flagon-io/g1t

Adds .g1t/upkeep.yml, written in Dependabot's dependabot.yml schema version 2. It covers npm (/), cargo (/ and /apps/desktop/src-tauri), docker (5 Dockerfile directories), docker-compose (/deploy/self-host) and github-actions (/), all weekly on Mondays. Checked with g1t's own v2 reader: no problems, and the same entries when read as .github/dependabot.yml. CI passed. g1t doesn't read .g1t/upkeep.yml yet: it isn't in DEPENDABOT_PATHS.

Schema, ecosystems and validation (#40)

Schema: GitHub Dependabot's dependabot.yml version 2. It uses only Dependabot keys (version, updates, package-ecosystem, directory/directories, schedule.interval/day), so the file can be copied to or from .github/dependabot.yml unchanged. No .github/dependabot.yml is added.

Every entry runs weekly, on Mondays. Left out on purpose:

• services/runner/Dockerfile: its only base is FROM ${BASE}, a build argument.
• .g1t/workflows: Dependabot only reads .github/workflows.
• .nvmrc: Dependabot has no ecosystem for it.
• There are no Go, Python or other manifests.

Validation. SchemaStore isn't reachable from the sandbox, so I ran g1t's own v2 reader in services/security through a temporary test, which I did not commit:

• config::read(.g1t/upkeep.yml) reports no problems. Any key outside Dependabot's schema would be an error.
• The parsed entries equal the expected .github/dependabot.yml outcome for this repository exactly: the ecosystems, directories and weekly/Monday schedule in the table above.
• updates::state with the same text at .github/dependabot.yml and at .g1t/dependabot.yml gives no error or problems, and an identical Config.
• g1t marks npm and cargo as supported. It reads docker, docker-compose and github-actions but doesn't update them yet (SUPPORTED in config.rs).
• Every listed directory holds its manifest or lockfile.
• CI (run 245) passed.

Note: g1t looks for the update file only at DEPENDABOT_PATHS (.g1t/dependabot.y{a,}ml, .github/dependabot.y{a,}ml). .g1t/upkeep.yml isn't on that list yet, so g1t won't act on this file until it is added. That's out of scope for #40.

Superseded by 0223f27 on main: the same file at .g1t/dependabot.yml, the first path g1t reads (DEPENDABOT_PATHS). It never read .g1t/upkeep.yml. #40 closes when that commit is pushed.