scorecard/.github/dependabot.yml
Spencer Schrock 4895019884
fix dependabot config to group docker images (#4211)
This is apparently required with the current implementation of multi dir PRs.

Signed-off-by: Spencer Schrock <sschrock@google.com>
2024-07-03 16:47:20 -04:00

53 lines
1.3 KiB
YAML

version: 2
updates:
- package-ecosystem: gomod
directories:
- "/"
- "/tools"
schedule:
interval: daily
rebase-strategy: disabled
commit-message:
prefix: ":seedling:"
open-pull-requests-limit: 3
- package-ecosystem: "github-actions"
directory: "/"
schedule:
interval: "weekly"
rebase-strategy: disabled
commit-message:
prefix: ":seedling:"
groups:
github-actions:
patterns:
- "*"
# These actions directly influence the build process and are excluded from grouped updates
exclude-patterns:
- "actions/setup-go"
- "arduino/setup-protoc"
- "goreleaser/goreleaser-action"
- package-ecosystem: docker
directories:
- "/"
- "/cron/internal/bq"
- "/cron/internal/worker"
- "/cron/internal/webhook"
- "/cron/internal/controller"
- "/cron/internal/cii"
- "/clients/githubrepo/roundtripper/tokens/server"
- "/attestor"
schedule:
interval: weekly
rebase-strategy: disabled
commit-message:
prefix: ":seedling:"
# currently needed to get PRs which actually update multiple directories in a single PR
# https://github.com/dependabot/dependabot-core/issues/2178#issuecomment-2109164992
groups:
golang:
patterns:
- "golang"
distroless:
patterns:
- "distroless/base"