From f594636493a2683f9f3dc7c5b71d2fc0362e986f Mon Sep 17 00:00:00 2001
From: Shashank <shashankp9353@gmail.com>
Date: Mon, 27 Apr 2026 13:21:21 +0530
Subject: [PATCH] Add Dependabot configuration and dependency submission
 workflow

---
 .github/dependabot.yml                      | 71 +++++++++++++++++++++
 .github/workflows/dependency-submission.yml | 50 +++++++++++++++
 2 files changed, 121 insertions(+)
 create mode 100644 .github/dependabot.yml
 create mode 100644 .github/workflows/dependency-submission.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 00000000..e594670e
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,71 @@
+version: 2
+updates:
+  # Root package.json — main content editor source and build tooling
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "03:30"        # 30 min after dependency-submission workflow (03:00 UTC)
+      timezone: "UTC"
+    open-pull-requests-limit: 10
+    labels:
+      - "dependencies"
+    commit-message:
+      prefix: "chore(deps)"
+    groups:
+      sunbird:
+        patterns:
+          - "@project-sunbird/*"
+      gulp-tools:
+        patterns:
+          - "gulp*"
+          - "grunt*"
+      webpack-tools:
+        patterns:
+          - "webpack*"
+          - "*-loader"
+          - "clean-webpack-plugin"
+          - "copy-webpack-plugin"
+          - "mini-css-extract-plugin"
+          - "html-webpack-plugin"
+          - "zip-webpack-plugin"
+          - "compression-webpack-plugin"
+      karma-testing:
+        patterns:
+          - "karma*"
+          - "jasmine*"
+      eslint:
+        patterns:
+          - "eslint*"
+
+  # deploy/ has its own package.json with gulp deployment tooling
+  - package-ecosystem: "npm"
+    directory: "/deploy"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "03:30"
+      timezone: "UTC"
+    open-pull-requests-limit: 5
+    labels:
+      - "dependencies"
+    commit-message:
+      prefix: "chore(deps)"
+    groups:
+      gulp-tools:
+        patterns:
+          - "gulp*"
+
+  # Keep GitHub Actions workflow action versions updated
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "03:30"
+      timezone: "UTC"
+    labels:
+      - "dependencies"
+    commit-message:
+      prefix: "chore(ci)"
diff --git a/.github/workflows/dependency-submission.yml b/.github/workflows/dependency-submission.yml
new file mode 100644
index 00000000..54d2d9f7
--- /dev/null
+++ b/.github/workflows/dependency-submission.yml
@@ -0,0 +1,50 @@
+name: Dependency Submission
+
+on:
+  schedule:
+    - cron: '0 3 * * 1'          # 03:00 UTC every Monday — runs before Dependabot (03:30)
+  push:
+    branches: [master]
+    paths:
+      - 'package.json'
+      - 'package-lock.json'
+      - 'deploy/package.json'
+  pull_request:
+    branches: [master]
+    paths:
+      - 'package.json'
+      - 'package-lock.json'
+      - 'deploy/package.json'
+  workflow_dispatch:
+
+permissions:
+  contents: write
+
+jobs:
+  submit-npm-root:
+    name: Submit npm (root)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '18'
+      - uses: advanced-security/npm-dependency-submission-action@v1
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+  submit-npm-deploy:
+    name: Submit npm (deploy/)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '18'
+      # No lock file in deploy/ — generate one without installing node_modules
+      - run: npm install --package-lock-only
+        working-directory: deploy
+      - uses: advanced-security/npm-dependency-submission-action@v1
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          directory: ./deploy