version: 2

# cooldown: wait 7 days after a release before opening version-update PRs, so a

# compromised or broken fresh release has time to be pulled first. Version

# updates only — security updates ignore cooldown, which is what keeps this from

# being a week of sitting on a known CVE.

#

# Seven rather than the three it was, and the same number my other repos use: a

# supply-chain compromise is usually caught in days, not hours, so three was

# short enough to open the PR while the bad version was still up.

#

# groups: one PR per block per week instead of one per dependency. The cost is

# that a single bad bump blocks the whole batch — split the group by

# dependency-type when that starts happening, majors alone are the usual culprit.

# Version updates only; security updates open their own PR regardless.

#

# commit-message.prefix: without it dependabot guesses the prefix from recent

# history, which is how `build(deps-dev):` got into the log. The convention here

# is `deps:`, and it has to be repeated per block — there is no global default.

updates:

## ci

- package-ecosystem: github-actions

directory: /

schedule:

interval: weekly

open-pull-requests-limit: 5

groups:

all:

patterns:

- "*"

cooldown:

default-days: 7

commit-message:

prefix: deps

## dashboard

- package-ecosystem: npm

directory: /dashboard

schedule:

interval: weekly

open-pull-requests-limit: 10

groups:

all:

patterns:

- "*"

cooldown:

default-days: 7

commit-message:

prefix: deps

- package-ecosystem: docker

directory: /dashboard/docker

schedule:

interval: weekly

open-pull-requests-limit: 5

groups:

all:

patterns:

- "*"

cooldown:

default-days: 7

commit-message:

prefix: deps

## ip service

- package-ecosystem: npm

directory: /ip-service

schedule:

interval: weekly

open-pull-requests-limit: 10

groups:

all:

patterns:

- "*"

cooldown:

default-days: 7

commit-message:

prefix: deps

- package-ecosystem: docker

directory: /ip-service/docker

schedule:

interval: weekly

open-pull-requests-limit: 5

groups:

all:

patterns:

- "*"

cooldown:

default-days: 7

commit-message:

prefix: deps

## compose services

# Every image here is pinned to an exact version rather than a floating major

# (`:16`, `:13`, `:18`). Dependabot diffs the tag string, so a floating tag is

# invisible to it — `:16` stayed `:16` across 16.0.3 -> 16.0.5 and no PR ever

# opened. Pinning is what makes these entries do anything at all.

#

# Not listed: whisper and github-runner build their own image (`build: .`), so

# their tag is an output name, not an upstream dependency. dashboard and

# ip-service are our own GHCR builds, already covered by their npm/docker entries.

- package-ecosystem: docker-compose

directory: /forgejo

schedule:

interval: weekly

open-pull-requests-limit: 5

groups:

all:

patterns:

- "*"

cooldown:

default-days: 7

commit-message:

prefix: deps

- package-ecosystem: docker-compose

directory: /readeck

schedule:

interval: weekly

open-pull-requests-limit: 5

groups:

all:

patterns:

- "*"

cooldown:

default-days: 7

commit-message:

prefix: deps

- package-ecosystem: docker-compose

directory: /database

schedule:

interval: weekly

open-pull-requests-limit: 5

groups:

all:

patterns:

- "*"

cooldown:

default-days: 7

commit-message:

prefix: deps

- package-ecosystem: docker-compose

directory: /gotenberg

schedule:

interval: weekly

open-pull-requests-limit: 5

groups:

all:

patterns:

- "*"

cooldown:

default-days: 7

commit-message:

prefix: deps

- package-ecosystem: docker-compose

directory: /forgejo-runner

schedule:

interval: weekly

open-pull-requests-limit: 5

groups:

all:

patterns:

- "*"

cooldown:

default-days: 7

commit-message:

prefix: deps

- package-ecosystem: docker-compose

directory: /archivebox

schedule:

interval: weekly

open-pull-requests-limit: 5

groups:

all:

patterns:

- "*"

cooldown:

default-days: 7

commit-message:

prefix: deps

- package-ecosystem: docker-compose

directory: /mealie

schedule:

interval: weekly

open-pull-requests-limit: 5

groups:

all:

patterns:

- "*"

cooldown:

default-days: 7

commit-message:

prefix: deps

- package-ecosystem: docker-compose

directory: /yt-archive

schedule:

interval: weekly

open-pull-requests-limit: 5

groups:

all:

patterns:

- "*"

cooldown:

default-days: 7

commit-message:

prefix: deps

## dockerfile services

- package-ecosystem: docker

directory: /github-runner

schedule:

interval: weekly

open-pull-requests-limit: 5

groups:

all:

patterns:

- "*"

cooldown:

default-days: 7

commit-message:

prefix: deps

## pollos microsite

# Two npm roots: the Astro site and the worker in front of it. Separate

# package.json files, so separate entries — dependabot resolves one manifest

# per directory and does not walk down.

- package-ecosystem: npm

directory: /pollos/microsite

schedule:

interval: weekly

open-pull-requests-limit: 10

groups:

all:

patterns:

- "*"

cooldown:

default-days: 7

commit-message:

prefix: deps

- package-ecosystem: npm

directory: /pollos/microsite-ws

schedule:

interval: weekly

open-pull-requests-limit: 10

groups:

all:

patterns:

- "*"

cooldown:

default-days: 7

commit-message:

prefix: deps

## terraform

# One entry per root module, because that is the unit dependabot resolves: it

# reads the required_providers of the directory it is pointed at and nothing

# below it. Both pin with `~>`, so a PR shows up when the constraint stops

# covering the newest release — cloudflare 5.x here, 6.0 when it lands.

#

# Providers only. `required_version = ">= 1.15"`, the terraform binary itself,

# is not something this ecosystem touches; that stays a hand edit.

- package-ecosystem: terraform

directory: /insuit/infra

schedule:

interval: weekly

open-pull-requests-limit: 5

groups:

all:

patterns:

- "*"

cooldown:

default-days: 7

commit-message:

prefix: deps

- package-ecosystem: terraform

directory: /pollos/infra

schedule:

interval: weekly

open-pull-requests-limit: 5

groups:

all:

patterns:

- "*"

cooldown:

default-days: 7

commit-message:

prefix: deps