tektoncd · jkhelil · Jun 16, 2026
diff --git a/.github/dependabot.config.yml b/.github/dependabot.config.yml
@@ -0,0 +1,59 @@
+# Human-editable source of truth for Dependabot configuration.
+# Active release branches are populated from releases.md by hack/generate-dependabot.sh.
+# Run ./hack/generate-dependabot.sh to regenerate .github/dependabot.yml.
+
+release-branches:
+  - release-v0.4.x
+  - release-v0.3.x
+ecosystems:
+  - package-ecosystem: gomod
+    directory: /
+    schedule:
+      interval: daily
+    labels:
+      - ok-to-test
+      - dependencies
+      - release-note-none
+      - kind/misc
+    ignore:
+      - dependency-name: "k8s.io/*"
+        update-types:
+          - "version-update:semver-major"
+          - "version-update:semver-minor"
+    cooldown:
+      default-days: 7
+      semver-major-days: 30
+      semver-minor-days: 7
+      semver-patch-days: 3
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    labels:
+      - ok-to-test
+      - dependencies
+      - release-note-none
+      - kind/misc
+    cooldown:
+      default-days: 7
+      semver-major-days: 30
+      semver-minor-days: 7
+      semver-patch-days: 3
+  - package-ecosystem: docker
+    directory: /tekton
+    schedule:
+      interval: weekly
+    labels:
+      - ok-to-test
+      - dependencies
+      - release-note-none
+      - kind/misc
+    groups:
+      all:
+        patterns:
+          - "*"
+    cooldown:
+      default-days: 7
+      semver-major-days: 30
+      semver-minor-days: 7
+      semver-patch-days: 3
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
@@ -1,36 +1,196 @@
+# Generated file - DO NOT EDIT MANUALLY
+# This file is generated by hack/generate-dependabot.sh
+#
+# To update this file:
+# 1. Edit .github/dependabot.config.yml
+# 2. Run: ./hack/generate-dependabot.sh
+#
 version: 2
 updates:
-  - package-ecosystem: "gomod"
-    directory: "/"
+  - package-ecosystem: gomod
+    directory: /
     schedule:
-      interval: "daily"
+      interval: daily
     labels:
-    - "ok-to-test"
-    - "dependencies"
-    - "release-note-none"
-    - "kind/misc"
+      - ok-to-test
+      - dependencies
+      - release-note-none
+      - kind/misc
     ignore:
-    - dependency-name: "k8s.io/*"
-      update-types: ["version-update:semver-major", "version-update:semver-minor"]
-  - package-ecosystem: "github-actions"
-    directory: "/"
-    schedule:
-      interval: "weekly"
-    labels:
-    - "ok-to-test"
-    - "dependencies"
-    - "release-note-none"
-    - "kind/misc"
-  - package-ecosystem: "docker"
-    directory: "/tekton"
-    schedule:
-      interval: "weekly"
-    labels:
-    - "ok-to-test"
-    - "dependencies"
-    - "release-note-none"
-    - "kind/misc"
+      - dependency-name: k8s.io/*
+        update-types:
+          - version-update:semver-major
+          - version-update:semver-minor
+    cooldown:
+      default-days: 7
+      semver-major-days: 30
+      semver-minor-days: 7
+      semver-patch-days: 3
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    labels:
+      - ok-to-test
+      - dependencies
+      - release-note-none
+      - kind/misc
+    cooldown:
+      default-days: 7
+      semver-major-days: 30
+      semver-minor-days: 7
+      semver-patch-days: 3
+  - package-ecosystem: docker
+    directory: /tekton
+    schedule:
+      interval: weekly
+    labels:
+      - ok-to-test
+      - dependencies
+      - release-note-none
+      - kind/misc
+    groups:
+      all:
+        patterns:
+          - '*'
+    cooldown:
+      default-days: 7
+      semver-major-days: 30
+      semver-minor-days: 7
+      semver-patch-days: 3
+  - package-ecosystem: gomod
+    directory: /
+    target-branch: release-v0.4.x
+    schedule:
+      interval: daily
+    labels:
+      - ok-to-test
+      - dependencies
+      - release-note-none
+      - kind/misc
+    ignore:
+      - dependency-name: k8s.io/*
+        update-types:
+          - version-update:semver-major
+          - version-update:semver-minor
+      - dependency-name: '*'
+        update-types:
+          - version-update:semver-major
+          - version-update:semver-minor
+    cooldown:
+      default-days: 7
+      semver-major-days: 30
+      semver-minor-days: 7
+      semver-patch-days: 3
+  - package-ecosystem: github-actions
+    directory: /
+    target-branch: release-v0.4.x
+    schedule:
+      interval: weekly
+    labels:
+      - ok-to-test
+      - dependencies
+      - release-note-none
+      - kind/misc
+    ignore:
+      - dependency-name: '*'
+        update-types:
+          - version-update:semver-major
+          - version-update:semver-minor
+    cooldown:
+      default-days: 7
+      semver-major-days: 30
+      semver-minor-days: 7
+      semver-patch-days: 3
+  - package-ecosystem: docker
+    directory: /tekton
+    target-branch: release-v0.4.x
+    schedule:
+      interval: weekly
+    labels:
+      - ok-to-test
+      - dependencies
+      - release-note-none
+      - kind/misc
+    ignore:
+      - dependency-name: '*'
+        update-types:
+          - version-update:semver-major
+          - version-update:semver-minor
+    groups:
+      all:
+        patterns:
+          - '*'
+    cooldown:
+      default-days: 7
+      semver-major-days: 30
+      semver-minor-days: 7
+      semver-patch-days: 3
+  - package-ecosystem: gomod
+    directory: /
+    target-branch: release-v0.3.x
+    schedule:
+      interval: daily
+    labels:
+      - ok-to-test
+      - dependencies
+      - release-note-none
+      - kind/misc
+    ignore:
+      - dependency-name: k8s.io/*
+        update-types:
+          - version-update:semver-major
+          - version-update:semver-minor
+      - dependency-name: '*'
+        update-types:
+          - version-update:semver-major
+          - version-update:semver-minor
+    cooldown:
+      default-days: 7
+      semver-major-days: 30
+      semver-minor-days: 7
+      semver-patch-days: 3
+  - package-ecosystem: github-actions
+    directory: /
+    target-branch: release-v0.3.x
+    schedule:
+      interval: weekly
+    labels:
+      - ok-to-test
+      - dependencies
+      - release-note-none
+      - kind/misc
+    ignore:
+      - dependency-name: '*'
+        update-types:
+          - version-update:semver-major
+          - version-update:semver-minor
+    cooldown:
+      default-days: 7
+      semver-major-days: 30
+      semver-minor-days: 7
+      semver-patch-days: 3
+  - package-ecosystem: docker
+    directory: /tekton
+    target-branch: release-v0.3.x
+    schedule:
+      interval: weekly
+    labels:
+      - ok-to-test
+      - dependencies
+      - release-note-none
+      - kind/misc
+    ignore:
+      - dependency-name: '*'
+        update-types:
+          - version-update:semver-major
+          - version-update:semver-minor
     groups:
       all:
         patterns:
-          - "*"
+          - '*'
+    cooldown:
+      default-days: 7
+      semver-major-days: 30
+      semver-minor-days: 7
+      semver-patch-days: 3
diff --git a/.github/workflows/dependabot-regen.yml b/.github/workflows/dependabot-regen.yml
@@ -0,0 +1,114 @@
+name: Regenerate Dependabot Configuration
+
+"on":
+  schedule:
+    - cron: '0 9 * * 1'
+  workflow_dispatch: {}
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  regenerate:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411  # v2.19.4
+        with:
+          egress-policy: audit
+
+      - name: Checkout repository
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        with:
+          persist-credentials: false
+
+      - name: Set up Go
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c  # v6.4.0
+        with:
+          go-version-file: 'go.mod'
+
+      - name: Regenerate dependabot.yml
+        run: |
+          echo "Regenerating .github/dependabot.yml..."
+          ./hack/generate-dependabot.sh
+
+      - name: Check for changes
+        id: check-changes
+        run: |
+          if git diff --quiet .github/dependabot.config.yml .github/dependabot.yml; then
+            echo "changed=false" >> $GITHUB_OUTPUT
+            echo "No changes detected in dependabot.yml"
+          else
+            echo "changed=true" >> $GITHUB_OUTPUT
+            echo "Changes detected in dependabot.yml"
+          fi
+
+      - name: Create Pull Request
+        if: steps.check-changes.outputs.changed == 'true'
+        env:
+          GH_TOKEN: ${{ secrets.CHATOPS_TOKEN }}
+          WORKFLOW_NAME: ${{ github.workflow }}
+          EVENT_NAME: ${{ github.event_name }}
+          SERVER_URL: ${{ github.server_url }}
+          REPOSITORY: ${{ github.repository }}
+          RUN_ID: ${{ github.run_id }}
+        run: |
+          git config user.name "tekton-robot"
+          git config user.email "tekton-robot@users.noreply.github.com"
+
+          # Create a new branch
+          BRANCH="dependabot-regen-$(date +%Y%m%d-%H%M%S)"
+          git checkout -b "$BRANCH"
+
+          # Commit changes
+          git add .github/dependabot.config.yml .github/dependabot.yml
+          git commit -s -m "Regenerate dependabot.yml from config
+
+          This automated PR regenerates .github/dependabot.yml from
+          .github/dependabot.config.yml to ensure the configuration
+          is up-to-date with the latest release branches.
+
+          Generated by: ${WORKFLOW_NAME}
+          Triggered by: ${EVENT_NAME}"
+
+          # Push branch (configure credentials only for this step)
+          git remote set-url origin "https://x-access-token:${GH_TOKEN}@github.com/${REPOSITORY}.git"
+          git push origin "$BRANCH"
+
+          # Create PR
+          gh pr create \
+            --title "Regenerate dependabot.yml configuration" \
+            --body "## Automated Dependabot Configuration Update
+
+          This PR regenerates \`.github/dependabot.yml\` from \`.github/dependabot.config.yml\`.
+
+          ### Changes
+          The dependabot configuration has been regenerated to ensure it's in sync with:
+          - Release branches listed in \`.github/dependabot.config.yml\`
+          - Ecosystem configurations
+
+          ### Review Checklist
+          - [ ] Verify that all active LTS release branches are included
+          - [ ] Check that main branch configurations look correct
+          - [ ] Ensure patch-only restrictions are applied to release branches
+
+          ---
+          🤖 This PR was automatically created by the \`${WORKFLOW_NAME}\` workflow.
+          **Triggered by**: ${EVENT_NAME}
+          **Run**: ${SERVER_URL}/${REPOSITORY}/actions/runs/${RUN_ID}" \
+            --base main \
+            --head "$BRANCH" \
+            --label "dependencies" \
+            --label "kind/misc" \
+            --label "release-note-none"
+
+      - name: Summary
+        env:
+          CHANGED: ${{ steps.check-changes.outputs.changed }}
+        run: |
+          if [ "${CHANGED}" = "true" ]; then
+            echo "✅ Pull request created with updated dependabot.yml"
+          else
+            echo "✅ No changes needed - dependabot.yml is up-to-date"
+          fi