From 14a2feaccff0e475f0aa154cfa96f715b626389b Mon Sep 17 00:00:00 2001 From: Sil Date: Sat, 3 Oct 2026 01:17:58 +0200 Subject: [PATCH] Add Dependabot for GitHub Actions and grouped security updates Dependabot bumps the SHA-pinned actions weekly in one grouped PR, and security updates arrive as one grouped PR. Version update PRs for npm stay off (open-pull-requests-limit: 0). Co-Authored-By: Claude Opus 5.5 (1M context) --- .github/dependabot.yml | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..1e64af3 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,24 @@ +version: 2 +updates: + # Keeps the SHA-pinned actions and their version comments current, + # in one grouped PR per week. + - package-ecosystem: github-actions + directory: / + schedule: + interval: weekly + groups: + github-actions: + patterns: + - "*" + # Security updates only. Version update PRs are off (limit 0), and all + # security fixes for this repository land in one grouped PR. + - package-ecosystem: npm + directory: / + schedule: + interval: weekly + open-pull-requests-limit: 0 + groups: + security: + applies-to: security-updates + patterns: + - "*"