Dmitry VerkhoturovandUmputun
5b37a583ce
Previously the npm entries carried only open-pull-requests-limit: 0, which bounds version updates and leaves security updates unlimited, so npm pull requests kept arriving from Dependabot alerts. The ignore option applies to both kinds, so a blanket ignore per npm entry is what actually stops them. Go modules and GitHub Actions updates are unchanged.
88 lines
2.6 KiB
YAML
88 lines
2.6 KiB
YAML
# To get started with Dependabot version updates, you'll need to specify which
|
|
# package ecosystems to update and where the package manifests are located.
|
|
# Please see the documentation for all configuration options:
|
|
# https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
|
|
|
|
version: 2
|
|
|
|
# npm updates are switched off entirely. open-pull-requests-limit bounds version
|
|
# updates only, so the ignore entries below are what also stops security updates;
|
|
# removing the npm entries would not work, as security updates come from alerts
|
|
# rather than from this file.
|
|
updates:
|
|
- package-ecosystem: "github-actions"
|
|
directory: "/"
|
|
schedule:
|
|
interval: "monthly"
|
|
groups:
|
|
"GitHub Actions updates":
|
|
patterns:
|
|
- "*"
|
|
- package-ecosystem: "gomod"
|
|
directory: "/backend"
|
|
schedule:
|
|
interval: "monthly"
|
|
groups:
|
|
"Go modules updates":
|
|
dependency-type: "production"
|
|
- package-ecosystem: "npm"
|
|
directory: "/frontend"
|
|
open-pull-requests-limit: 0
|
|
ignore:
|
|
- dependency-name: "*"
|
|
schedule:
|
|
interval: "monthly"
|
|
groups:
|
|
"NPM modules updates":
|
|
dependency-type: "production"
|
|
"NPM modules updates for tests":
|
|
dependency-type: "development"
|
|
- package-ecosystem: "npm"
|
|
directory: "/frontend/packages/api"
|
|
open-pull-requests-limit: 0
|
|
ignore:
|
|
- dependency-name: "*"
|
|
schedule:
|
|
interval: "monthly"
|
|
groups:
|
|
"NPM modules updates":
|
|
dependency-type: "production"
|
|
"NPM modules updates for tests":
|
|
dependency-type: "development"
|
|
- package-ecosystem: "npm"
|
|
directory: "/frontend/e2e"
|
|
open-pull-requests-limit: 0
|
|
ignore:
|
|
- dependency-name: "*"
|
|
schedule:
|
|
interval: "monthly"
|
|
groups:
|
|
"NPM modules updates":
|
|
dependency-type: "production"
|
|
"NPM modules updates for tests":
|
|
dependency-type: "development"
|
|
- package-ecosystem: "npm"
|
|
directory: "/frontend/apps/remark42"
|
|
open-pull-requests-limit: 0
|
|
ignore:
|
|
- dependency-name: "*"
|
|
schedule:
|
|
interval: "monthly"
|
|
groups:
|
|
"NPM modules updates":
|
|
dependency-type: "production"
|
|
"NPM modules updates for tests":
|
|
dependency-type: "development"
|
|
- package-ecosystem: "npm"
|
|
directory: "/site"
|
|
open-pull-requests-limit: 0
|
|
ignore:
|
|
- dependency-name: "*"
|
|
schedule:
|
|
interval: "monthly"
|
|
groups:
|
|
"NPM modules updates":
|
|
dependency-type: "production"
|
|
"NPM modules updates for tests":
|
|
dependency-type: "development"
|