From c8bccfc7029dbe9035b06eb23aed6f8284bc5cbf Mon Sep 17 00:00:00 2001 From: 3metaJun <251347867+3metaJun@users.noreply.github.com> Date: Mon, 12 Oct 2026 15:58:31 +0800 Subject: [PATCH] chore(deps): add Dependabot version updates Workflow actions are pinned by commit SHA, which is safe but never moves on its own, and `tools/meta-mode` has a `bun.lock` nobody is watching. This repo is public, so stale pins are visible. `.github/dependabot.yml` tracks github-actions (rewrites the SHA and the `# vN` comment together) and the bun project in `tools/meta-mode`, both monthly. Minor/patch bumps are grouped into one PR per cycle, and `cooldown: 7 days` keeps brand-new releases out as a supply-chain guard (security updates ignore it). Co-Authored-By: Claude Sonnet 5.5 --- .github/dependabot.yml | 32 ++++++++++++++++++++++++++++++++ 1 file changed, 32 insertions(+) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..6de931c --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,32 @@ +# Workflow actions are pinned by commit SHA with a `# vN` comment; Dependabot +# rewrites both. `cooldown` skips releases younger than 7 days as a supply-chain +# guard (security updates ignore it). +version: 2 +updates: + - package-ecosystem: github-actions + directory: / + schedule: + interval: monthly + timezone: Asia/Shanghai + cooldown: + default-days: 7 + commit-message: + prefix: chore + include: scope + groups: + github-actions: + patterns: ['*'] + + - package-ecosystem: bun + directory: /tools/meta-mode + schedule: + interval: monthly + timezone: Asia/Shanghai + cooldown: + default-days: 7 + commit-message: + prefix: chore + include: scope + groups: + bun-minor-and-patch: + update-types: [minor, patch]