From 49a0d2fe6de4dac90de52ae0356d4e3dc687a7fc Mon Sep 17 00:00:00 2001 From: Kevin Veen-Birkenbach Date: Wed, 23 Sep 2026 00:38:03 +0200 Subject: [PATCH] ci: let Dependabot watch the dependencies The SHA-pinned actions, the two base images, the compose file, the Python project and the npm assets had no update stream, so a pinned reference only moved when someone noticed it by hand. Adds a daily Dependabot config for all five. Co-Authored-By: Claude Opus 5 (1M context) --- .github/dependabot.yml | 47 ++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 47 insertions(+) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..bbdecf0 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,47 @@ +version: 2 + +updates: + - package-ecosystem: "github-actions" + directory: "/" + schedule: + interval: "daily" + time: "00:00" + labels: + - "dependencies" + - "ci" + + - package-ecosystem: "docker" + directory: "/" + schedule: + interval: "daily" + time: "00:00" + labels: + - "dependencies" + - "docker" + + - package-ecosystem: "docker-compose" + directory: "/" + schedule: + interval: "daily" + time: "00:00" + labels: + - "dependencies" + - "docker" + + - package-ecosystem: "pip" + directory: "/" + schedule: + interval: "daily" + time: "00:00" + labels: + - "dependencies" + - "python" + + - package-ecosystem: "npm" + directory: "/app" + schedule: + interval: "daily" + time: "00:00" + labels: + - "dependencies" + - "javascript"