chore(ci): add cargo to Dependabot configuration - #357

The repository is a Cargo workspace with nine crates under crates/ and 411 locked packages in Cargo.lock, built by build-rust-crates.yml, but dependabot.yml declares only npm, github-actions, and two gomod ecosystems. Rust dependencies receive no automated security updates.

Adds a cargo entry at the workspace root, which covers all member crates. Mirrors the existing gomod block style.

further ::

.github/dependabot.yml declares four ecosystems:

npm /
github-actions /
gomod /
gomod /grafana-datasource-plugin

Both go.mod files are covered. The Rust side is not — and it's substantial:

bash
ls crates/ # 9 crates
grep -c '^[[package]]' Cargo.lock # 411 locked packages

hermes-server, hermes-decode, hermes-xtce, hermes-pb, hermes-data, hermes-yamcs, hermes-yamcs-fprime-events, hermes-fprime-dictionary and yamcs-http currently receive no automated dependency or security updates, despite having their own CI workflow in build-rust-crates.yml.

Change

One cargo entry at the workspace root — directory: '/' covers all nine member crates, so no per-crate entries are needed. Style mirrors the existing gomod blocks: same quoting, same open-pull-requests-limit: 5, same commit-message prefix.

9 insertions, 1 file.

One question

The npm block uses cooldown: default-days: 5 with the note about circumventing supply-chain attacks. The gomod blocks don't, so I've left it off here for consistency with them. Happy to add it to cargo — or to the other ecosystems — if you'd prefer that policy applied across the board.

Note::

Expect an initial burst of Dependabot PRs for accumulated Rust updates once this merges. The open-pull-requests-limit: 5 caps it, matching the other ecosystems.