pulse/.github/dependabot.yml

version: 2

# Keep the version-update review queue bounded. Minor and patch updates are
# grouped by ecosystem; major updates remain isolated so CI and review expose
# their risk. Security updates use separate ecosystem groups.
updates:
  - package-ecosystem: "github-actions"
    directory: "/"
    schedule:
      interval: "weekly"
      day: "tuesday"
      time: "04:00"
      timezone: "Europe/London"
    open-pull-requests-limit: 3
    labels:
      - "dependencies"
      - "github_actions"
    groups:
      actions-minor-patch:
        applies-to: "version-updates"
        patterns:
          - "*"
        update-types:
          - "minor"
          - "patch"

  - package-ecosystem: "gomod"
    directories:
      - "/"
      - "/tests/integration/mock-github-server"
    schedule:
      interval: "weekly"
      day: "tuesday"
      time: "04:10"
      timezone: "Europe/London"
    open-pull-requests-limit: 3
    labels:
      - "dependencies"
    groups:
      go-minor-patch:
        applies-to: "version-updates"
        patterns:
          - "*"
        update-types:
          - "minor"
          - "patch"
      go-security:
        applies-to: "security-updates"
        patterns:
          - "*"

  - package-ecosystem: "npm"
    directories:
      - "/"
      - "/frontend-modern"
      - "/internal/cloudcp/portal/frontend"
      - "/tests/integration"
    schedule:
      interval: "weekly"
      day: "tuesday"
      time: "04:20"
      timezone: "Europe/London"
    open-pull-requests-limit: 3
    labels:
      - "dependencies"
      - "javascript"
    groups:
      npm-minor-patch:
        applies-to: "version-updates"
        patterns:
          - "*"
        update-types:
          - "minor"
          - "patch"
      npm-security:
        applies-to: "security-updates"
        patterns:
          - "*"

  - package-ecosystem: "docker"
    directories:
      - "/"
      - "/.devcontainer"
      - "/deploy/provider-msp"
      - "/tests/integration/mock-github-server"
    schedule:
      interval: "weekly"
      day: "tuesday"
      time: "04:30"
      timezone: "Europe/London"
    open-pull-requests-limit: 3
    labels:
      - "dependencies"
    groups:
      shared-container-images:
        group-by: "dependency-name"
    # Dockerfiles intentionally track governed runtime/toolchain lines. Refresh
    # immutable digests automatically, but keep tag upgrades in explicit work.
    ignore:
      - dependency-name: "node"
        update-types:
          - "version-update:semver-major"
          - "version-update:semver-minor"
          - "version-update:semver-patch"
      - dependency-name: "golang"
        update-types:
          - "version-update:semver-major"
          - "version-update:semver-minor"
          - "version-update:semver-patch"
      - dependency-name: "alpine"
        update-types:
          - "version-update:semver-major"
          - "version-update:semver-minor"
          - "version-update:semver-patch"

  - package-ecosystem: "docker-compose"
    directory: "/tests/integration"
    schedule:
      interval: "weekly"
      day: "tuesday"
      time: "04:40"
      timezone: "Europe/London"
    open-pull-requests-limit: 3
    labels:
      - "dependencies"
    # Keep the governed Alpine release line explicit while allowing automatic
    # digest refreshes for the seed container used by release qualification.
    ignore:
      - dependency-name: "alpine"
        update-types:
          - "version-update:semver-major"
          - "version-update:semver-minor"
          - "version-update:semver-patch"

  - package-ecosystem: "devcontainers"
    directory: "/"
    schedule:
      interval: "weekly"
      day: "tuesday"
      time: "04:50"
      timezone: "Europe/London"
    open-pull-requests-limit: 3
    labels:
      - "dependencies"