mirror of
https://github.com/PerpetualSoftware/pad.git
synced 2026-10-26 22:37:03 +00:00
xarmian
6ffd2d1b8c
Every ecosystem now waits 7 days after a release before Dependabot proposes it, so a hijacked or broken version that is yanked within days never reaches a PR. gomod and npm wait 14 days for a semver major. github-actions and docker take default-days only: GitHub honours the semver-*-days keys just for SemVer package managers. Security updates are not affected; cooldown applies to version updates only.
140 lines
4.3 KiB
YAML
140 lines
4.3 KiB
YAML
# Dependabot configuration for Pad.
|
|
#
|
|
# Pairs with TASK-677 (SHA-pinned Actions): Dependabot understands
|
|
# commit-pinned uses: refs and opens PRs that update the SHA + trailing
|
|
# version comment together, so the human-reviewable version label stays
|
|
# in sync with the pinned SHA.
|
|
#
|
|
# Grouping strategy: patch + minor updates collapse into one PR per
|
|
# ecosystem per week; major bumps get their own PRs so the breaking
|
|
# change is easy to review in isolation.
|
|
#
|
|
# Cooldown (TASK-1390): every ecosystem waits 7 days after a release
|
|
# before proposing it, and gomod and npm wait 14 for a major. Security
|
|
# updates bypass it.
|
|
version: 2
|
|
updates:
|
|
# Go modules at repo root (cmd/pad + internal/*).
|
|
- package-ecosystem: gomod
|
|
directory: "/"
|
|
schedule:
|
|
interval: weekly
|
|
day: monday
|
|
time: "06:00"
|
|
timezone: America/Los_Angeles
|
|
# Hold a release for 7 days (14 for a major) before proposing it, so a
|
|
# hijacked or broken version that is yanked within days never reaches a
|
|
# PR (TASK-1390). Security updates are never held: cooldown applies to
|
|
# version updates only.
|
|
cooldown:
|
|
default-days: 7
|
|
semver-major-days: 14
|
|
open-pull-requests-limit: 5
|
|
labels:
|
|
- dependencies
|
|
- go
|
|
commit-message:
|
|
prefix: "chore(deps)"
|
|
include: scope
|
|
ignore:
|
|
# mcp-go v1.1.1 cancels every in-flight stdio request at stdin EOF
|
|
# (upstream #977), so `pad mcp serve` fed a piped batch answers
|
|
# `context canceled` for each dispatcher-backed call (TASK-3298).
|
|
# Only this release is excluded; internal/mcp's
|
|
# TestStdio_EOFDoesNotCancelInFlightRequests guards the next one.
|
|
- dependency-name: "github.com/mark3labs/mcp-go"
|
|
versions: ["1.1.1"]
|
|
groups:
|
|
go-minor-and-patch:
|
|
applies-to: version-updates
|
|
update-types:
|
|
- minor
|
|
- patch
|
|
|
|
# Web UI npm deps (SvelteKit frontend).
|
|
- package-ecosystem: npm
|
|
directory: "/web"
|
|
schedule:
|
|
interval: weekly
|
|
day: monday
|
|
time: "06:00"
|
|
timezone: America/Los_Angeles
|
|
# Hold a release for 7 days (14 for a major) before proposing it, so a
|
|
# hijacked or broken version that is yanked within days never reaches a
|
|
# PR (TASK-1390). Security updates are never held: cooldown applies to
|
|
# version updates only.
|
|
cooldown:
|
|
default-days: 7
|
|
semver-major-days: 14
|
|
open-pull-requests-limit: 5
|
|
labels:
|
|
- dependencies
|
|
- javascript
|
|
commit-message:
|
|
prefix: "chore(deps)"
|
|
include: scope
|
|
groups:
|
|
npm-minor-and-patch:
|
|
applies-to: version-updates
|
|
update-types:
|
|
- minor
|
|
- patch
|
|
|
|
# GitHub Actions — pairs with TASK-677 (SHA pinning).
|
|
- package-ecosystem: github-actions
|
|
directory: "/"
|
|
schedule:
|
|
interval: weekly
|
|
day: monday
|
|
time: "06:00"
|
|
timezone: America/Los_Angeles
|
|
# Hold a release for 7 days before proposing it (TASK-1390). This
|
|
# ecosystem takes default-days only: the semver-*-days keys are honoured
|
|
# just for SemVer package managers such as gomod and npm. Security
|
|
# updates are never held.
|
|
cooldown:
|
|
default-days: 7
|
|
open-pull-requests-limit: 5
|
|
labels:
|
|
- dependencies
|
|
- github-actions
|
|
commit-message:
|
|
prefix: "chore(ci)"
|
|
include: scope
|
|
groups:
|
|
actions-minor-and-patch:
|
|
applies-to: version-updates
|
|
update-types:
|
|
- minor
|
|
- patch
|
|
|
|
# Docker base images. The `/` directory covers both Dockerfile and
|
|
# Dockerfile.goreleaser — Dependabot's docker ecosystem scans every
|
|
# `Dockerfile*` file in the directory.
|
|
- package-ecosystem: docker
|
|
directory: "/"
|
|
schedule:
|
|
interval: weekly
|
|
day: monday
|
|
time: "06:00"
|
|
timezone: America/Los_Angeles
|
|
# Hold a release for 7 days before proposing it (TASK-1390). This
|
|
# ecosystem takes default-days only: the semver-*-days keys are honoured
|
|
# just for SemVer package managers such as gomod and npm. Security
|
|
# updates are never held.
|
|
cooldown:
|
|
default-days: 7
|
|
open-pull-requests-limit: 3
|
|
labels:
|
|
- dependencies
|
|
- docker
|
|
commit-message:
|
|
prefix: "chore(docker)"
|
|
include: scope
|
|
groups:
|
|
docker-minor-and-patch:
|
|
applies-to: version-updates
|
|
update-types:
|
|
- minor
|
|
- patch
|