ee14a9fc1cThe npm-entry removal in `.github/dependabot.yml` is split out of this PR so that every change to that one file lands in a single reviewable piece — alongside the `github-actions` entry, which #2229 had declared out of scope but which opens the same issue-less, board-cardless PR the decision exists to remove. Reverts `.github/dependabot.yml` to its `v2/main` state, leaving this PR with the release-time `npm audit fix` and the monthly `npm outdated` sweep: the replacement flow, not the switch-off. Both new files' header comments claimed the switch-off had already happened, which is false until #2235 lands. They now say #2235 does it, and that until then Dependabot's npm PRs and this sweep overlap — duplicate signal rather than conflicting action. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RWMJENjs1mExXE5XPJTEei Signed-off-by: cliffhall <cliff@futurescale.com>
93 lines
2.5 KiB
YAML
93 lines
2.5 KiB
YAML
version: 2
|
|
|
|
# Version updates target `v2/main`, the develop branch where all v2 work lands,
|
|
# not the default branch — `main` is release-only, holding the latest released
|
|
# v2 and receiving milestone merges from `v2/main`. (The deprecated v1 line
|
|
# lives on `v1/main` and takes security fixes only.)
|
|
#
|
|
# Two things to know about this file:
|
|
# 1. Dependabot reads it from the DEFAULT branch (`main`). Changes here are
|
|
# inert until the next milestone merge carries them there.
|
|
# 2. `target-branch` scopes VERSION updates. Dependabot SECURITY updates are
|
|
# enabled in repo settings, not here, and are raised against the default
|
|
# branch — they kept working while this file was missing entirely
|
|
# (see #1833, #1840). Per GitHub's Dependabot options reference, an entry
|
|
# whose `target-branch` names a non-default branch is NOT applied to
|
|
# security updates, so the schedule/labels/groups below shape version
|
|
# updates only. Re-confirm security PRs still appear after this lands.
|
|
#
|
|
# v2 is not an npm workspace: the root and each client under `clients/*` carry
|
|
# their own package.json + lockfile, so each needs its own entry.
|
|
|
|
updates:
|
|
- package-ecosystem: "github-actions"
|
|
directory: "/"
|
|
target-branch: "v2/main"
|
|
schedule:
|
|
interval: "monthly"
|
|
labels:
|
|
- "v2"
|
|
groups:
|
|
github-actions:
|
|
patterns:
|
|
- "*"
|
|
|
|
- package-ecosystem: "npm"
|
|
directory: "/"
|
|
target-branch: "v2/main"
|
|
schedule:
|
|
interval: "monthly"
|
|
labels:
|
|
- "v2"
|
|
groups:
|
|
root-dependencies:
|
|
patterns:
|
|
- "*"
|
|
|
|
- package-ecosystem: "npm"
|
|
directory: "/clients/web"
|
|
target-branch: "v2/main"
|
|
schedule:
|
|
interval: "monthly"
|
|
labels:
|
|
- "v2"
|
|
groups:
|
|
web-dependencies:
|
|
patterns:
|
|
- "*"
|
|
|
|
- package-ecosystem: "npm"
|
|
directory: "/clients/cli"
|
|
target-branch: "v2/main"
|
|
schedule:
|
|
interval: "monthly"
|
|
labels:
|
|
- "v2"
|
|
groups:
|
|
cli-dependencies:
|
|
patterns:
|
|
- "*"
|
|
|
|
- package-ecosystem: "npm"
|
|
directory: "/clients/tui"
|
|
target-branch: "v2/main"
|
|
schedule:
|
|
interval: "monthly"
|
|
labels:
|
|
- "v2"
|
|
groups:
|
|
tui-dependencies:
|
|
patterns:
|
|
- "*"
|
|
|
|
- package-ecosystem: "npm"
|
|
directory: "/clients/launcher"
|
|
target-branch: "v2/main"
|
|
schedule:
|
|
interval: "monthly"
|
|
labels:
|
|
- "v2"
|
|
groups:
|
|
launcher-dependencies:
|
|
patterns:
|
|
- "*"
|