Sandbox::https://github.com/cryptomator/docs/blob/develop/.github/dependabot.yml

Visitar URL original

docs/.github/dependabot.yml at develop · cryptomator/docs · GitHub

Repository navigation

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

version: 2

# Reviewed dependency upgrades. Replaces ad-hoc `pnpm up --latest` with

# Dependabot PRs that go through normal review.

#

# - npm ecosystem covers pnpm-lock.yaml (Dependabot understands pnpm).

# - github-actions ecosystem covers third-party actions in workflows;

# they are part of the same supply chain and need the same review.

# - cooldown.default-days mirrors pnpm-workspace.yaml `minimumReleaseAge`

# (3 days) so Dependabot does not propose a version pnpm would refuse

# to install.

updates:

- package-ecosystem: npm

directory: /

schedule:

interval: monthly

open-pull-requests-limit: 5

cooldown:

default-days: 3

groups:

minor-and-patch:

update-types:

- minor

- patch

- package-ecosystem: github-actions

directory: /

schedule:

interval: monthly

open-pull-requests-limit: 5

cooldown:

default-days: 3

groups:

github-actions:

patterns:

- "*"