ci: goimports -local gate + Dependabot config (gomod weekly, actions monthly)

[LukasWodka]

Summary

WS-A.3 of epic tracebloc/backend#1106, two parts:

1. goimports gate — goimports -local github.com/tracebloc/cli now blocks in both loops: build.yml's lint job (pinned goimports@v0.48.0 — same x/tools version as the deadcode pin) and the Makefile's fmt-check target. make fmt is extended to auto-fix. .golangci.yml already declared this grouping (local-prefixes) but nothing enforced it since the action was disabled. Ran goimports -l to verify the ticket: exactly 4 drifted files (internal/cli/data.go, data_test.go, ingestion_run_test.go, resources_set_test.go) — fixed here, import-grouping-only diffs, no code change.
2. Dependabot config — .github/dependabot.yml: gomod weekly with k8s.io/*+sigs.k8s.io/* grouped and golang.org/x/* grouped (the k8s constellation only upgrades cleanly in lockstep — one PR each, not a dozen singletons); github-actions monthly. Labels mirror the backend pilot (work-type:tech-debt exists on this repo; dependencies is Dependabot's built-in default).

Org decision flag — @saadqbal

This extends the backend-only Dependabot pilot to a second repo, and deliberately diverges from it: backend runs security-only updates (open-pull-requests-limit: 0), while this config takes real version updates — the CLI ships as a customer-installed binary, so staying current on k8s.io/* and x/* is security posture, not just hygiene (#276 was six reachable vulns riding a stale x/net + toolchain). If you'd rather keep the pilot uniform (security-only everywhere) until the org-wide rollout decision, say so and I'll flip this config to match. Also: this effectively front-runs the "roll out to the other 16 repos after a week of acceptable noise" checkpoint for one repo.

Stacking note

Stacked on #302 (staticcheck, WS-A.2) — merge #302 first; this PR then shows only its own diff. Shared-file edits (build.yml lint job, Makefile) are surgical — expected trivial rebase vs sibling WS-A PRs touching the same files, merge order flexible.

Test plan (ran locally on this branch)

• goimports -local github.com/tracebloc/cli -l . — 0 files after fix (was the 4 above)
• make fmt-check (gofmt -s + new goimports gate) — green
• go build ./... and go test -race ./internal/cli/... — green
• build.yml + dependabot.yml both YAML-parse
• Not run locally: Dependabot config is validated by GitHub server-side on merge to the default branch; full CI matrix runs on this PR

Fixes#280

🤖 Generated with Claude Code

---

Note

Low Risk
Tooling and dependency-automation only; test diffs are import formatting with no logic changes.

Overview
Adds Dependabot (.github/dependabot.yml): weekly grouped Go module updates (k8s.io/* / sigs.k8s.io/* and golang.org/x/*) and monthly GitHub Actions pins, with work-type:tech-debt and dependencies labels.

Enforces import grouping that matches .golangci.ymllocal-prefixes: goimports -local github.com/tracebloc/cli runs in CI (build.yml lint job, pinned v0.48.0) and locally via make fmt / make fmt-check, alongside existing gofmt -s. GOIMPORTS_VERSION is added to the Makefile in lockstep with CI.

Four CLI test files are reformatted import-order only (stdlib → third-party → github.com/tracebloc/cli/...); no behavior changes.

^{Reviewed by Cursor Bugbot for commit 6f34128. Bugbot is set up for automated code reviews on this repo. Configure here.}

[LukasWodka]

👋 Heads-up — Code review queue is at 42 / 30

Above the WIP limit. The team convention is to review existing PRs before opening new work.

Open PRs currently in Code review (oldest first):

• averaging-service#181 — feat(weights): normalize-on-read — mixed cycles average instead of rejecting (SEC-03 §8 step 2) · author: @shujaatTracebloc · no reviewer assigned
• averaging-service#182 — feat(weights): averaging writes SafeTensors (TF + PyTorch) — SEC-03 §8 step 4 · author: @shujaatTracebloc · no reviewer assigned
• backend#1079 — feat(global_meta): edge dataset_meta exposure + attributes contract at ingest (#924 G4a) · author: @divyasinghds · no reviewer assigned
• backend#1086 — docs(rfc): SafeTensors weight-format migration — SEC-03 Phase 1 (RFC 0004) · author: @shujaatTracebloc · no reviewer assigned
• backend#1093 — chore(deps): bump django from 5.2.14 to 5.2.15 · author: @dependabot · no reviewer assigned
• backend#1095 — feat(experiment): configurable preprocessing knobs incl. tabular scaler — RFC 0003 L1 + L1b (#1094) · author: @LukasWodka · no reviewer assigned
• backend#1100 — fix(boot): pin SDK install to tracebloc==0.11.2, drop 404 dev line (#1098) · author: @LukasWodka · reviewer: @saqlainsyed007
• backend#1105 — perf(api): query micro-fixes — notifications N+1, cached data_scientist, composite index, sampling (#975) · author: @aptracebloc · no reviewer assigned
• cli#266 — main - > enhance CLI features and tests · author: @saadqbal · no reviewer assigned
• cli#278 — fix(deps): toolchain go1.26.5 + x/net v0.57.0 — clear 6 reachable vulns; govulncheck CI gate · author: @LukasWodka · reviewer: @saadqbal

Pull from review before opening new work. (This is a nudge from the kanban WIP check, not a block.)

[LukasWodka]

@BugBot run

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

1 issue from previous review remains unresolved.

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 876f1bc. Configure here.}

[LukasWodka]

@BugBot run

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

1 issue from previous review remains unresolved.

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 876f1bc. Configure here.}

[saadqbal]

👍 Solid — goimports gate logic is correct, make fmt actually runs goimports -local -w so the remediation hint is accurate, and the version pin (v0.48.0) matches between Makefile and build.yml. Dependabot grouping (k8s / golang-x lockstep) is the right call. All green. (Stacked on #302 — land that first.)

[saadqbal]

Status: approved, stacked on #302 (ci/279-staticcheck-pinned). Will retarget to develop and be mergeable once #302 is rebased + merged. Nothing needed here yet.