1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
# Dependabot keeps both dependency trees current.
#
# Scorecard's Dependency-Update-Tool check looks for exactly this file.
# It scored zero without it, which was accurate: nothing was watching
# for a vulnerable transitive dependency between `cargo audit` runs.
#
# GitHub Actions are pinned by commit SHA rather than tag, so a moved
# tag cannot change what runs. Dependabot understands that pinning and
# updates the SHA while keeping the `# v4` comment accurate.
version: 2
updates:
- package-ecosystem: cargo
directory: "/"
schedule:
interval: weekly
open-pull-requests-limit: 5
- package-ecosystem: github-actions
directory: "/"
schedule:
interval: weekly
open-pull-requests-limit: 5
# The CodeQL sub-actions must all run the same version. Bumped
# separately -- which is what Dependabot does by default -- an
# `init` at v4 meets an `analyze` at v3 and the job fails with
# "Loaded a configuration file for version '4.x', but running
# version '3.x'". Grouping them makes one pull request that moves
# all three together.
groups:
codeql:
patterns:
- "github/codeql-action*"
# `dtolnay/rust-toolchain` was ignored here while its ref carried the
# Rust toolchain (`@1.98.0`); Dependabot read that as a stale action
# version and proposed moving the compiler. The ref is now a pinned
# commit SHA and the toolchain moved into a `with: toolchain:` input,
# so the two are no longer conflated -- Dependabot updates the SHA and
# leaves the compiler alone. Keeping the ignore would freeze the pin.