabotSecurityUpdates

Both are repository settings, so a repository gets CVE alerts and fix pull requests without a .github/dependabot.yml (which only drives version updates).

Behaviour

• A key left out is not managed; GitHub keeps what the repository has.
• An unknown key aborts the run (DEPENDABOT_KEYS), as branch_protection does.
• security_updates: true without alerts: true aborts the run, checked after the entries of a repository are merged, since GitHub refuses it.
• Security updates depend on the alerts resource, so they are declared after it.
• No import step: creating either resource applies the setting.
• Removing the block turns the settings off on GitHub (the provider's delete calls the disable endpoints).

Other changes

• pulumi-github>=6.13.0: the first release with RepositoryVulnerabilityAlerts (6.12.2 does not have it).
• Version 0.3.0, README section ### dependabot.

Checked

• ruff check, ruff format --check, mypy ghfleet: clean.
• apply() under Pulumi mocks: the resources are declared per repository, a repository getting alerts from one entry and security_updates from another gets both, and both error cases abort with their message.