dependabot.yml

# Dependabot keeps third-party action SHAs and Python deps current. The PR
# workflow runs against every Dependabot PR, so if a bump breaks something we
# learn about it in CI rather than in production.
version: 2
updates:
  # GitHub Actions used by the workflows in .github/workflows. We pin
  # third-party actions to a commit SHA with the version in a comment;
  # Dependabot understands that pattern and will keep bumping the SHA.
  - package-ecosystem: "github-actions"
    directory: "/"
    schedule:
      interval: "daily"
    open-pull-requests-limit: 5
    commit-message:
      # Conventional Commits: `deps(actions): bump foo from 1 to 2`.
      prefix: "deps(actions)"
    groups:
      # Roll every github-actions bump into a single PR per run so we review
      # and merge them as one ci(deps) batch instead of N parallel PRs.
      github-actions:
        patterns:
          - "*"

  # Python tooling (validator + tests). Declared in pyproject.toml and locked
  # in uv.lock. Use the dedicated `uv` ecosystem (not `pip`) so Dependabot
  # bumps both the manifest *and* the lockfile in the same PR — the `pip`
  # ecosystem ignores uv.lock and would leave it drifting behind.
  - package-ecosystem: "uv"
    directory: "/"
    schedule:
      interval: "daily"
    open-pull-requests-limit: 5
    commit-message:
      # Conventional Commits: `deps(uv): bump foo from 1 to 2`.
      prefix: "deps(uv)"
    groups:
      # Roll every uv bump into a single PR per run so the validator + test
      # suite runs once for the batch instead of once per dependency.
      python:
        patterns:
          - "*"