From 385632d22c5f0dfd8e8a7f1d1f4e28b66a14617b Mon Sep 17 00:00:00 2001
From: Vishal Rana <v@labstack.com>
Date: Mon, 24 Aug 2026 11:19:02 -0700
Subject: [PATCH] ci(deps): let Dependabot propose dependency and action
 updates
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The workflow actions are pinned to commit SHAs rather than tags, which is
what makes this worth configuring: a pinned SHA never moves on its own, so
without something proposing new ones the pins quietly rot, and resolving
them by hand is exactly the motion the pinning exists to prevent. Dependabot
resolves each new SHA, names the release it belongs to, and opens one
reviewable pull request.

Five graphs are covered: the actions, the Go modules, the two browser
workspaces (separate on purpose, each with its own overrides block pinning
security fixes) and the npm-based documentation site. Minor and patch
updates are grouped per ecosystem so a week of drift arrives as one pull
request; majors are left ungrouped so they arrive alone, since those are the
ones that need someone to read the migration notes.

Note that Bun is a version-updates-only ecosystem for Dependabot — it does
not receive security updates, so `bun audit` in `just check` stays the gate
for those.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 .github/dependabot.yml | 68 ++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 68 insertions(+)
 create mode 100644 .github/dependabot.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 00000000..fa529d21
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,68 @@
+# Dependency updates.
+#
+# The actions are pinned to commit SHAs rather than tags, which is what makes
+# this file worth having: a pinned SHA never moves on its own, so without
+# something proposing new ones the pins quietly rot. Dependabot resolves each
+# new SHA and says which release it belongs to, one reviewable pull request at
+# a time — the thing a human should never do by hand.
+#
+# Everything is grouped by ecosystem so a week of patch drift arrives as one
+# pull request instead of a dozen. Major versions are deliberately left out of
+# the groups: they arrive on their own, because they are the ones that need a
+# person to read the migration notes.
+version: 2
+
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    commit-message:
+      prefix: "ci(deps)"
+    groups:
+      actions:
+        update-types: [minor, patch]
+
+  - package-ecosystem: gomod
+    directory: /
+    schedule:
+      interval: weekly
+    commit-message:
+      prefix: "chore(deps)"
+    groups:
+      go:
+        update-types: [minor, patch]
+
+  # The two browser workspaces are separate dependency graphs on purpose, and
+  # each carries its own `overrides` block pinning security fixes, so they are
+  # listed separately rather than as one glob.
+  - package-ecosystem: bun
+    directory: /ui/host
+    schedule:
+      interval: weekly
+    commit-message:
+      prefix: "chore(deps)"
+    groups:
+      host:
+        update-types: [minor, patch]
+
+  - package-ecosystem: bun
+    directory: /ui/apps
+    schedule:
+      interval: weekly
+    commit-message:
+      prefix: "chore(deps)"
+    groups:
+      apps:
+        update-types: [minor, patch]
+
+  # The documentation site is npm, not bun.
+  - package-ecosystem: npm
+    directory: /site
+    schedule:
+      interval: weekly
+    commit-message:
+      prefix: "chore(deps)"
+    groups:
+      site:
+        update-types: [minor, patch]