fix(ci): route Dependabot PRs to develop, not main

[alain-sv]

Summary

• Add target-branch: "develop" to both pip and github-actions ecosystems in .github/dependabot.yml

Dependabot was defaulting to the repository's default branch (main) when creating update PRs. This routes all Dependabot update PRs to develop instead, consistent with the standard development flow for this repo.

Test plan

• Verify the next Dependabot PRs are opened against develop

🤖 Generated with Claude Code

[qodo-code-review]

Review Summary by Qodo

Route Dependabot PRs to develop branch

🐞 Bug fix

Walkthroughs

Description

• Route Dependabot PRs to develop branch instead of main
• Add target-branch: "develop" to pip ecosystem configuration
• Add target-branch: "develop" to github-actions ecosystem configuration

Diagram

flowchart LR
  dependabot["Dependabot Updates"]
  config[".github/dependabot.yml"]
  pip["pip ecosystem"]
  actions["github-actions ecosystem"]
  develop["develop branch"]
  
  dependabot --> config
  config --> pip
  config --> actions
  pip -- "target-branch: develop" --> develop
  actions -- "target-branch: develop" --> develop

Loading

File Changes

1. .github/dependabot.yml ⚙️ Configuration changes +2/-0

Configure Dependabot to target develop branch

• Added target-branch: "develop" to pip ecosystem configuration
• Added target-branch: "develop" to github-actions ecosystem configuration
• Ensures all Dependabot update PRs are created against develop branch instead of main

.github/dependabot.yml

---

ⓘ You are approaching your monthly quota for Qodo. Upgrade your plan

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (1) 📘 Rule violations (0)

1. Dependabot bypasses PR scan 🐞 Bug ⛨ Security

Description

With Dependabot now targeting develop, dependency update PRs will no longer trigger the
OSV-Scanner workflow because security-scan.yml only runs for pull requests against main,
allowing dependency updates to merge without PR-time vulnerability scanning.

Code

.github/dependabot.yml[5]

+    target-branch: "develop"

Evidence

Dependabot PRs will target develop due to the new target-branch setting, but the OSV security
scan workflow is configured to run on pull requests only when the base branch is main, so
develop-targeted Dependabot PRs will not run this scan. This also conflicts with the repo’s stated
posture that OSV-Scanner runs on every PR.

.github/dependabot.yml[1-8]
.github/dependabot.yml[23-28]
.github/workflows/security-scan.yml[3-9]
SECURITY.md[19-32]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
Dependabot PRs are now opened against `develop`, but the OSV security scan workflow only triggers on PRs targeting `main`. This means dependency update PRs (the ones most likely to introduce vulnerable packages) won’t receive the intended PR-time OSV scan.

### Issue Context
- Dependabot is configured to target `develop`.
- The OSV security workflow’s `pull_request` trigger is restricted to `branches: [main]`.
- Repository documentation claims OSV-Scanner runs “on every PR”, which won’t hold for `develop`-targeted PRs.

### Fix Focus Areas
- .github/workflows/security-scan.yml[3-9]
- .github/dependabot.yml[3-8]
- SECURITY.md[19-32]

### Suggested change
Update `.github/workflows/security-scan.yml` so `on.pull_request.branches` includes `develop` (e.g., `[develop, main]`). If you intentionally only want to scan `main`, then update `SECURITY.md` to reflect that OSV-Scanner is not run on every PR and consider an alternate mechanism to scan `develop` dependency PRs.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

ⓘ You are approaching your monthly quota for Qodo. Upgrade your plan

[qodo-code-review]

1. Dependabot bypasses pr scan 🐞 Bug ⛨ Security

With Dependabot now targeting develop, dependency update PRs will no longer trigger the
OSV-Scanner workflow because security-scan.yml only runs for pull requests against main,
allowing dependency updates to merge without PR-time vulnerability scanning.

Agent Prompt

### Issue description
Dependabot PRs are now opened against `develop`, but the OSV security scan workflow only triggers on PRs targeting `main`. This means dependency update PRs (the ones most likely to introduce vulnerable packages) won’t receive the intended PR-time OSV scan.

### Issue Context
- Dependabot is configured to target `develop`.
- The OSV security workflow’s `pull_request` trigger is restricted to `branches: [main]`.
- Repository documentation claims OSV-Scanner runs “on every PR”, which won’t hold for `develop`-targeted PRs.

### Fix Focus Areas
- .github/workflows/security-scan.yml[3-9]
- .github/dependabot.yml[3-8]
- SECURITY.md[19-32]

### Suggested change
Update `.github/workflows/security-scan.yml` so `on.pull_request.branches` includes `develop` (e.g., `[develop, main]`). If you intentionally only want to scan `main`, then update `SECURITY.md` to reflect that OSV-Scanner is not run on every PR and consider an alternate mechanism to scan `develop` dependency PRs.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools