mirror of
https://github.com/pewdiepie-archdaemon/odysseus.git
synced 2026-09-16 13:12:20 +02:00
49 lines
1.4 KiB
YAML
49 lines
1.4 KiB
YAML
# Dependabot keeps dependencies and pinned action versions current.
|
|
#
|
|
# Why this matters for security: every workflow in this repo pins its GitHub
|
|
# Actions to an exact commit (a SHA), which is safe but freezes them in time.
|
|
# Dependabot opens a small, reviewable pull request whenever a newer version
|
|
# exists -- for Python packages, npm packages, the Docker base image, and the
|
|
# pinned Actions themselves -- so staying patched does not require manual work.
|
|
# Updates are grouped so a week's bumps arrive as one PR per ecosystem, not a
|
|
# flood of separate ones.
|
|
|
|
version: 2
|
|
updates:
|
|
# Python dependencies (requirements.txt + requirements-optional.txt).
|
|
- package-ecosystem: pip
|
|
directory: "/"
|
|
schedule:
|
|
interval: weekly
|
|
open-pull-requests-limit: 5
|
|
groups:
|
|
python:
|
|
patterns: ["*"]
|
|
|
|
# Frontend / tooling npm packages (package.json).
|
|
- package-ecosystem: npm
|
|
directory: "/"
|
|
schedule:
|
|
interval: weekly
|
|
open-pull-requests-limit: 5
|
|
groups:
|
|
npm:
|
|
patterns: ["*"]
|
|
|
|
# The pinned action SHAs used across .github/workflows.
|
|
- package-ecosystem: github-actions
|
|
directory: "/"
|
|
schedule:
|
|
interval: weekly
|
|
open-pull-requests-limit: 5
|
|
groups:
|
|
actions:
|
|
patterns: ["*"]
|
|
|
|
# The Docker base image in the Dockerfile.
|
|
- package-ecosystem: docker
|
|
directory: "/"
|
|
schedule:
|
|
interval: weekly
|
|
open-pull-requests-limit: 5
|