Ornn/.github/dependabot.yml at develop · ChronoAIProject/Ornn · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
# Dependabot keeps our supply chain current. Three groupings to minimise
# PR churn: minor/patch bundled per-ecosystem, security-only PRs come through
# uncapped (one per CVE), majors stay un-grouped so they're easy to triage.
#
# See SECURITY.md for the public vuln disclosure path; CI's `audit` job
# (CI workflow → audit) is the runtime gate that blocks high/critical
# regressions from landing.

version: 2
updates:
  # ---- Bun workspace (root + ornn-api + ornn-web) -------------------------
  # Dependabot walks the workspace from /, so a single entry covers every
  # package.json in the tree.
  - package-ecosystem: bun
    directory: /
    schedule:
      interval: weekly
      day: monday
      time: "08:00"
      timezone: Asia/Shanghai
    open-pull-requests-limit: 10
    labels: ["dependencies", "infra"]
    groups:
      bun-minor-and-patch:
        applies-to: version-updates
        update-types: ["minor", "patch"]
    commit-message:
      prefix: "chore(deps)"
      include: scope

  # ---- Python SDK ---------------------------------------------------------
  - package-ecosystem: pip
    directory: /sdk/python
    schedule:
      interval: weekly
      day: monday
      time: "08:00"
      timezone: Asia/Shanghai
    open-pull-requests-limit: 5
    labels: ["dependencies", "infra"]
    groups:
      pip-minor-and-patch:
        applies-to: version-updates
        update-types: ["minor", "patch"]
    commit-message:
      prefix: "chore(deps)"
      include: scope

  # ---- GitHub Actions -----------------------------------------------------
  - package-ecosystem: github-actions
    directory: /
    schedule:
      interval: weekly
      day: monday
      time: "08:00"
      timezone: Asia/Shanghai
    open-pull-requests-limit: 5
    labels: ["dependencies", "infra"]
    groups:
      actions-all:
        applies-to: version-updates
        patterns: ["*"]
    commit-message:
      prefix: "chore(ci)"
      include: scope

  # ---- Docker base images -------------------------------------------------
  - package-ecosystem: docker
    directory: /ornn-api
    schedule:
      interval: weekly
      day: monday
      time: "08:00"
      timezone: Asia/Shanghai
    open-pull-requests-limit: 3
    labels: ["dependencies", "infra"]
    commit-message:
      prefix: "chore(docker)"
      include: scope

  - package-ecosystem: docker
    directory: /ornn-web
    schedule:
      interval: weekly
      day: monday
      time: "08:00"
      timezone: Asia/Shanghai
    open-pull-requests-limit: 3
    labels: ["dependencies", "infra"]
    commit-message:
      prefix: "chore(docker)"
      include: scope