1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
# Cargo.lock is tracked on purpose (see .gitignore for the reasoning:
# reproducible CI, bisectable dependency regressions, and a
# `cargo install --locked` that resolves what was actually reviewed).
#
# The cost of that choice is that the lockfile does not update itself.
# Left alone it pins whatever was current on release day, so a
# `cargo install --locked yodel` keeps handing users those versions long
# after upstream has moved -- including past a fix for an advisory the
# audit workflow is meanwhile reporting every Monday. Committing the
# lockfile only pays off if something keeps it moving.
version: 2
updates:
- package-ecosystem: cargo
directory: /
schedule:
interval: weekly
day: monday
# Update Cargo.lock, never the requirements in Cargo.toml.
#
# The default strategy also widens the requirements, and the first
# thing it did here was propose cpal 0.16 -> 0.17, which renames
# `SampleRate` to a type alias and removes `Device::name()`. CI caught
# it, which is the system working -- but a semver-major bump is an API
# migration, and a migration is not a thing a bot can open on a Monday
# and have anyone merge on the strength of a green tick.
#
# Keeping the lockfile current is the whole reason it is tracked. That
# is what this does; crossing a major version stays a decision someone
# makes on purpose.
versioning-strategy: lockfile-only
# One pull request for the lot. The requirements in Cargo.toml are
# deliberately loose ("3", "4", "1"), so nearly every update here is a
# patch-level lockfile bump; fifteen separate pull requests for fifteen
# of them would train everyone to stop reading them.
groups:
cargo:
patterns:
open-pull-requests-limit: 3
commit-message:
prefix: "build(deps)"
# No entry for examples/esp32-riscv on purpose: its only dependency is
# `yodel` itself by path, and it gitignores its lockfile, so there is
# nothing there for dependabot to bump.
- package-ecosystem: github-actions
directory: /
schedule:
interval: weekly
day: monday
groups:
actions:
patterns:
commit-message:
prefix: "ci(deps)"