# Dependabot keeps this repository's GitHub Actions current, so a security fix
# arrives as a pull request rather than slipping past. The bumps are grouped
# into one pull request so they land together.
#
# Package versions are not Dependabot's work here. `ship` runs the language's
# own update as a release step, which puts the decision at the moment the tree
# is being looked at anyway, and keeps what a release ships current as of that
# release. Security alerts are a separate switch and stay on.
version: 2
updates:
- package-ecosystem: github-actions
directory: "/"
schedule:
interval: monthly
open-pull-requests-limit: 5
commit-message:
prefix: "ci"
groups:
actions:
patterns:
- "*"
# actions/checkout, actions/upload-artifact, and actions/download-artifact are pinned by
# cargo-dist's generated release.yml. Bumping them independently breaks the
# plan job. Update cargo-dist itself in dist-workspace.toml to pick up newer
# artifact-action versions through that channel.
ignore:
- dependency-name: "actions/checkout"
- dependency-name: "actions/upload-artifact"
- dependency-name: "actions/download-artifact"