mirror of
https://github.com/PerpetualSoftware/pad.git
synced 2026-09-10 15:05:40 +00:00
xarmian
8d33dcbfc8
Add .github/dependabot.yml covering four ecosystems:
- gomod (root) — Go modules for cmd/pad + internal/*
- npm (/web) — SvelteKit frontend dependencies
- github-actions (root) — pairs with TASK-677 SHA pinning
- docker (root) — both Dockerfile and Dockerfile.goreleaser
Strategy:
- Weekly schedule on Monday 06:00 PT (off-hours, avoids PR flood
on weekdays)
- Minor + patch updates grouped per ecosystem → one PR/week
- Major version bumps get their own PRs so breaking changes are
reviewed in isolation
- open-pull-requests-limit: 5 per ecosystem (3 for docker) keeps
backlog manageable
- Commit prefixes follow the conventional-commit style the project
already uses (chore(deps) / chore(ci) / chore(docker))
Pairs with TASK-677: for SHA-pinned Actions, Dependabot updates both
the commit SHA and the trailing '# vX.Y.Z' comment in one PR, so the
human-readable version label stays in sync.
Parent: PLAN-644.
102 lines
2.5 KiB
YAML
102 lines
2.5 KiB
YAML
# Dependabot configuration for Pad.
|
|
#
|
|
# Pairs with TASK-677 (SHA-pinned Actions): Dependabot understands
|
|
# commit-pinned uses: refs and opens PRs that update the SHA + trailing
|
|
# version comment together, so the human-reviewable version label stays
|
|
# in sync with the pinned SHA.
|
|
#
|
|
# Grouping strategy: patch + minor updates collapse into one PR per
|
|
# ecosystem per week; major bumps get their own PRs so the breaking
|
|
# change is easy to review in isolation.
|
|
version: 2
|
|
updates:
|
|
# Go modules at repo root (cmd/pad + internal/*).
|
|
- package-ecosystem: gomod
|
|
directory: "/"
|
|
schedule:
|
|
interval: weekly
|
|
day: monday
|
|
time: "06:00"
|
|
timezone: America/Los_Angeles
|
|
open-pull-requests-limit: 5
|
|
labels:
|
|
- dependencies
|
|
- go
|
|
commit-message:
|
|
prefix: "chore(deps)"
|
|
include: scope
|
|
groups:
|
|
go-minor-and-patch:
|
|
applies-to: version-updates
|
|
update-types:
|
|
- minor
|
|
- patch
|
|
|
|
# Web UI npm deps (SvelteKit frontend).
|
|
- package-ecosystem: npm
|
|
directory: "/web"
|
|
schedule:
|
|
interval: weekly
|
|
day: monday
|
|
time: "06:00"
|
|
timezone: America/Los_Angeles
|
|
open-pull-requests-limit: 5
|
|
labels:
|
|
- dependencies
|
|
- javascript
|
|
commit-message:
|
|
prefix: "chore(deps)"
|
|
include: scope
|
|
groups:
|
|
npm-minor-and-patch:
|
|
applies-to: version-updates
|
|
update-types:
|
|
- minor
|
|
- patch
|
|
|
|
# GitHub Actions — pairs with TASK-677 (SHA pinning).
|
|
- package-ecosystem: github-actions
|
|
directory: "/"
|
|
schedule:
|
|
interval: weekly
|
|
day: monday
|
|
time: "06:00"
|
|
timezone: America/Los_Angeles
|
|
open-pull-requests-limit: 5
|
|
labels:
|
|
- dependencies
|
|
- github-actions
|
|
commit-message:
|
|
prefix: "chore(ci)"
|
|
include: scope
|
|
groups:
|
|
actions-minor-and-patch:
|
|
applies-to: version-updates
|
|
update-types:
|
|
- minor
|
|
- patch
|
|
|
|
# Docker base images. The `/` directory covers both Dockerfile and
|
|
# Dockerfile.goreleaser — Dependabot's docker ecosystem scans every
|
|
# `Dockerfile*` file in the directory.
|
|
- package-ecosystem: docker
|
|
directory: "/"
|
|
schedule:
|
|
interval: weekly
|
|
day: monday
|
|
time: "06:00"
|
|
timezone: America/Los_Angeles
|
|
open-pull-requests-limit: 3
|
|
labels:
|
|
- dependencies
|
|
- docker
|
|
commit-message:
|
|
prefix: "chore(docker)"
|
|
include: scope
|
|
groups:
|
|
docker-minor-and-patch:
|
|
applies-to: version-updates
|
|
update-types:
|
|
- minor
|
|
- patch
|