[shenxianpeng]

Summary

DevOps Maturity is moving to security-only maintenance. This PR turns off Dependabot version updates by setting open-pull-requests-limit: 0 on every ecosystem in .github/dependabot.yml — the documented way to keep security updates while excluding version updates. The existing schedule and grouping are kept, so reverting is a one-line change per ecosystem.

Before / After

	Before	After
github-actions version-update PRs	monthly (grouped)	none
Open version-update PRs	#15 (release-drafter 7.7.0 → 7.10.0)	closed
Dependabot security updates (repo setting)	disabled → enabled in repo settings as part of this change	enabled
Security PRs when an advisory hits a dependency	opened	still opened (not affected by open-pull-requests-limit)

Validation

$ python -c 'import yaml; print([(u["package-ecosystem"], u.get("open-pull-requests-limit")) for u in yaml.safe_load(open(".github/dependabot.yml"))["updates"]])'
[('github-actions', 0)]
$ gh api repos/devops-maturity/devops-maturity-action/automated-security-fixes
{"enabled":true,"paused":false}

User impact

None for users. Maintainers stop receiving routine version-bump PRs; security fixes still arrive automatically.

AI disclosure

Prepared with Claude Code (AI-assisted). Not merged — awaiting maintainer review.