setup dependabot for clog (#18)

Signed-off-by: Kenny Leung <kleung@chainguard.dev>

.github/dependabot.yml

@@ -0,0 +1,20 @@
+# Copyright 2024 Chainguard, Inc.
+# SPDX-License-Identifier: Apache-2.0
+
+version: 2
+updates:
+- package-ecosystem: gomod
+  directory: "/"
+  schedule:
+    interval: "weekly"
+  open-pull-requests-limit: 10
+  groups:
+    all:
+      update-types:
+        - "minor"
+        - "patch"
+- package-ecosystem: "github-actions"
+  directory: "/"
+  schedule:
+    interval: "weekly"
+  open-pull-requests-limit: 10

.github/workflows/go.yml

@@ -17,9 +17,9 @@ jobs:
     - uses: actions/checkout@v3
 
     - name: Set up Go
-      uses: actions/setup-go@v4
+      uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
       with:
-        go-version: '1.21'
+        go-version-file: './go.mod'
 
     - name: Build
       run: go build -v ./...

go.mod

@@ -1,3 +1,3 @@
 module github.com/chainguard-dev/clog
 
-go 1.21.2
+go 1.22.4