TPT-4593: Miscellaneous updates

[zliang-akamai]

📝 Description

Misc maintenance updates for this composite action:

• Harden action.yml by binding untrusted inputs through step env instead of interpolating them into run: scripts
• Bump GitHub Actions used in workflows and action.yml (checkout, setup-python, dependency-review-action, github-script, labeler pin)
• Add Dependabot config for monthly github-actions updates
• Add AGENTS.md contributor/agent guidance and a .gitignore for .DS_Store

[Copilot]

Pull request overview

This PR performs maintenance updates for the composite GitHub Action by hardening how untrusted inputs are handled in action.yml, modernizing the referenced GitHub Actions in workflows, and adding repository automation/docs hygiene files.

Changes:

• Bind inputs.token via step env in action.yml and reuse it in run: commands.
• Bump GitHub Actions versions/pins across the action and workflows.
• Add Dependabot configuration plus contributor/agent guidance and a .DS_Store ignore.

Reviewed changes

Copilot reviewed 7 out of 8 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
AGENTS.md	Adds agent/contributor guidance for repo shape, editing rules, validation, and PR conventions.
action.yml	Hardens token handling and adjusts install command to use environment variables.
.gitignore	Ignores .DS_Store.
.github/workflows/test.yml	Updates actions/checkout version used in integration test workflow.
.github/workflows/labeler.yml	Updates actions/checkout and labeler action pin.
.github/workflows/dependency-review.yml	Updates actions/checkout and dependency review action versions.
.github/workflows/clean-release-notes.yml	Updates actions/github-script version.
.github/dependabot.yml	Adds monthly Dependabot updates for github-actions.

Suppressed comments (1)

action.yml:79

• Writing LINODE_CLI_TOKEN to $GITHUB_ENV with echo "VAR=$TOKEN" allows newline injection: a token containing newlines could append additional environment variables or malformed entries. Use the documented heredoc form for environment files so the value is treated as a single entry even if it contains newlines.

      if: ${{ inputs.token != '' }}
      shell: bash
      env:
        TOKEN: ${{ inputs.token }}
      run: echo "LINODE_CLI_TOKEN=$TOKEN" >> "$GITHUB_ENV"

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.