From 273f157a61d3dfad4815e6b312bdf2069c6e4d5c Mon Sep 17 00:00:00 2001 From: niranjankagri Date: Mon, 26 Oct 2026 10:38:44 +0530 Subject: [PATCH] Dependabot: monthly version updates Dependabot version updates once a month: minor and patch updates grouped into one pull request per ecosystem, major versions as separate pull requests to review. README says so. The existing CI schedule is unchanged. Co-Authored-By: Claude Opus 5.5 --- .github/dependabot.yml | 20 ++++++++++++++++++++ README.md | 2 ++ 2 files changed, 22 insertions(+) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..c96ad17 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,20 @@ +# Keeps dependencies and CI actions current (security alerts are on separately). Once a month, +# minor and patch updates are grouped into one pull request per ecosystem and folder; a major +# version comes as its own pull request and is reviewed before merging. CI checks every update. +version: 2 +updates: + - package-ecosystem: pip + directory: "/" + schedule: + interval: monthly + groups: + pip-minor-patch: + update-types: [minor, patch] + + - package-ecosystem: github-actions + directory: "/" + schedule: + interval: monthly + groups: + github-actions-minor-patch: + update-types: [minor, patch] diff --git a/README.md b/README.md index 100e1c1..96b5140 100644 --- a/README.md +++ b/README.md @@ -211,6 +211,8 @@ traces as an artifact. A manual run (Run workflow) can choose the `demo` markers CI. [Automation Coverage & Quality Intelligence](https://github.com/niranjankagri/automation-coverage-quality-intelligence) reads the `junit.xml` in these artifacts for its cross-repository dashboard. +Dependabot proposes dependency and GitHub Actions updates once a month (minor and patch updates grouped, major versions as separate pull requests). + `main` is protected by a ruleset: every change goes through a pull request, and the CI jobs above must pass before it is merged. ## Code quality