version: 2
updates:
# Keep the SHA-pinned GitHub Actions current (Dependabot bumps the pinned
# commit and the trailing `# vX` comment together).
- package-ecosystem: "github-actions"
directory: "/"
schedule:
interval: "weekly"
commit-message:
prefix: "ci"
# Surface Rust dependency updates, including security advisories.
- package-ecosystem: "cargo"
directory: "/"
schedule:
interval: "weekly"
commit-message:
prefix: "deps"
open-pull-requests-limit: 5