[vsethi09]

Summary

Integrates Dependabot to automate dependency updates across develop and release/3.2:

1. develop branch (Automated Merge):
   • Configures weekly Dependabot updates for Go modules (/ and /vendor_old/sigs.k8s.io/controller-reconciler), Dockerfile, and GitHub Actions.
   • Adds .github/workflows/dependabot-auto-merge.yml to automatically approve and enable squash auto-merge on Dependabot PRs targeting develop once required CI checks pass.
2. release/3.2 branch (Human Review):
   • Configures weekly Dependabot updates for Go modules and Dockerfile targeting release/3.2.
   • Leaves PRs targeting release/3.2 open for manual maintainer review (excluded from the auto-merge workflow).
3. CI Trigger Update:
   • Updates .github/workflows/go.yml to also run on release/** branches and PRs so Dependabot PRs against release/3.2 execute unit and manifest tests.

Changes

• .github/dependabot.yml: Dependabot configuration for develop and release/3.2.
• .github/workflows/dependabot-auto-merge.yml: GitHub Actions workflow to auto-approve and auto-merge Dependabot PRs targeting develop.
• .github/workflows/go.yml: Extend CI triggers to include release/**.

Post-Merge / Repository Settings Checklist

• Enable Allow auto-merge under Settings → General → Pull Requests.
• Enable Allow GitHub Actions to create and approve pull requests under Settings → Actions → General → Workflow permissions.
• Verify branch protection on develop requires the build status check to pass before merging.

[gemini-code-assist]

Code Review

This pull request introduces a Dependabot configuration file (.github/dependabot.yml) to automate dependency updates for Go modules, Docker images, and GitHub Actions across the develop and release/3.2 branches. Feedback on this configuration highlights two main issues: first, the Go modules in the repository currently specify an invalid Go version (1.26.5), which will cause Dependabot updates to fail; second, auto-merging production dependencies via the automerge label introduces security and stability risks, so it is recommended to restrict auto-merging to development dependencies or GitHub Actions.