feat: cut release 3.5.0-gmp (rc.1 demo)

.gcloudignore

@@ -0,0 +1,3 @@
+.git
+.gitignore
+#!include:.gitignore

.github/dependabot.yaml

@@ -0,0 +1,51 @@
+# Copyright 2025 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+version: 2
+updates:
+- package-ecosystem: "gomod"
+  directory: "/"
+  schedule:
+    interval: "weekly"
+  groups:
+   all:
+      patterns:
+      - "*"
+  open-pull-requests-limit: 0 # This ensures, only security updates will be created.
+- package-ecosystem: "npm"
+  directory: "/web/ui"
+  schedule:
+    interval: "weekly"
+  groups:
+    all:
+      patterns:
+      - "*"
+  open-pull-requests-limit: 0 # This ensures, only security updates will be created.
+- package-ecosystem: "github-actions"
+  directory: "/"
+  schedule:
+    interval: "weekly"
+  groups:
+    all:
+      patterns:
+      - "*"
+  open-pull-requests-limit: 0 # This ensures, only security updates will be created.
+- package-ecosystem: "docker"
+  directory: "/"
+  schedule:
+    interval: "weekly"
+  groups:
+    all:
+      patterns:
+      - "*"
+  open-pull-requests-limit: 0 # This ensures, only security updates will be created.

.github/workflows/automerge-dependabot.yml

@@ -1,4 +1,17 @@
----
+# Copyright 2025 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
 name: Dependabot auto-merge
 on: pull_request
 
@@ -7,19 +20,17 @@ concurrency:
   cancel-in-progress: true
 
 permissions:
-  contents: read
+  contents: write
+  pull-requests: write
 
 jobs:
   dependabot:
-    permissions:
-      contents: write
-      pull-requests: write
     runs-on: ubuntu-latest
-    if: ${{ github.event.pull_request.user.login == 'dependabot[bot]' && github.repository_owner == 'prometheus' }}
+    if: ${{ github.actor == 'dependabot[bot]' }}
     steps:
     - name: Dependabot metadata
       id: metadata
-      uses: dependabot/fetch-metadata@d7267f607e9d3fb96fc2fbe83e0af444713e90b7 # v2.3.0
+      uses: dependabot/fetch-metadata@dbb049abf0d677abbd7f7eee0375145b417fdd34 # v2.2.0
       with:
         github-token: "${{ secrets.GITHUB_TOKEN }}"
     - name: Enable auto-merge for Dependabot PRs