version: 2

# Cooldown: a version is proposed only once it has been public for 7 days, so a
# release that is yanked or found malicious within its first week never reaches a
# PR. Security updates are exempt from the cooldown by Dependabot's own rules.
#
# Grouping: every ecosystem gets one batched PR for minor/patch version
# updates and one batched PR for security updates. Groups apply to version
# updates only by default, so the security-updates groups are declared
# explicitly — otherwise every advisory lands as its own PR.

updates:
  - package-ecosystem: nuget
    directory: /
    schedule:
      interval: weekly
    cooldown:
      default-days: 7
    open-pull-requests-limit: 5
    groups:
      dotnet:
        patterns: ['*']
        update-types: [minor, patch]
      dotnet-security:
        applies-to: security-updates
        patterns: ['*']

  - package-ecosystem: npm
    directory: /src/Web/autopilot-monitor-web
    schedule:
      interval: weekly
    cooldown:
      default-days: 7
    open-pull-requests-limit: 5
    groups:
      web:
        patterns: ['*']
        update-types: [minor, patch]
      web-security:
        applies-to: security-updates
        patterns: ['*']
    # Major bumps are breaking and reviewed deliberately, not auto-PR'd.
    # Security updates ignore this filter, so the Security tab stays clean.
    ignore:
      - dependency-name: '*'
        update-types: ['version-update:semver-major']

  - package-ecosystem: npm
    directory: /src/McpServer/autopilot-monitor-mcp
    schedule:
      interval: weekly
    cooldown:
      default-days: 7
    open-pull-requests-limit: 5
    groups:
      mcp:
        patterns: ['*']
        update-types: [minor, patch]
      mcp-security:
        applies-to: security-updates
        patterns: ['*']
    # Major bumps are breaking and reviewed deliberately, not auto-PR'd.
    # Security updates ignore this filter, so the Security tab stays clean.
    ignore:
      - dependency-name: '*'
        update-types: ['version-update:semver-major']

  # Validator tooling for rules/ (ajv for validate.js); combine-rules.yml installs it from this
  # lockfile with contents:write in hand, so the pins must not go stale.
  - package-ecosystem: npm
    directory: /rules/scripts
    schedule:
      interval: weekly
    cooldown:
      default-days: 7
    open-pull-requests-limit: 5
    groups:
      rules-tooling:
        patterns: ['*']
      rules-tooling-security:
        applies-to: security-updates
        patterns: ['*']

  # Duplicate-check tooling (jscpd for tools/quality/check-duplicates.mjs), installed by the
  # CI duplicates job from this lockfile. A jscpd update can change the clone fingerprints:
  # if its PR fails the job, regenerate the baseline (npm run dup:baseline) in that PR.
  - package-ecosystem: npm
    directory: /tools/quality
    schedule:
      interval: weekly
    cooldown:
      default-days: 7
    open-pull-requests-limit: 5
    groups:
      quality-tooling:
        patterns: ['*']
      quality-tooling-security:
        applies-to: security-updates
        patterns: ['*']

  # Every action is referenced by commit SHA with the version in a trailing comment;
  # action-pins.yml fails any workflow change that reintroduces a mutable tag. Dependabot
  # is what keeps those pins current: it rewrites the SHA and the comment together, so the
  # pins are reviewed in a PR instead of drifting silently or being bumped by hand.
  - package-ecosystem: github-actions
    directory: /
    schedule:
      interval: monthly
    cooldown:
      default-days: 7
    groups:
      actions:
        patterns: ['*']
      actions-security:
        applies-to: security-updates
        patterns: ['*']