From a4abdf75dc744391865eeca4813ae89990de2854 Mon Sep 17 00:00:00 2001
From: Gepser Hoil <github@gepser.com>
Date: Mon, 23 Feb 2026 01:08:15 +0100
Subject: [PATCH] Add dependency maintenance policy docs

---
 CONTRIBUTING.md | 6 ++++++
 README.md       | 6 ++++++
 2 files changed, 12 insertions(+)

diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 3d43e49..6202560 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -40,3 +40,9 @@ BASE_URL=https://YOUR_DOMAIN_OR_FUNCTION_URL mise exec -- make smoke
 - Keep changes focused and small.
 - Include tests for behavioral changes.
 - Update `README.md` when API behavior changes.
+
+## Dependency maintenance
+
+- Dependabot PRs (`gomod`, `github-actions`) are reviewed weekly.
+- Merge only with passing CI checks.
+- For failing dependency PRs, push a fix commit to the PR branch or replace it with a clean follow-up PR.
diff --git a/README.md b/README.md
index 3b94283..ff435f5 100644
--- a/README.md
+++ b/README.md
@@ -263,6 +263,12 @@ projects/PROJECT_NUMBER/locations/global/workloadIdentityPools/POOL_ID/providers
 - `Smoke Tests` workflow can be run manually (`workflow_dispatch`) with a `base_url` input.
 - `Deploy` workflow deploys to GCP on `master` using OIDC/WIF.
 
+## 📦 Dependency Policy
+
+- Dependabot is enabled for `gomod` and `github-actions` on a weekly schedule.
+- Merge dependency PRs only after CI is green.
+- If a dependency PR fails CI, either patch on top of that branch or close and open a follow-up PR from `master`.
+
 ## 🤝 Contributing
 
 See `CONTRIBUTING.md`.