civaccount/.github/dependabot.yml at main · wulfsagedev/civaccount · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
# Dependabot — security-focused configuration for CivAccount.
#
# Security updates always open a PR immediately.  Version updates are grouped
# weekly so the PR firehose stays manageable.  We pin all GitHub Actions to
# full commit SHAs (see .github/workflows/*.yml) and Dependabot will keep
# those SHAs current while preserving the version comments.

version: 2
updates:
  - package-ecosystem: "npm"
    directory: "/"
    schedule:
      interval: "weekly"
      day: "monday"
      time: "06:00"
      timezone: "Europe/London"
    # Group non-security updates into a single PR per week so we don't drown
    # in churn; security advisories still open their own PR immediately.
    groups:
      npm-weekly:
        applies-to: version-updates
        patterns:
          - "*"
    labels:
      - "dependencies"
    commit-message:
      prefix: "chore(deps):"
    # Ignore major-version bumps for Next.js and React in the batched PR —
    # those are breaking-change migrations that need conscious planning.
    # Security advisories on Next.js still come through as separate PRs.
    ignore:
      - dependency-name: "next"
        update-types: ["version-update:semver-major"]
      - dependency-name: "react"
        update-types: ["version-update:semver-major"]
      - dependency-name: "react-dom"
        update-types: ["version-update:semver-major"]

  - package-ecosystem: "github-actions"
    directory: "/"
    schedule:
      interval: "weekly"
      day: "monday"
      time: "06:00"
      timezone: "Europe/London"
    labels:
      - "ci"
      - "dependencies"
    commit-message:
      prefix: "chore(ci):"