FilesExpand file tree

main

/

dependabot.yml

Copy path

Blame

More file actions

Blame

More file actions

Latest commit

 

History

History

History

148 lines (140 loc) · 4.23 KB

main

/

dependabot.yml

Copy path

Top

File metadata and controls

• Code
• Blame

148 lines (140 loc) · 4.23 KB

Raw

Copy raw file

Download raw file

Open symbols panel

Edit and raw actions

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

76

77

78

79

80

81

82

83

84

85

86

87

88

89

90

91

92

93

94

95

96

97

98

99

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

# Dependabot configuration

# https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options

#

# Preconditions (now satisfied on uMailServer/uMailServer):

# - Branch protection on `main` requires Lint, Test, Build (strict=true, admins enforced).

# - Repo-level auto-merge is enabled (gh repo edit uMailServer/uMailServer --enable-auto-merge).

# Auto-merge is therefore safe to grant for non-major updates below.

version: 2

# Shared defaults — applied to every ecosystem below.

# `groups` collapses dozens of transitive bumps into one reviewable PR.

# `open-pull-requests-limit` is raised so security batches aren't silently dropped.

# `rebase-strategy: auto` keeps stacked PRs from going stale.

x-base: &base

open-pull-requests-limit: 20

rebase-strategy: auto

commit-message:

prefix: "chore(deps)"

include: "scope"

labels:

- "dependencies"

# Major-version bumps are NEVER auto-merged — they require manual review.

# We model that by adding `ignore.update-types: ["version-update:semver-major"]`

# at the ecosystem level on top of the YAML anchor.

x-ignore-majors: &ignore_majors

ignore:

dependency-name: "*"

update-types: ["version-update:semver-major"]

# Go modules — runtime is the production mail server; security bumps are P0.

updates:

- package-ecosystem: "gomod"

directory: "/"

schedule:

interval: "weekly"

day: "monday"

time: "06:00"

timezone: "UTC"

<<: [*base, *ignore_majors]

auto-merge: true

# Group non-major bumps; majors stay individual for review.

groups:

gomod-minor:

applies-to: version-updates

patterns: ["*"]

update-types: ["minor", "patch"]

gomod-security:

applies-to: security-updates

patterns: ["*"]

# npm — webmail (production frontend)

- package-ecosystem: "npm"

directory: "/webmail"

schedule:

interval: "weekly"

day: "monday"

time: "06:00"

timezone: "UTC"

<<: [*base, *ignore_majors]

auto-merge: true

groups:

npm-runtime:

applies-to: version-updates

patterns: ["*"]

update-types: ["minor", "patch"]

exclude-patterns: ["@types/*", "*-loader", "*-plugin"]

npm-types:

applies-to: version-updates

patterns: ["@types/*"]

update-types: ["minor", "patch"]

npm-security:

applies-to: security-updates

patterns: ["*"]

# npm — web/admin (admin SPA)

- package-ecosystem: "npm"

directory: "/web/admin"

schedule:

interval: "weekly"

day: "monday"

time: "06:00"

timezone: "UTC"

<<: [*base, *ignore_majors]

auto-merge: true

groups:

npm-runtime:

applies-to: version-updates

patterns: ["*"]

update-types: ["minor", "patch"]

exclude-patterns: ["@types/*", "*-loader", "*-plugin"]

npm-types:

applies-to: version-updates

patterns: ["@types/*"]

update-types: ["minor", "patch"]

npm-security:

applies-to: security-updates

patterns: ["*"]

# npm — web/account (account portal)

- package-ecosystem: "npm"

directory: "/web/account"

schedule:

interval: "weekly"

day: "monday"

time: "06:00"

timezone: "UTC"

<<: [*base, *ignore_majors]

auto-merge: true

groups:

npm-runtime:

applies-to: version-updates

patterns: ["*"]

update-types: ["minor", "patch"]

exclude-patterns: ["@types/*", "*-loader", "*-plugin"]

npm-types:

applies-to: version-updates

patterns: ["@types/*"]

update-types: ["minor", "patch"]

npm-security:

applies-to: security-updates

patterns: ["*"]

# Docker — top-level Dockerfile + docker-compose

- package-ecosystem: "docker"

directory: "/"

schedule:

interval: "weekly"

day: "monday"

time: "06:00"

timezone: "UTC"

<<: [*base, *ignore_majors]

auto-merge: true

# GitHub Actions

- package-ecosystem: "github-actions"

directory: "/"

schedule:

interval: "weekly"

day: "monday"

time: "06:00"

timezone: "UTC"

<<: [*base, *ignore_majors]

auto-merge: true

groups:

actions:

applies-to: version-updates

patterns: ["*"]