Add workflow that fails when Dependabot updates error

[claude]

Requested by William Storey, Greg Oschwald · Slack thread

Before: when a Dependabot version-update job errors (e.g. gradle can't resolve a dependency), nothing surfaces it to a human — the failure only shows as a red triangle in Insights → Dependency graph → Dependabot, which nobody checks. That's how this repo's gradle updates were silently broken for ~7 months while github-actions updates kept flowing.

After: a weekly scheduled workflow checks whether any Dependabot Updates run failed in the last 8 days and fails (goes red, and emails whoever last edited the cron) if so — so a broken ecosystem surfaces through a normal failed scheduled run instead of an invisible tab.

How: Dependabot version updates run as Actions workflow runs named Dependabot Updates. .github/workflows/dependabot-failure-watcher.yml runs on a weekly schedule (plus workflow_dispatch for manual runs), queries those runs via gh run list, and exits non-zero if any completed with failure or startup_failure in the window. Needs only actions: read.

Why scheduled rather than workflow_run: a scheduled run's actor is the user who last edited the cron, so a failure emails a human; a workflow_run-triggered run's actor is dependabot[bot], which emails no one.

Caveats: GitHub auto-disables scheduled workflows after 60 days of repo inactivity; and the failure email targets whoever last modified the cron.

Rollout: this is the reference PR; the same single file is intended for the other ~39 maxmind repos that have a Dependabot config.

[claude]

Superseded by #62, which added this watcher to main (running Wednesdays and also catching timed_out). Closing as redundant — the functionality here is already on main.