[remyperona]

Description

Closes #1309

This PR only changes CI and Dependabot configuration. Plugin users see no difference.

• .github/dependabot.yml adds an npm entry for / and /_dev:
  • minor and patch security updates are grouped into one PR across both directories;
  • version updates run monthly, also grouped for minor and patch, with a 7-day cooldown and at most 5 open PRs;
  • majors are left out of both groups, so a breaking one (for example a new @wordpress/scripts) arrives as its own PR instead of blocking the safe bumps.
• code_coverage.yml skips the Codacy upload step when github.actor is dependabot[bot]. The coverage run itself still executes.
• pr-template-checker.yml skips the task-check job when github.actor is dependabot[bot].

Both checks failed on every Dependabot PR, whatever the PR changed. Dependabot-triggered runs only receive Dependabot secrets, so CODACY_PROJECT_TOKEN and PR_TEMPLATE_TOKEN are empty, and Dependabot never fills the PR template.

Type of change

• New feature (non-breaking change which adds functionality).
• Bug fix (non-breaking change which fixes an issue).
• Enhancement (non-breaking change which improves an existing functionality).
• Breaking change (fix or feature that would cause existing functionality to not work as before).
• Sub-task of #(issue number)
• Chore
• Release

Detailed scenario

What was tested

• dependabot.yml validates against the SchemaStore Dependabot v2 schema, and all three files parse as YAML.
• I checked the options against GitHub's docs. Security-update groups accept update-types and multiple directories. cooldown and open-pull-requests-limit apply to version updates only.
• I confirmed the failure causes in existing logs. On Bump axios from 1.19.0 to 1.20.0 #1279, the Codacy step fails with Either a project or account API token must be provided, and task-check fails with Description not set. Both runs show Secret source: Dependabot.
• Not tested yet: the skip on a real Dependabot PR. That needs this change on develop first.

How to test

1. After merge, open Insights → Dependency graph → Dependabot. The npm entries for / and /_dev should show no config error.
2. On the next Dependabot PR, Run codacy-coverage-reporter and PR Template Checker / task-check should be skipped, while Code Coverage (the test run) still runs.
3. On this PR, opened by a person, both checks still run.

Affected Features & Quality Assurance Scope

CI only: the Codacy coverage upload and the PR Template Checker, on Dependabot PRs. No plugin code changes.

Technical description

Documentation

github.actor is the right condition because it is what decides whether secrets are available. If a person pushes to a Dependabot branch, github.actor is that person, the secrets are present, and both checks run normally.

New dependencies

None.

Risks

• Once merged, the first monthly version-update run may open a few PRs at once: one grouped minor/patch PR plus individual majors, capped at 5.
• Some majors will break CI until Reduce JS dev-dependency alerts: retire the _dev Bud toolchain and slim @wordpress/scripts #1308 is done (for example @wordpress/scripts 36+ and autoprefixer 10).
• Dependabot PRs no longer report coverage to Codacy. They only change npm dev tooling, which has no PHP coverage impact.

Mandatory Checklist

Code validation

• I validated all the Acceptance Criteria. If possible, provide screenshots or videos.
• I triggered all changed lines of code at least once without new errors/warnings/notices.
• I implemented built-in tests to cover the new/changed code.

Code style

• I wrote a self-explanatory code about what it does.
• I protected entry points against unexpected inputs.
• I did not introduce unnecessary complexity.
• Output messages (errors, notices, logs) are explicit enough for users to understand the issue and are actionnable.

Unticked items justification

• The Dependabot-actor branch of both if: conditions can only run on a real Dependabot PR after merge; this PR exercises the human-actor branch.
• The acceptance criteria are only partly validated. Schema validation is done; the GitHub-side config check and the Dependabot skip can only be confirmed after merge.
• There are no automated tests for CI configuration.

Additional Checks

• In the case of complex code, I wrote comments to explain it.
• When possible, I prepared ways to observe the implemented system (logs, data, etc.)
• I added error handling logic when using functions that could throw errors (HTTP/API request, filesystem, etc.)

🤖 Generated with Claude Code

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Coverage ∅ diff coverage

Metric	Results
Coverage variation	Report missing for f6a19441
Diff coverage	✅ ∅ diff coverage (50.00%)

View coverage diff in Codacy

Coverage variation details

	Coverable lines	Covered lines	Coverage
Common ancestor commit (f6a1944)	Report Missing	Report Missing	Report Missing
Head commit (d146439)	20546	1653	8.05%

Coverage variation is the difference between the coverage for the head and common ancestor commits of the pull request branch: <coverage of head commit> - <coverage of common ancestor commit>

Diff coverage details

	Coverable lines	Covered lines	Diff coverage
Pull request (#1310)	0	0	∅ (not applicable)

Diff coverage is the percentage of lines that are covered by tests out of the coverable lines that the pull request added or modified: <covered lines added or modified>/<coverable lines added or modified> * 100%

¹ Codacy didn't receive coverage data for the commit, or there was an error processing the received data. Check your integration for errors and validate that your coverage setup is correct.

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}