1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
# Dependency updates.
#
# Two ecosystems and no more. There is no npm package in this repository and
# there is not going to be one -- see docs/decisions/0001-no-npm-package.md --
# so there is nothing for a `npm` entry to watch.
version: 2
updates:
- package-ecosystem: cargo
directory: "/"
schedule:
interval: weekly
day: monday
open-pull-requests-limit: 5
commit-message:
prefix: "chore"
include: scope
groups:
# One pull request for the patch-level noise. A patch bump that breaks
# the build is worth knowing about, but not worth five separate reviews.
patch-updates:
update-types:
ignore:
# The certified stack is re-exported through the crate root, so its
# major version is part of Arcature's own public API. Raising one breaks
# downstream code, which under 0.x is a minor bump, and belongs in a
# hand-written pull request that says what changed and how to adapt.
- dependency-name: "axum"
update-types:
- dependency-name: "sea-orm"
update-types:
- dependency-name: "sqlx"
update-types:
- dependency-name: "tower"
update-types:
- dependency-name: "validator"
update-types:
# Every `uses:` in .github/workflows is pinned to a full commit SHA with the
# version in a trailing comment. A tag is a mutable pointer: whoever can move
# `v4` can run their code inside a job holding this repository's token, and
# that is a supply-chain compromise with no commit to review. A SHA cannot be
# moved.
#
# This entry is what keeps the pins from rotting. Dependabot rewrites both
# the SHA and the comment, so a pinned action still arrives as a reviewable
# pull request every week rather than freezing at whatever was current the
# day it was written.
- package-ecosystem: github-actions
directory: "/"
schedule:
interval: weekly
day: monday
open-pull-requests-limit: 3
commit-message:
prefix: "chore"