40 lines
1.6 KiB
YAML
40 lines
1.6 KiB
YAML
# Dependabot — dependency & supply-chain update gate for Waggle OS.
|
|
# Docs: https://docs.github.com/code-security/dependabot/dependabot-version-updates
|
|
version: 2
|
|
updates:
|
|
# npm — one entry at the repo root. This is an npm workspaces monorepo with a
|
|
# SINGLE root package-lock.json shared by every workspace (apps/*, packages/*),
|
|
# so Dependabot's workspace-aware npm updater covers the root manifest AND all
|
|
# workspace package.json files from `directory: "/"`. (The plural `directories`
|
|
# form is for repos with independent per-directory lockfiles — not this layout.)
|
|
# Minor+patch bumps are grouped into one PR per run to keep review volume low;
|
|
# majors stay ungrouped so breaking changes land as isolated, reviewable PRs.
|
|
#
|
|
# Intentionally NOT covered: `app/` (the Tauri desktop shell) is a standalone
|
|
# npm project outside the workspace with its own app/package-lock.json, and its
|
|
# Tauri toolchain is owned by the release/tauri workflows — add a separate npm
|
|
# entry with `directory: "/app"` only if that wave asks for it. `external/**`
|
|
# is vendored third-party code and is left alone.
|
|
- package-ecosystem: "npm"
|
|
directory: "/"
|
|
schedule:
|
|
interval: "weekly"
|
|
open-pull-requests-limit: 10
|
|
groups:
|
|
npm-minor-and-patch:
|
|
update-types:
|
|
- "minor"
|
|
- "patch"
|
|
|
|
# GitHub Actions pinned across .github/workflows/*.
|
|
- package-ecosystem: "github-actions"
|
|
directory: "/"
|
|
schedule:
|
|
interval: "weekly"
|
|
open-pull-requests-limit: 5
|
|
groups:
|
|
actions-minor-and-patch:
|
|
update-types:
|
|
- "minor"
|
|
- "patch"
|