1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
updates:
- commit-message:
prefix: chore(deps)
cooldown:
default-days: 7
directory: /
groups:
async-runtime:
patterns:
- tokio*
- async-*
update-types:
- minor
- patch
dev-dependencies:
patterns:
- proptest*
- test-*
- criterion*
update-types:
- minor
- patch
serde-ecosystem:
patterns:
- serde*
update-types:
- minor
- patch
labels:
- dependencies
- rust
open-pull-requests-limit: 10
package-ecosystem: cargo
reviewers:
- zircote
schedule:
day: monday
interval: weekly
time: "09:00"
timezone: America/Chicago
- commit-message:
prefix: chore(deps)
cooldown:
default-days: 7
directory: /
# Known quirk (nsip#364): dependabot has bumped docker/login-action to an
# untagged main-branch commit at least once (PR #346), leaving a stale/
# misleading trailing `# vX.Y.Z` comment on the uses: pin rather than
# landing on a real release tag. Sibling actions bumped in other PRs
# (actions/checkout, taiki-e/install-action -- see #351, #354) resolved
# correctly, so this is specific to docker/login-action, not a general
# dependabot behavior. When reviewing a docker/login-action bump PR,
# verify the target SHA matches a real tag
# (`gh api repos/docker/login-action/tags`) before merging -- do not
# trust the trailing version comment alone.
exclude-paths:
# gh-aw-generated workflows (gh aw compile). Every action embedded in these
# files -- not just github/gh-aw-actions/** -- is version-locked to the
# gh-aw compiler; dependabot hand-editing them would be silently reverted
# the next time someone runs `gh aw compile`. See #363.
- ".github/workflows/*.lock.yml"
groups:
github-actions:
patterns:
- "*"
update-types:
- minor
- patch
ignore:
# Belt-and-suspenders alongside exclude-paths above: if github/gh-aw-actions
# is ever referenced outside a *.lock.yml file, it stays version-locked to
# the gh-aw compiler rather than bumped by dependabot.
- dependency-name: "github/gh-aw-actions/**"
labels:
- dependencies
- github-actions
open-pull-requests-limit: 5
package-ecosystem: github-actions
reviewers:
- zircote
schedule:
day: monday
interval: weekly
time: "09:00"
timezone: America/Chicago
version: 2