version: 2
updates:
# Actions are pinned to commit SHAs, so they cannot be updated by hand
# realistically. Dependabot rewrites the pin and the trailing tag comment
# together, which is the only sustainable way to keep pinning honest.
- package-ecosystem: github-actions
directory: /
schedule:
interval: weekly
commit-message:
prefix: "ci"
- package-ecosystem: cargo
directory: /
schedule:
interval: weekly
commit-message:
prefix: "deps"
groups:
# One PR for routine bumps; anything major still arrives separately so it
# gets read properly.
minor-and-patch:
update-types: