g1t/services/security/fixtures/dependabot/dependabot_dependabot-core.yml
| 1 | # dependabot/dependabot-core's .github/dependabot.yml, as published. |
| 2 | version: 2 |
| 3 | multi-ecosystem-groups: |
| 4 | uv-ecosystem: |
| 5 | schedule: |
| 6 | interval: "weekly" |
| 7 | day: "sunday" |
| 8 | time: "16:00" |
| 9 | |
| 10 | updates: |
| 11 | - package-ecosystem: "bundler" |
| 12 | directories: |
| 13 | - "/updater" |
| 14 | - "/" |
| 15 | schedule: |
| 16 | interval: "weekly" |
| 17 | day: "sunday" |
| 18 | time: "16:00" |
| 19 | groups: |
| 20 | sorbet: |
| 21 | patterns: |
| 22 | - "*-sorbet" |
| 23 | - "sorbet-*" |
| 24 | - "sorbet" |
| 25 | - "tapioca" |
| 26 | aws-sdk: |
| 27 | patterns: |
| 28 | - "aws-sdk-*" |
| 29 | prod-dependencies: |
| 30 | dependency-type: "production" |
| 31 | update-types: |
| 32 | - "minor" |
| 33 | - "patch" |
| 34 | dev-dependencies: |
| 35 | dependency-type: "development" |
| 36 | update-types: |
| 37 | - "minor" |
| 38 | - "patch" |
| 39 | per-dependency: |
| 40 | group-by: "dependency-name" |
| 41 | |
| 42 | # Watch the per-ecosystem native helpers |
| 43 | - package-ecosystem: "composer" |
| 44 | directories: |
| 45 | - "/composer/helpers/v2" |
| 46 | schedule: |
| 47 | interval: "weekly" |
| 48 | day: "sunday" |
| 49 | time: "16:00" |
| 50 | groups: |
| 51 | prod-dependencies: |
| 52 | dependency-type: "production" |
| 53 | update-types: |
| 54 | - "minor" |
| 55 | - "patch" |
| 56 | dev-dependencies: |
| 57 | dependency-type: "development" |
| 58 | update-types: |
| 59 | - "minor" |
| 60 | - "patch" |
| 61 | - package-ecosystem: "devcontainers" |
| 62 | directory: "/" |
| 63 | schedule: |
| 64 | interval: "weekly" |
| 65 | day: "sunday" |
| 66 | time: "16:00" |
| 67 | - package-ecosystem: "docker" |
| 68 | directories: |
| 69 | - "/" |
| 70 | - "/cargo" |
| 71 | - "/docker" |
| 72 | - "/go_modules" |
| 73 | - "/gradle" |
| 74 | - "/helm" |
| 75 | - "/maven" |
| 76 | - "/nix" |
| 77 | schedule: |
| 78 | interval: "weekly" |
| 79 | day: "sunday" |
| 80 | time: "16:00" |
| 81 | groups: |
| 82 | container-tools: |
| 83 | patterns: |
| 84 | - "alpine/helm" |
| 85 | - "oras-project/oras" |
| 86 | - "regclient/regctl*" |
| 87 | - "sigstore/cosign/cosign*" |
| 88 | per-image: |
| 89 | group-by: "dependency-name" |
| 90 | - package-ecosystem: "github-actions" |
| 91 | directory: "/" |
| 92 | schedule: |
| 93 | interval: "weekly" |
| 94 | day: "sunday" |
| 95 | time: "16:00" |
| 96 | groups: |
| 97 | all-actions: |
| 98 | patterns: [ "*" ] |
| 99 | - package-ecosystem: "gomod" |
| 100 | directories: |
| 101 | - "/go_modules/helpers" |
| 102 | - "/silent/tests" |
| 103 | schedule: |
| 104 | interval: "weekly" |
| 105 | day: "sunday" |
| 106 | time: "16:00" |
| 107 | groups: |
| 108 | per-dependency: |
| 109 | group-by: "dependency-name" |
| 110 | - package-ecosystem: "julia" |
| 111 | directories: |
| 112 | - "/julia/helpers" |
| 113 | - "/julia/helpers/DependabotHelper.jl" |
| 114 | schedule: |
| 115 | interval: "weekly" |
| 116 | day: "sunday" |
| 117 | time: "16:00" |
| 118 | groups: |
| 119 | per-dependency: |
| 120 | group-by: "dependency-name" |
| 121 | - package-ecosystem: "mix" |
| 122 | directory: "/hex/helpers" |
| 123 | schedule: |
| 124 | interval: "weekly" |
| 125 | day: "sunday" |
| 126 | time: "16:00" |
| 127 | - package-ecosystem: "npm" |
| 128 | directories: |
| 129 | - "/bun/helpers" |
| 130 | - "/npm_and_yarn/helpers" |
| 131 | schedule: |
| 132 | interval: "weekly" |
| 133 | day: "sunday" |
| 134 | time: "16:00" |
| 135 | groups: |
| 136 | npm-dependencies: |
| 137 | patterns: |
| 138 | - "@npmcli/arborist" |
| 139 | - "nock" |
| 140 | - "npm" |
| 141 | - "semver" |
| 142 | exclude-patterns: |
| 143 | - "detect-indent" # temp excluded due to https://github.com/dependabot/dependabot-core/pull/5683#issuecomment-1243468605 |
| 144 | yarn-dependencies: |
| 145 | patterns: |
| 146 | - "@dependabot/yarn-lib" |
| 147 | pnpm-dependencies: |
| 148 | patterns: |
| 149 | - "@pnpm/lockfile-file" |
| 150 | - "@pnpm/dependency-path" |
| 151 | dev-dependencies: |
| 152 | dependency-type: "development" |
| 153 | update-types: |
| 154 | - "minor" |
| 155 | - "patch" |
| 156 | per-dependency: |
| 157 | group-by: "dependency-name" |
| 158 | ignore: |
| 159 | - dependency-name: "npm" |
| 160 | update-types: [ "version-update:semver-major" ] |
| 161 | - package-ecosystem: "pip" |
| 162 | directory: "/python/helpers" |
| 163 | schedule: |
| 164 | interval: "weekly" |
| 165 | day: "sunday" |
| 166 | time: "16:00" |
| 167 | groups: |
| 168 | common: |
| 169 | patterns: |
| 170 | - hashin |
| 171 | - cython |
| 172 | - flake8 |
| 173 | # Keep the package managers themselves separate because they are higher risk |
| 174 | # and also higher visibility--ie, users generally want latest, so we don't |
| 175 | # want breakage in the `common` group to prevent updating package manager versions |
| 176 | pip: |
| 177 | patterns: |
| 178 | - pip |
| 179 | pip-tools: |
| 180 | patterns: |
| 181 | - pip-tools |
| 182 | pipenv: |
| 183 | patterns: |
| 184 | - pipfile |
| 185 | - pipenv |
| 186 | poetry: |
| 187 | patterns: |
| 188 | - poetry |
| 189 | - package-ecosystem: "pub" |
| 190 | directory: "/pub/helpers" |
| 191 | schedule: |
| 192 | interval: "weekly" |
| 193 | day: "sunday" |
| 194 | time: "16:00" |
| 195 | - package-ecosystem: "nuget" |
| 196 | directory: "/nuget/helpers/lib/NuGetUpdater" |
| 197 | schedule: |
| 198 | interval: "weekly" |
| 199 | day: "sunday" |
| 200 | time: "16:00" |
| 201 | groups: |
| 202 | microsoft-build: |
| 203 | patterns: |
| 204 | - "Microsoft.Build*" |
| 205 | - package-ecosystem: "dotnet-sdk" |
| 206 | directory: "/nuget/helpers/lib/NuGetUpdater" |
| 207 | schedule: |
| 208 | interval: "weekly" |
| 209 | day: "sunday" |
| 210 | time: "16:00" |
| 211 | - package-ecosystem: "gitsubmodule" |
| 212 | directory: "/" |
| 213 | schedule: |
| 214 | interval: "weekly" |
| 215 | day: "sunday" |
| 216 | time: "16:00" |
| 217 | ignore: |
| 218 | # This revision must remain aligned with the SDK and assembly versions used by NuGetUpdater. |
| 219 | - dependency-name: "nuget/helpers/lib/NuGet.Client" |
| 220 | - package-ecosystem: "maven" |
| 221 | directory: "/maven/lib/dependabot/maven/" |
| 222 | schedule: |
| 223 | interval: "weekly" |
| 224 | day: "sunday" |
| 225 | time: "16:00" |
| 226 | - package-ecosystem: "docker" |
| 227 | directory: "/uv" |
| 228 | multi-ecosystem-group: "uv-ecosystem" |
| 229 | patterns: ["*"] |
| 230 | - package-ecosystem: "pip" |
| 231 | directory: "/uv/helpers" |
| 232 | multi-ecosystem-group: "uv-ecosystem" |
| 233 | patterns: ["*"] |
| 234 | ignore: |
| 235 | # Ignore major updates as most major updates will need manual intervention |
| 236 | - dependency-name: "*" |
| 237 | update-types: [ "version-update:semver-major" ] |