Dependabot's target-branch redirect is inert: .github/dependabot.yml is missing from the default branch

[rubenvdlinde]

Symptom

Dependabot keeps opening PRs against main, which is 740 commits behind development and carries entirely different package-lock.json and composer.lock files. Two such PRs — #453 (npm, 12 packages) and #454 (composer, 5 packages) — were closed today: measured per package, 15 of the 17 bumps were already at or ahead of the proposed version on development, and neither of the two residual patch bumps (ws 8.21.2→8.21.3, symfony/yaml 6.4.40→6.4.43) carries any advisory.

Cause

#445 added .github/dependabot.yml with target-branch: development and merged it into development.

Dependabot reads .github/dependabot.yml from the repository's default branch. The default branch here is main, and main has no .github/dependabot.yml at all — so the redirect never took effect.

Verified by directory listing rather than a per-file lookup, because an absence claim is exactly what a wrong lookup manufactures for free:

$ git ls-tree -r origin/main --name-only | grep '^\.github/' | wc -l
14                      # all workflows, no dependabot config
$ git ls-tree -r origin/development --name-only | grep -i dependabot
.github/dependabot.yml  # positive control: the file exists, on the other branch

Fix

Land .github/dependabot.yml on main. The file on development is correct as written — it documents its own reasoning at length, including the trade-off that GitHub only raises security updates against the default branch, so target-branch converts those to version updates.

Note that the security-update half will keep targeting main regardless of config; the value of the fix is that version updates start arriving on development, where the shared Code Quality workflow actually runs, instead of the security ones arriving on main where — as #445 recorded — they collect no meaningful check runs at all.

Why this wasn't done in the closing PRs

main is not writable in this workstream. Filing rather than pushing.