CI: update actions/checkout to v7, add Dependabot

.github/dependabot.yml

@@ -0,0 +1,11 @@
+# Monthly and grouped: every Dependabot PR triggers CI, so this keeps it to at most one PR a month.
+# sync_docs.yml and the README example are not workflows here; bump their checkout version by hand.
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: monthly
+    groups:
+      github-actions:
+        patterns: ["*"]

.github/workflows/test.yml

@@ -12,7 +12,7 @@ jobs:
   sync-logic:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       # Runner has jq installed, so the real jq filter is exercised here
       - name: Run sync tests

CHANGELOG.md

@@ -6,6 +6,10 @@ All notable changes to this project are documented here. Format: [Keep a Changel
 
 ### Added
 - CI: `tests/test_sync.sh` runs on every push and pull request, with the real `jq`.
+- Dependabot version updates for GitHub Actions, monthly and grouped.
+
+### Changed
+- `actions/checkout` v4 -> v7 (Node 24) in CI, `sync_docs.yml` and the README example.
 
 ### Removed
 - Marketplace `branding` block from `action.yml` (not listed on the Marketplace).

README.md

@@ -71,7 +71,7 @@ jobs:
   sync:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0   # needed to see which files changed
 

sync_docs.yml

@@ -18,7 +18,7 @@ jobs:
 
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0