From a4762facc8a8b8bb7cbf61611e726b36346c0a4e Mon Sep 17 00:00:00 2001
From: patrick-creates <47230534+patrick-creates@users.noreply.github.com>
Date: Tue, 3 Nov 2026 23:28:44 +0100
Subject: [PATCH] CI: update actions/checkout to v7, add Dependabot

- actions/checkout v4 -> v7 (Node 24) in test.yml, sync_docs.yml and the
  README example.
- Dependabot version updates for GitHub Actions, monthly and grouped.
---
 .github/dependabot.yml     | 11 +++++++++++
 .github/workflows/test.yml |  2 +-
 CHANGELOG.md               |  4 ++++
 README.md                  |  2 +-
 sync_docs.yml              |  2 +-
 5 files changed, 18 insertions(+), 3 deletions(-)
 create mode 100644 .github/dependabot.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..6b7b05d
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,11 @@
+# Monthly and grouped: every Dependabot PR triggers CI, so this keeps it to at most one PR a month.
+# sync_docs.yml and the README example are not workflows here; bump their checkout version by hand.
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: monthly
+    groups:
+      github-actions:
+        patterns: ["*"]
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 4e851a7..c6571db 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -12,7 +12,7 @@ jobs:
   sync-logic:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       # Runner has jq installed, so the real jq filter is exercised here
       - name: Run sync tests
diff --git a/CHANGELOG.md b/CHANGELOG.md
index d5cf7ff..aa886e9 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,10 @@ All notable changes to this project are documented here. Format: [Keep a Changel
 
 ### Added
 - CI: `tests/test_sync.sh` runs on every push and pull request, with the real `jq`.
+- Dependabot version updates for GitHub Actions, monthly and grouped.
+
+### Changed
+- `actions/checkout` v4 -> v7 (Node 24) in CI, `sync_docs.yml` and the README example.
 
 ### Removed
 - Marketplace `branding` block from `action.yml` (not listed on the Marketplace).
diff --git a/README.md b/README.md
index 896b10a..9cbf354 100644
--- a/README.md
+++ b/README.md
@@ -71,7 +71,7 @@ jobs:
   sync:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0   # needed to see which files changed
 
diff --git a/sync_docs.yml b/sync_docs.yml
index 9feefbb..0620256 100644
--- a/sync_docs.yml
+++ b/sync_docs.yml
@@ -18,7 +18,7 @@ jobs:
 
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0