[CI] Add manual pre-commit hook to validate the dependabot config

[jbampton]

https://www.npmjs.com/package/@bugron/validate-dependabot-yaml

refs #12930

Description

This PR adds another check or test to our pre-commit framework.

refs apache/sedona#2793

Types of changes

• Breaking change (fix or feature that would cause existing functionality to change)
• New feature (non-breaking change which adds functionality)
• Bug fix (non-breaking change which fixes an issue)
• Enhancement (improves an existing feature and functionality)
• Cleanup (Code refactoring and cleanup, that may add test cases)
• Build/CI
• Test (unit or integration test code)

Feature/Enhancement Scale or Bug Severity

Feature/Enhancement Scale

• Major
• Minor

Bug Severity

• BLOCKER
• Critical
• Major
• Minor
• Trivial

Screenshots (if appropriate):

How Has This Been Tested?

Ran the manual hooks with pre-commit"

pre-commit run --all-files --hook-stage manual

Ran the standard pre-commit hooks:

pre-commit run --all-files

How did you try to break this feature and the system with this change?

[jbampton]

@blueorangutan package

[blueorangutan]

@jbampton a [SL] Jenkins job has been kicked to build packages. It will be bundled with no SystemVM templates. I'll keep you posted as I make progress.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 19.73%. Comparing base (77fbb0f) to head (a146baa).

Additional details and impacted files

@@            Coverage Diff            @@
##               main   #12932   +/-   ##
=========================================
  Coverage     19.73%   19.73%           
- Complexity    19955    19958    +3     
=========================================
  Files          6371     6371           
  Lines        575784   575784           
  Branches      70478    70478           
=========================================
+ Hits         113632   113654   +22     
+ Misses       449805   449778   -27     
- Partials      12347    12352    +5     

Flag	Coverage Δ
uitests	3.41% <ø> (ø)
unittests	21.01% <ø> (+<0.01%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[blueorangutan]

Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ el10 ✔️ debian ✔️ suse15. SL-JID 17309

[DaanHoogland]

@jbampton , I have found dependabot to be generally useless in this repo (works fine in the website repo). Will this improve the updates as well?

[Copilot]

Pull request overview

Adds a manual pre-commit hook to validate the repository’s Dependabot configuration, helping catch invalid .github/dependabot.yml changes before they’re committed.

Changes:

• Introduces a new local, manual-stage pre-commit hook to validate .github/dependabot.yml via @bugron/validate-dependabot-yaml.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Using language: system with an npx ...@0.3.3 entry makes this hook depend on whatever Node/npm/npx happens to be installed on the developer machine (and may not run at all if npx isn’t available/in PATH). To make the manual hook reproducible and cross-platform, configure it as a language: node hook with additional_dependencies: ['@bugron/validate-dependabot-yaml@0.3.3'] and set entry to the installed CLI (so pre-commit manages the Node environment and caching).

Suggested change

	entry: npx @bugron/validate-dependabot-yaml@0.3.3
	language: system
	entry: validate-dependabot-yaml
	language: node
	additional_dependencies: ['@bugron/validate-dependabot-yaml@0.3.3']

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

Suppressed comments (1)

.pre-commit-config.yaml:40

• Using language: system with npx makes this hook depend on a preinstalled Node/npm toolchain and can also trigger an interactive "Ok to proceed?" prompt on some npm/npx versions when the package is not already cached. This can break manual hook runs (and any CI job that runs manual hooks). Consider making npx non-interactive at minimum, or switching to a managed pre-commit environment.

        entry: npx @bugron/validate-dependabot-yaml@0.3.3
        language: system
        files: ^\.github/dependabot\.yml$