What does Dependabot scan by default

[biohazd]

Select Topic Area

Question

Body

If I enable dependabot scanning. What does it scan in my repo by default ?

for example, if I have gradle build and Python and terraform code in my repo. By default will it scan all of those or do I need to create dependabot.yml file to tell it to scan “gradle” or “terraform”

[biohazd]

Awesome.

By default, how often does it scan those? Daily, weekly?

[biohazd]

Does it also scan GitHub workflows by default or do I have to create a dependabot.yaml file to scan them ?