chore(deps): add general label to all dependabot ecosystems (#1460)

[amehsamuel200225-sketch]

Closes #1460

Summary

Adds the general label to all four Dependabot ecosystems in .github/dependabot.yml, so dependency PRs are tagged consistently for triage-board filtering.

This implements the first option in the acceptance criteria ("Configure dependabot.yml labels: [dependencies, general]"). The alternative — an auto-label workflow gated on if: actor == 'dependabot[bot]' — was not used, because the native Dependabot labels: key is the supported mechanism and the file already uses it.

Changes

.github/dependabot.yml — added - "general" to the labels: list of all four updates entries (npm /frontend, npm /backend, cargo /, github-actions /). Existing dependencies, security, and github-actions labels were preserved; this is purely additive.

Findings for maintainers

Three things surfaced while implementing this that are worth flagging, since the issue's premise did not match the repository:

1. Labels were already configured. The issue states Dependabot "opens PRs without labels," but every ecosystem already declared a labels: list. The only genuinely missing label was general, which is what this PR adds.

2. The configured labels do not exist in the repository. gh label list shows 19 labels in this repo; dependencies, security, and github-actions are not among them (only general exists). Dependabot applies labels by name and silently skips ones that do not exist, so the configured dependencies label is unlikely to be applied to any PR. This needs a maintainer with admin rights to create those labels, or a change to reference existing ones. I could not do this from a fork PR. This is the part of the issue that is genuinely unfixed.

3. The reported symptom was never observed. gh pr list --author "dependabot[bot]" --state all returns zero PRs — Dependabot has never opened one in this repository, so the "15 unlabeled dependabot PRs per week" backlog described in the issue does not exist. Note that dependabot.yml targets /frontend and /backend npm directories; if the frontend/backend lockfiles are current there may simply be nothing to update.

Acceptance criteria status

• Configure dependabot.yml labels: [dependencies, general] — general added to all four ecosystems.
• Board filter -label:dependencies — not deliverable in a PR. This is a GitHub Project board view configuration, applied in the board UI or project settings. Needs a maintainer, and is also blocked on finding #2 above (the dependencies label must exist first for the filter to be meaningful).
• Test: open a dummy dependabot PR and assert it has the dependencies label — not performed. A dummy PR cannot reproduce Dependabot's own labeling behaviour, and the repo has no Dependabot PRs to inspect. Verification instead covered: all four ecosystems parse with the expected label sets, and label indentation is valid. Empirically confirming the label lands requires waiting for a real Dependabot PR after the dependencies label is created.
• No regression for human PRs getting correct labels — this config only affects Dependabot-created PRs; no labeler workflow was added, so human PR labelling is untouched.

Validation

• Structural check over .github/dependabot.yml: 4 package-ecosystem entries, 4 dependencies labels, 4 general labels, 0 indentation issues.
• git diff --check — clean.
• Change is confined to a single YAML file with no build or test impact.

[drips-wave]

@amehsamuel200225-sketch Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits