dependabot is an independent security scanning tool which mostly focuses on evaluating the dependency chain. Having the dependabot.yml file on the main branch would enable the bot to test the dependencies daily.
