From 825ee792d206f4e966b1920e846aaaa79f4fa43d Mon Sep 17 00:00:00 2001 From: Nnamdi Kenneth Ojibe Date: Fri, 17 Jul 2026 18:01:05 -0700 Subject: [PATCH] Add Dependabot config for npm and GitHub Actions updates Weekly schedule with grouped minor/patch updates (separate production and development groups); major bumps arrive as individual PRs. Open-PR limits and labels keep the queue manageable. Closes #34 Co-Authored-By: Claude Fable 5 --- .github/dependabot.yml | 50 ++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 50 insertions(+) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..4847e5a --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,50 @@ +# Dependabot configuration +# Docs: https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file +version: 2 +updates: + # Root package.json / pnpm-lock.yaml + - package-ecosystem: "npm" + directory: "/" + schedule: + interval: "weekly" + day: "monday" + time: "06:00" + timezone: "Etc/UTC" + open-pull-requests-limit: 5 + labels: + - "dependencies" + commit-message: + prefix: "chore(deps)" + prefix-development: "chore(deps-dev)" + groups: + # Minor and patch bumps arrive as one weekly PR per group. + # Major bumps stay as individual PRs so breaking changes get their own review. + production-minor-patch: + dependency-type: "production" + update-types: + - "minor" + - "patch" + development-minor-patch: + dependency-type: "development" + update-types: + - "minor" + - "patch" + + # GitHub Actions used in .github/workflows/ + - package-ecosystem: "github-actions" + directory: "/" + schedule: + interval: "weekly" + day: "monday" + time: "06:00" + timezone: "Etc/UTC" + open-pull-requests-limit: 3 + labels: + - "dependencies" + - "ci" + commit-message: + prefix: "chore(ci)" + groups: + actions: + patterns: + - "*"