mirror of
https://github.com/gesellix/Bose-SoundTouch.git
synced 2026-08-18 16:46:17 +00:00
Tobias GesellchenandClaude Opus 4.8
00db897c24
github/codeql-action/init, /analyze and /upload-sarif are separate Dependabot dependencies but must run on the same version. Without a group they update in independent PRs that merge at different times, producing a version mismatch that fails CodeQL. Group them so all sub-actions bump together in one PR. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
193 lines
4.5 KiB
YAML
193 lines
4.5 KiB
YAML
# Dependabot configuration for Bose SoundTouch Go Library
|
|
# See: https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
|
|
|
|
version: 2
|
|
updates:
|
|
# Go modules dependency updates
|
|
- package-ecosystem: "gomod"
|
|
directory: "/"
|
|
schedule:
|
|
interval: "weekly"
|
|
day: "monday"
|
|
time: "09:00"
|
|
timezone: "UTC"
|
|
open-pull-requests-limit: 5
|
|
reviewers:
|
|
- "gesellix"
|
|
assignees:
|
|
- "gesellix"
|
|
commit-message:
|
|
prefix: "deps"
|
|
include: "scope"
|
|
labels:
|
|
- "dependencies"
|
|
- "go"
|
|
rebase-strategy: "auto"
|
|
allow:
|
|
# Allow all dependency types
|
|
- dependency-type: "all"
|
|
ignore:
|
|
# Ignore major version updates for stable dependencies (manual review preferred)
|
|
- dependency-name: "github.com/gorilla/websocket"
|
|
update-types: ["version-update:semver-major"]
|
|
- dependency-name: "github.com/hashicorp/mdns"
|
|
update-types: ["version-update:semver-major"]
|
|
groups:
|
|
# Group Go standard library and toolchain updates
|
|
golang:
|
|
patterns:
|
|
- "golang.org/*"
|
|
|
|
# Hugo module dependency updates (docs site)
|
|
- package-ecosystem: "gomod"
|
|
directory: "/docs"
|
|
schedule:
|
|
interval: "weekly"
|
|
day: "monday"
|
|
time: "09:00"
|
|
timezone: "UTC"
|
|
open-pull-requests-limit: 3
|
|
reviewers:
|
|
- "gesellix"
|
|
assignees:
|
|
- "gesellix"
|
|
commit-message:
|
|
prefix: "deps"
|
|
include: "scope"
|
|
labels:
|
|
- "dependencies"
|
|
- "go"
|
|
- "docs"
|
|
rebase-strategy: "auto"
|
|
|
|
# Example module dependency updates
|
|
- package-ecosystem: "gomod"
|
|
directory: "/examples/navigation-station-demo"
|
|
schedule:
|
|
interval: "weekly"
|
|
day: "monday"
|
|
time: "09:00"
|
|
timezone: "UTC"
|
|
open-pull-requests-limit: 3
|
|
reviewers:
|
|
- "gesellix"
|
|
assignees:
|
|
- "gesellix"
|
|
commit-message:
|
|
prefix: "deps"
|
|
include: "scope"
|
|
labels:
|
|
- "dependencies"
|
|
- "go"
|
|
rebase-strategy: "auto"
|
|
|
|
- package-ecosystem: "gomod"
|
|
directory: "/examples/preset-management"
|
|
schedule:
|
|
interval: "weekly"
|
|
day: "monday"
|
|
time: "09:00"
|
|
timezone: "UTC"
|
|
open-pull-requests-limit: 3
|
|
reviewers:
|
|
- "gesellix"
|
|
assignees:
|
|
- "gesellix"
|
|
commit-message:
|
|
prefix: "deps"
|
|
include: "scope"
|
|
labels:
|
|
- "dependencies"
|
|
- "go"
|
|
rebase-strategy: "auto"
|
|
|
|
# GitHub Actions workflow dependency updates
|
|
- package-ecosystem: "github-actions"
|
|
directory: "/"
|
|
schedule:
|
|
interval: "weekly"
|
|
day: "tuesday"
|
|
time: "09:00"
|
|
timezone: "UTC"
|
|
open-pull-requests-limit: 3
|
|
reviewers:
|
|
- "gesellix"
|
|
assignees:
|
|
- "gesellix"
|
|
commit-message:
|
|
prefix: "ci"
|
|
include: "scope"
|
|
labels:
|
|
- "dependencies"
|
|
- "github-actions"
|
|
- "ci"
|
|
rebase-strategy: "auto"
|
|
allow:
|
|
- dependency-type: "all"
|
|
groups:
|
|
# Group all codeql-action sub-actions (init/analyze/upload-sarif)
|
|
# so they bump together. They are separate dependencies to
|
|
# Dependabot but must stay on the same version, or CodeQL fails
|
|
# with "Loaded a configuration file for version X, but running Y".
|
|
codeql-action:
|
|
patterns:
|
|
- "github/codeql-action*"
|
|
# Group actions from the same organization
|
|
actions-core:
|
|
patterns:
|
|
- "actions/*"
|
|
# Group setup actions
|
|
setup-actions:
|
|
patterns:
|
|
- "*setup-*"
|
|
# Group security-related actions
|
|
security-actions:
|
|
patterns:
|
|
- "*security*"
|
|
- "*scan*"
|
|
- "securecodewarrior/*"
|
|
- "codecov/*"
|
|
|
|
# Docker dependency updates
|
|
- package-ecosystem: "docker"
|
|
directory: "/"
|
|
schedule:
|
|
interval: "weekly"
|
|
day: "wednesday"
|
|
time: "09:00"
|
|
timezone: "UTC"
|
|
open-pull-requests-limit: 3
|
|
reviewers:
|
|
- "gesellix"
|
|
assignees:
|
|
- "gesellix"
|
|
commit-message:
|
|
prefix: "docker"
|
|
include: "scope"
|
|
labels:
|
|
- "dependencies"
|
|
- "docker"
|
|
rebase-strategy: "auto"
|
|
|
|
# npm dependency updates
|
|
- package-ecosystem: "npm"
|
|
directory: "/"
|
|
schedule:
|
|
interval: "weekly"
|
|
day: "thursday"
|
|
time: "09:00"
|
|
timezone: "UTC"
|
|
open-pull-requests-limit: 3
|
|
reviewers:
|
|
- "gesellix"
|
|
assignees:
|
|
- "gesellix"
|
|
commit-message:
|
|
prefix: "deps"
|
|
include: "scope"
|
|
labels:
|
|
- "dependencies"
|
|
- "npm"
|
|
- "frontend"
|
|
rebase-strategy: "auto"
|