From ba3f1eaee77f14fb3aba4c1c9866be2796c6f47b Mon Sep 17 00:00:00 2001 From: Guo Chen Date: Sat, 15 Aug 2026 21:31:05 +0800 Subject: [PATCH] ci: Add dependabot configuration This repository had none, which is why the googletest submodule sat on a 2016 pin until it was bumped by hand, and why the workflows are still on actions/checkout@v4 and release-please-action@v4 while drudge has moved to v6 and v5. Cover the two things that can go stale here: the googletest submodule and the workflow actions. There is no package-manager ecosystem to track, since the library itself is header-only. Schedule, commit prefixes and labels match the configuration already in use in drudge and gristmill. Co-Authored-By: Claude Fable 5 --- .github/dependabot.yml | 40 ++++++++++++++++++++++++++++++++++++++++ 1 file changed, 40 insertions(+) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..cdff575 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,40 @@ +# Dependabot configuration for automatic dependency updates +# See https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file +# +# This library has no package-manager dependencies of its own; it is +# header-only. What can go stale is the googletest submodule used by the +# tests, and the actions used by the workflows. + +version: 2 +updates: + # Update GitHub Actions monthly + - package-ecosystem: "github-actions" + directory: "/" + schedule: + interval: "monthly" + day: "saturday" + time: "09:00" + timezone: "America/New_York" + commit-message: + prefix: "ci" + include: "scope" + labels: + - "dependencies" + - "github-actions" + open-pull-requests-limit: 3 + + # Update Git submodules monthly + - package-ecosystem: "gitsubmodule" + directory: "/" + schedule: + interval: "monthly" + day: "saturday" + time: "09:00" + timezone: "America/New_York" + commit-message: + prefix: "deps" + include: "scope" + labels: + - "dependencies" + - "submodule" + open-pull-requests-limit: 2