Authorize Dependabot npm security updates for GitHub scripts

[Copilot]

What is being addressed

Dependabot security updates for /.github/scripts/package-lock.json are rejected because /.github/scripts is not declared as an npm update location. This causes security-update PR creation to fail with dependency_file_not_supported.

How is this addressed

• Add /.github/scripts as an npm Dependabot update directory.
• Keep version updates disabled while allowing security updates for that lockfile.

  - package-ecosystem: "npm"
    directory: "/.github/scripts"
    schedule:
      interval: "monthly"
    ignore:
      - dependency-name: "*"
        update-types: ["version-update:semver-patch"]
    open-pull-requests-limit: 0

[Copilot]

Pull request overview

Adds Dependabot coverage for npm dependencies used by GitHub workflow scripts, enabling security-update PRs while suppressing routine version updates.

Changes:

• Adds /.github/scripts as an npm update directory.
• Disables version-update PRs while preserving security updates.

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

[Jack Morris (rudolphjacksonm)]

/test-force-approve

[github-actions]

🤖 pr-bot 🤖

✅ Marking tests as complete (for commit e150513)

(in response to this comment from Jack Morris (@rudolphjacksonm))

[github-actions]

Unit Test Results

0 tests   0 ✅  0s ⏱️
0 suites  0 💤
0 files    0 ❌

Results for commit e150513.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.