version: 2

# npm version updates are OFF (#2229): a Dependabot version-update PR carries no
# issue and no board card, which is the same "every PR references an issue"
# carve-out the security-update flow had. Routine npm bumps are handled instead
# by a monthly `npm outdated` sweep (`.github/workflows/dependency-refresh.yml`)
# that files ONE tracking issue per run, boarded and milestoned like any other
# work — so a maintainer picks the bump and opens a normal PR against `v2/main`.
#
# Security updates are unaffected by this file either way: they are enabled in
# repo settings, not here. #2229 additionally proposes consuming them as
# Dependabot ALERTS rather than PRs (tracked, not yet built) — until that lands,
# security-update PRs still open against `main` and still need retargeting by
# hand, same as before.
#
# github-actions version updates stay on Dependabot's own PR flow below — out of
# scope for #2229, which was about npm packages specifically.
#
# Two things to know about this file:
#   1. Dependabot reads it from the DEFAULT branch (`main`). Changes here are
#      inert until the next milestone merge carries them there.
#   2. `target-branch` scopes VERSION updates only (npm updates are removed
#      here, so this now only applies to the github-actions entry below).

updates:
  - package-ecosystem: "github-actions"
    directory: "/"
    target-branch: "v2/main"
    schedule:
      interval: "monthly"
    labels:
      - "v2"
    groups:
      github-actions:
        patterns:
          - "*"