version: 2

# Keep the version-update review queue bounded. Minor and patch updates are
# grouped by ecosystem; major updates remain isolated so CI and review expose
# their risk. Security updates use separate ecosystem groups.
updates:
  - package-ecosystem: "github-actions"
    directory: "/"
    schedule:
      interval: "weekly"
      day: "tuesday"
      time: "04:00"
      timezone: "Europe/London"
    open-pull-requests-limit: 3
    labels:
      - "dependencies"
      - "github_actions"
    groups:
      actions-minor-patch:
        applies-to: "version-updates"
        patterns:
          - "*"
        update-types:
          - "minor"
          - "patch"
    # scripts/release_control/action_consumer_manifests.json pins each
    # release-consumed action to an exact SHA plus the upstream action.yml
    # sha256, and release_promotion_policy_test.py requires every workflow step
    # to match that manifest. Refreshing a pin needs the upstream action bytes
    # through the reviewed pin-refresh route, so keep these actions as explicit
    # work rather than opening proposals the manifest contract cannot accept.
    ignore:
      - dependency-name: "actions/attest"
      - dependency-name: "azure/setup-helm"
      - dependency-name: "docker/build-push-action"
      - dependency-name: "docker/login-action"
      - dependency-name: "docker/setup-buildx-action"
      - dependency-name: "docker/setup-qemu-action"
      - dependency-name: "signpath/github-action-submit-signing-request"
      - dependency-name: "tailscale/github-action"

  - package-ecosystem: "gomod"
    directories:
      - "/"
      - "/tests/integration/mock-github-server"
    schedule:
      interval: "weekly"
      day: "tuesday"
      time: "04:10"
      timezone: "Europe/London"
    open-pull-requests-limit: 3
    labels:
      - "dependencies"
    groups:
      go-minor-patch:
        applies-to: "version-updates"
        patterns:
          - "*"
        update-types:
          - "minor"
          - "patch"
      go-security:
        applies-to: "security-updates"
        patterns:
          - "*"

  - package-ecosystem: "npm"
    directories:
      - "/"
      - "/frontend-modern"
      - "/internal/cloudcp/portal/frontend"
      - "/tests/integration"
    schedule:
      interval: "weekly"
      day: "tuesday"
      time: "04:20"
      timezone: "Europe/London"
    open-pull-requests-limit: 3
    labels:
      - "dependencies"
      - "javascript"
    groups:
      npm-minor-patch:
        applies-to: "version-updates"
        patterns:
          - "*"
        update-types:
          - "minor"
          - "patch"
      npm-security:
        applies-to: "security-updates"
        patterns:
          - "*"
    # The offline browser-verification runtime is pinned to Playwright 1.56.1,
    # so frontend browser proofs require lockfile parity. Keep Playwright on the
    # governed 1.56.1 line; review upgrades as explicit work alongside a runtime
    # change, matching the docker governed-tag policy.
    ignore:
      - dependency-name: "playwright"
        update-types:
          - "version-update:semver-major"
          - "version-update:semver-minor"
          - "version-update:semver-patch"
      - dependency-name: "playwright-core"
        update-types:
          - "version-update:semver-major"
          - "version-update:semver-minor"
          - "version-update:semver-patch"
      - dependency-name: "@playwright/test"
        update-types:
          - "version-update:semver-major"
          - "version-update:semver-minor"
          - "version-update:semver-patch"
      # TypeScript majors must land with the lint toolchain:
      # @typescript-eslint/eslint-plugin@8.70.0, @typescript-eslint/parser@8.70.0
      # and typescript-eslint@8.70.0 each declare a peer dependency of
      # "typescript": ">=4.8.4 <6.1.0". Keep TypeScript majors as explicit work
      # rather than opening proposals the checked-in toolchain cannot build.
      - dependency-name: "typescript"
        update-types:
          - "version-update:semver-major"
      # ESLint 10's proposed lockfile drops every js-yaml copy, which breaks the
      # checked-in dependency-security contract. Migrate the lint stack and
      # its lockfile together rather than accepting an isolated major bump.
      - dependency-name: "eslint"
        update-types:
          - "version-update:semver-major"
      # lucide-solid 1.x removes an icon subpath still imported by the app.
      # Keep majors explicit until the icon imports and frontend proof migrate.
      - dependency-name: "lucide-solid"
        update-types:
          - "version-update:semver-major"
      # Vitest and its V8 coverage provider require matching major versions.
      # An isolated coverage-v8 5.x update cannot install beside Vitest 4.x;
      # migrate the pair with frontend proof as one explicit change instead.
      - dependency-name: "vitest"
        update-types:
          - "version-update:semver-major"
      - dependency-name: "@vitest/coverage-v8"
        update-types:
          - "version-update:semver-major"

  - package-ecosystem: "docker"
    directories:
      - "/"
      - "/.devcontainer"
      - "/deploy/provider-msp"
      - "/tests/integration/mock-github-server"
    schedule:
      interval: "weekly"
      day: "tuesday"
      time: "04:30"
      timezone: "Europe/London"
    open-pull-requests-limit: 3
    labels:
      - "dependencies"
    groups:
      shared-container-images:
        group-by: "dependency-name"
    # Dockerfiles intentionally track governed runtime/toolchain lines. Refresh
    # immutable digests automatically, but keep tag upgrades in explicit work.
    ignore:
      - dependency-name: "node"
        update-types:
          - "version-update:semver-major"
          - "version-update:semver-minor"
          - "version-update:semver-patch"
      - dependency-name: "golang"
        update-types:
          - "version-update:semver-major"
          - "version-update:semver-minor"
          - "version-update:semver-patch"
      - dependency-name: "alpine"
        update-types:
          - "version-update:semver-major"
          - "version-update:semver-minor"
          - "version-update:semver-patch"

  - package-ecosystem: "docker-compose"
    directory: "/tests/integration"
    schedule:
      interval: "weekly"
      day: "tuesday"
      time: "04:40"
      timezone: "Europe/London"
    open-pull-requests-limit: 3
    labels:
      - "dependencies"
    # Keep the governed Alpine release line explicit while allowing automatic
    # digest refreshes for the seed container used by release qualification.
    ignore:
      - dependency-name: "alpine"
        update-types:
          - "version-update:semver-major"
          - "version-update:semver-minor"
          - "version-update:semver-patch"

  - package-ecosystem: "devcontainers"
    directory: "/"
    schedule:
      interval: "weekly"
      day: "tuesday"
      time: "04:50"
      timezone: "Europe/London"
    open-pull-requests-limit: 3
    labels:
      - "dependencies"