dotnet-template/.github/dependabot.yml at develop · mxwlf/dotnet-template · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
# ---------------------------------------------------------------------------
# Dependabot — automated dependency-update PRs
# ---------------------------------------------------------------------------
# Two ecosystems are watched:
#
#   github-actions  Keeps the SHA-pinned actions in .github/workflows/*.yml
#                   current. The workflow pins each action to a full commit SHA
#                   (tags are mutable) — without this, those pins silently go
#                   stale and miss upstream security patches. Dependabot bumps
#                   the SHA and the trailing version comment together.
#
#   nuget           Opens PRs for NuGet updates. Because the repo uses lock files
#                   (RestorePackagesWithLockFile in Directory.Build.props),
#                   Dependabot also regenerates the affected packages.lock.json,
#                   so the PR stays green under the `--locked-mode` CI gate.
#
# Adjust the schedule, open-PR limits, and reviewers/labels to suit your project.
version: 2
updates:
  - package-ecosystem: github-actions
    directory: "/"
    schedule:
      interval: weekly
    commit-message:
      prefix: ci
    open-pull-requests-limit: 5

  - package-ecosystem: nuget
    directory: "/"
    schedule:
      interval: weekly
    commit-message:
      prefix: build
    open-pull-requests-limit: 10