processkit-py/.github/dependabot.yml at main · ZelAnton/processkit-py · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
version: 2

updates:
  - package-ecosystem: github-actions
    directory: /
    schedule:
      interval: weekly
    commit-message:
      prefix: CI
    groups:
      # One PR per weekly run for all action bumps, instead of one PR per action.
      github-actions:
        patterns:
          - "*"

  # `uv` reads pyproject.toml + uv.lock. Commit uv.lock so Dependabot can bump
  # pinned versions and open grouped PRs.
  - package-ecosystem: uv
    directory: /
    schedule:
      interval: weekly
    commit-message:
      prefix: Update
    groups:
      # One PR per weekly run for routine bumps keeps the changelog auto-fill tidy.
      python-dependencies:
        patterns:
          - "*"
        update-types:
          - minor
          - patch

  # Cargo reads Cargo.toml + Cargo.lock. Commit Cargo.lock so Dependabot can bump
  # pyo3 and other Rust crates (including security fixes).
  - package-ecosystem: cargo
    directory: /
    schedule:
      interval: weekly
    commit-message:
      prefix: Update
    groups:
      rust-dependencies:
        patterns:
          - "*"
        update-types:
          - minor
          - patch

  # docker/Dockerfile (dev-only local test environment, excluded from the
  # sdist — see docker/Dockerfile's header) pins `rust:1-bookworm`. Keep that
  # base image current for the same reason as the other ecosystems: a stale
  # base can carry known CVEs even though it never ships to users.
  - package-ecosystem: docker
    directory: /docker
    schedule:
      interval: weekly
    commit-message:
      prefix: CI