Description
Currently, whenever package.json changes, we manually run npm install and commit the updated package-lock.json to keep CI passing.
Proposal:
- Use Dependabot to automatically regenerate package-lock.json whenever package.json changes.
- Dependabot will open a PR with the updated lockfile only when necessary.
Note
Optionally, enable GitHub auto-merge for these PRs when CI passes, so no manual commits are needed.
Benefits:
- Eliminates manual lockfile commits.