# See https://docs.github.com/en/github/administering-a-repository/enabling-and-disabling-version-updates

version: 2
updates:

  - package-ecosystem: "gomod"
    open-pull-requests-limit: 2
    directory: "/hack/update-go-mod"
    schedule:
      interval: "daily"

  # Use dependabot to automate major-only dependency bumps
  - package-ecosystem: "gomod"
    open-pull-requests-limit: 2 # Not sure why there would ever be more than 1, just would not want to hide anything
    directory: "/"
    schedule:
      interval: "daily"
    # group all major dependency bumps together so there's only one pull request
    groups:
      go-modules:
        patterns:
        - "*"
        update-types:
        - "major"
    ignore:
    # For all packages, ignore all minor and patch updates
    - dependency-name: "*"
      update-types:
      - "version-update:semver-minor"
      - "version-update:semver-patch"

# Our own CI job is responsible for updating this Docker file now.
#  - package-ecosystem: "docker"
#    directory: "/"
#    schedule:
#      interval: "daily"

# Our own CI job is responsible for updating this Docker file now.
#  - package-ecosystem: "docker"
#    directory: "/hack"  # this should keep the FIPS dockerfile updated per https://github.com/dependabot/feedback/issues/145#issuecomment-414738498
#    schedule:
#      interval: "daily"