From 8d33dcbfc84e5ba8a4beaa2986985eb8aaa851de Mon Sep 17 00:00:00 2001
From: xarmian <xarmian@gmail.com>
Date: Wed, 22 Apr 2026 15:33:26 -0400
Subject: [PATCH] chore(ci): add Dependabot configuration (TASK-678) (#202)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add .github/dependabot.yml covering four ecosystems:
  - gomod (root) — Go modules for cmd/pad + internal/*
  - npm (/web) — SvelteKit frontend dependencies
  - github-actions (root) — pairs with TASK-677 SHA pinning
  - docker (root) — both Dockerfile and Dockerfile.goreleaser

Strategy:
  - Weekly schedule on Monday 06:00 PT (off-hours, avoids PR flood
    on weekdays)
  - Minor + patch updates grouped per ecosystem → one PR/week
  - Major version bumps get their own PRs so breaking changes are
    reviewed in isolation
  - open-pull-requests-limit: 5 per ecosystem (3 for docker) keeps
    backlog manageable
  - Commit prefixes follow the conventional-commit style the project
    already uses (chore(deps) / chore(ci) / chore(docker))

Pairs with TASK-677: for SHA-pinned Actions, Dependabot updates both
the commit SHA and the trailing '# vX.Y.Z' comment in one PR, so the
human-readable version label stays in sync.

Parent: PLAN-644.
---
 .github/dependabot.yml | 101 +++++++++++++++++++++++++++++++++++++++++
 1 file changed, 101 insertions(+)
 create mode 100644 .github/dependabot.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 00000000..fdce9479
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,101 @@
+# Dependabot configuration for Pad.
+#
+# Pairs with TASK-677 (SHA-pinned Actions): Dependabot understands
+# commit-pinned uses: refs and opens PRs that update the SHA + trailing
+# version comment together, so the human-reviewable version label stays
+# in sync with the pinned SHA.
+#
+# Grouping strategy: patch + minor updates collapse into one PR per
+# ecosystem per week; major bumps get their own PRs so the breaking
+# change is easy to review in isolation.
+version: 2
+updates:
+  # Go modules at repo root (cmd/pad + internal/*).
+  - package-ecosystem: gomod
+    directory: "/"
+    schedule:
+      interval: weekly
+      day: monday
+      time: "06:00"
+      timezone: America/Los_Angeles
+    open-pull-requests-limit: 5
+    labels:
+      - dependencies
+      - go
+    commit-message:
+      prefix: "chore(deps)"
+      include: scope
+    groups:
+      go-minor-and-patch:
+        applies-to: version-updates
+        update-types:
+          - minor
+          - patch
+
+  # Web UI npm deps (SvelteKit frontend).
+  - package-ecosystem: npm
+    directory: "/web"
+    schedule:
+      interval: weekly
+      day: monday
+      time: "06:00"
+      timezone: America/Los_Angeles
+    open-pull-requests-limit: 5
+    labels:
+      - dependencies
+      - javascript
+    commit-message:
+      prefix: "chore(deps)"
+      include: scope
+    groups:
+      npm-minor-and-patch:
+        applies-to: version-updates
+        update-types:
+          - minor
+          - patch
+
+  # GitHub Actions — pairs with TASK-677 (SHA pinning).
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: weekly
+      day: monday
+      time: "06:00"
+      timezone: America/Los_Angeles
+    open-pull-requests-limit: 5
+    labels:
+      - dependencies
+      - github-actions
+    commit-message:
+      prefix: "chore(ci)"
+      include: scope
+    groups:
+      actions-minor-and-patch:
+        applies-to: version-updates
+        update-types:
+          - minor
+          - patch
+
+  # Docker base images. The `/` directory covers both Dockerfile and
+  # Dockerfile.goreleaser — Dependabot's docker ecosystem scans every
+  # `Dockerfile*` file in the directory.
+  - package-ecosystem: docker
+    directory: "/"
+    schedule:
+      interval: weekly
+      day: monday
+      time: "06:00"
+      timezone: America/Los_Angeles
+    open-pull-requests-limit: 3
+    labels:
+      - dependencies
+      - docker
+    commit-message:
+      prefix: "chore(docker)"
+      include: scope
+    groups:
+      docker-minor-and-patch:
+        applies-to: version-updates
+        update-types:
+          - minor
+          - patch