chore(ci): configure dependabot to automatically update repository dependencies

[Sparshjoshi-iit]

Resolves #703

Motive

To prevent technical debt and security vulnerabilities from outdated packages, this PR configures Dependabot to automatically manage and propose dependency updates.

Tasks Completed

• Created .github/dependabot.yml
• Configured NPM updates for the /frontend directory
• Configured GitHub Actions updates pointing to root /
• Applied unified dependencies labels to auto-generated PRs
• Set conventional commit prefixes (chore) to align with repository standards

[github-actions]

Thank you @, for creating the PR and contributing to our UltimateHealth project 💗.
Our team will review the PR and will reach out to you soon! 😇
Make sure that you have marked all the tasks that you are done with ✅.
Thank you for your patience! 😀

[Copilot]

Pull request overview

This PR introduces a Dependabot configuration to automate dependency update PRs for the repository’s GitHub Actions workflows (root) and the React Native/Expo frontend (/frontend), supporting the goal in #703 of reducing security/maintenance risk from outdated dependencies.

Changes:

• Added .github/dependabot.yml with weekly update checks for github-actions at / and npm at /frontend.
• Applied dependency-related labels to Dependabot PRs.
• Configured Dependabot commit message prefixing for the npm ecosystem entry.

Comments suppressed due to low confidence (2)

.github/dependabot.yml:10

• The PR description says Dependabot PRs will use a conventional commit prefix (chore), but commit-message is only configured for the npm entry. If you want consistent conventional commits across all Dependabot PRs, add the same commit-message configuration under the github-actions update as well.

  - package-ecosystem: "github-actions"
    directory: "/"
    schedule:
      interval: "weekly"
    labels:
      - "dependencies"
      - "github-actions"

.github/dependabot.yml:17

• This repo’s frontend/package.json has a large dependency set, so a weekly Dependabot run can still generate a high number of PRs at once. To better meet the goal of preventing PR spam, consider adding open-pull-requests-limit and/or using Dependabot groups to batch updates into fewer PRs.

  - package-ecosystem: "npm"
    directory: "/frontend"
    schedule:
      interval: "weekly"
    labels:

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[SB2318]

Hey! 🎉 Thank you so much for taking the initiative to secure our pipeline. Keeping React Native & Expo packages up-to-date is a massive win for reducing technical debt, so I really appreciate you driving this!

I reviewed your proposed .github/dependabot.yml file, and the foundation is fantastic. I especially love that you added prefix: "chore" for Conventional Commits and set up the frontend and github-actions labels to keep our PR board clean.

However, I am requesting a couple of additions before we can merge this, to ensure it scales well with our CI pipeline:

1. Add Open PR Limits
By default, Dependabot will open up to 5 PRs at a time. If we fall behind, it can overwhelm the repository. Please explicitly set an open-pull-requests-limit for each ecosystem (e.g., 5 for actions, 10 for npm) so we have documented control over the noise level.

Example snippet:

    schedule:
      interval: "weekly"
    open-pull-requests-limit: 10

2. Group Related Updates (Crucial)
Because React Native relies on heavy ecosystems, updates usually come in batches (e.g., updating multiple @react-navigation or expo-* packages). Without grouping, Dependabot will open individual PRs for every single package, which will quickly burn through our GitHub Action CI minutes and create PR fatigue.

Please add the groups feature to bundle related updates together in the npm ecosystem.

Example snippet:

    groups:
      expo-packages:
        patterns:
          - "expo-*"
      react-navigation:
        patterns:
          - "@react-navigation/*"

Requested Action:
Please review the Dependabot documentation on grouping and limits, update your configuration file with these concepts, and push the changes. Let me know once you do, and I will gladly approve and merge! 🚀

[SB2318]

@Sparshjoshi-iit, please resolve the conflict