83 lines
2.3 KiB
YAML
83 lines
2.3 KiB
YAML
# 仓库已对所有 action 强制 SHA pin，上游补丁不会自动到达；由 Dependabot 提 PR
|
||
# 更新 SHA 并同步刷新其后的版本注释，保持"可审计"与"能更新"同时成立。
|
||
#
|
||
# 不要声明 target-branch。Dependabot 默认就针对默认分支（当前为 main），而一旦声明
|
||
# target-branch，本文件对该 ecosystem 的配置就不再作用于 security update，
|
||
# groups、labels 与 commit-message 会对安全更新 PR 全部失效。
|
||
# https://docs.github.com/en/code-security/reference/supply-chain-security/dependabot-options-reference
|
||
version: 2
|
||
|
||
updates:
|
||
- package-ecosystem: github-actions
|
||
directory: /
|
||
schedule:
|
||
interval: weekly
|
||
open-pull-requests-limit: 5
|
||
commit-message:
|
||
prefix: chore(ci)
|
||
labels:
|
||
- dependencies
|
||
groups:
|
||
# 与下面两组保持一致：major 单独成 PR，便于评估破坏性变更。
|
||
github-actions-minor-and-patch:
|
||
patterns:
|
||
- "*"
|
||
update-types:
|
||
- minor
|
||
- patch
|
||
|
||
- package-ecosystem: gomod
|
||
directory: /
|
||
schedule:
|
||
interval: weekly
|
||
open-pull-requests-limit: 5
|
||
commit-message:
|
||
prefix: chore(deps)
|
||
labels:
|
||
- dependencies
|
||
groups:
|
||
# major 升级单独成 PR，便于评估破坏性变更。
|
||
go-minor-and-patch:
|
||
patterns:
|
||
- "*"
|
||
update-types:
|
||
- minor
|
||
- patch
|
||
|
||
# third_party/cpaembedded 是独立 module，Dependabot 不会从根目录递归发现，
|
||
# 需显式声明；它经 replace 编译进主二进制，其依赖属于实际攻击面。
|
||
- package-ecosystem: gomod
|
||
directory: /third_party/cpaembedded
|
||
schedule:
|
||
interval: weekly
|
||
open-pull-requests-limit: 5
|
||
commit-message:
|
||
prefix: chore(deps)
|
||
labels:
|
||
- dependencies
|
||
groups:
|
||
cpaembedded-minor-and-patch:
|
||
patterns:
|
||
- "*"
|
||
update-types:
|
||
- minor
|
||
- patch
|
||
|
||
- package-ecosystem: npm
|
||
directory: /web
|
||
schedule:
|
||
interval: weekly
|
||
open-pull-requests-limit: 5
|
||
commit-message:
|
||
prefix: chore(web)
|
||
labels:
|
||
- dependencies
|
||
- javascript
|
||
groups:
|
||
web-minor-and-patch:
|
||
patterns:
|
||
- "*"
|
||
update-types:
|
||
- minor
|
||
- patch
|