OwnCord/.github/dependabot.yml

version: 2

# Every ecosystem groups its updates into a single PR. Splitting per package
# means each ecosystem's lockfile (go.sum, package-lock.json, Cargo.lock) is
# rewritten once per PR, so merging any one of them invalidates all the rest —
# every sibling then rebases and re-runs the full ~15 minute CI matrix. The
# 2026-08-10 batch opened 17 PRs for one weekly refresh.
#
# Grouping also keeps release trains together. The OpenTelemetry modules move
# in lockstep, and npm families version-lock their own packages with exact peer
# pins (typescript-checker@9.6.0 requires core@9.6.0, not ^9.6.0), so a partial
# merge is an ERESOLVE failure waiting to happen.
#
# Majors are ignored everywhere below, so each group only ever carries patch and
# minor updates. If one member of a group is bad, add it to that ecosystem's
# ignore list rather than ungrouping the rest.
#
# Each package root gets its own block rather than one block with `directories:`.
# Grouping only works because a group rewrites exactly one lockfile; a block
# spanning roots would put several lockfiles in one PR and reintroduce the very
# conflict the grouping prevents. The three npm roots stay separate for the same
# reason — see docs/contributing.md#dependency-policy for the measured decision
# against adopting npm workspaces.

# Every block targets `dev`, not the default branch. `dev` is the integration
# branch and the only branch that takes PRs; `main` carries releases. Without
# this, Dependabot opens against `main`, and retargeting by hand does not stick
# — `@dependabot rebase` recreates the PR against the configured target.

updates:
  # Go server dependencies
  - package-ecosystem: gomod
    directory: /Server
    target-branch: dev
    schedule:
      interval: weekly
      day: monday
    commit-message:
      prefix: "chore(deps):"
    labels:
      - dependencies
      - go
    open-pull-requests-limit: 10
    groups:
      go-dependencies:
        patterns:
          - "*"
    ignore:
      - dependency-name: "*"
        update-types: ["version-update:semver-major"]

  # Server container base images (Server/Dockerfile). The builder's
  # `golang:1.26-bookworm` tracks the toolchain in Server/go.mod and every
  # `actions/setup-go` in CI, so a minor bump here is a signal to move all three
  # together — not a standalone merge.
  - package-ecosystem: docker
    directory: /Server
    target-branch: dev
    schedule:
      interval: weekly
      day: monday
    commit-message:
      prefix: "chore(deps):"
    labels:
      - dependencies
      - docker
    open-pull-requests-limit: 5
    groups:
      docker-dependencies:
        patterns:
          - "*"
    ignore:
      - dependency-name: "*"
        update-types: ["version-update:semver-major"]

  # Tauri client npm dependencies
  - package-ecosystem: npm
    directory: /Client
    target-branch: dev
    schedule:
      interval: weekly
      day: monday
    commit-message:
      prefix: "chore(deps):"
    labels:
      - dependencies
      - npm
    open-pull-requests-limit: 10
    groups:
      npm-dependencies:
        patterns:
          - "*"
    ignore:
      - dependency-name: "*"
        update-types: ["version-update:semver-major"]

  # Root tooling npm dependencies (changelogen, prettier)
  - package-ecosystem: npm
    directory: /
    target-branch: dev
    schedule:
      interval: weekly
      day: monday
    commit-message:
      prefix: "chore(deps):"
    labels:
      - dependencies
      - npm
    open-pull-requests-limit: 5
    groups:
      root-npm-dependencies:
        patterns:
          - "*"
    ignore:
      - dependency-name: "*"
        update-types: ["version-update:semver-major"]

  # tools/mcp-introspect npm dependencies (local dev MCP server)
  - package-ecosystem: npm
    directory: /tools/mcp-introspect
    target-branch: dev
    schedule:
      interval: weekly
      day: monday
    commit-message:
      prefix: "chore(deps):"
    labels:
      - dependencies
      - npm
    open-pull-requests-limit: 5
    groups:
      mcp-introspect-dependencies:
        patterns:
          - "*"
    ignore:
      - dependency-name: "*"
        update-types: ["version-update:semver-major"]

  # Tauri Rust/Cargo dependencies
  - package-ecosystem: cargo
    directory: /Client/src-tauri
    target-branch: dev
    schedule:
      interval: weekly
      day: monday
    commit-message:
      prefix: "chore(deps):"
    labels:
      - dependencies
      - rust
    open-pull-requests-limit: 5
    groups:
      cargo-dependencies:
        patterns:
          - "*"
    ignore:
      - dependency-name: "*"
        update-types: ["version-update:semver-major"]
      # rfd rides into the tree on tauri-plugin-dialog, which pins ^0.16, and we
      # declare it directly only for the fatal-startup dialog in lib.rs (there is
      # no AppHandle yet, so the plugin API is unusable at that point). Cargo
      # unifies features only within a semver-compatible group, so bumping our
      # direct dep to 0.17 forks rfd in two: the plugin keeps 0.16 with its
      # backend features, ours gets 0.17 with none, and rfd 0.17's build.rs then
      # aborts the Linux build demanding `gtk3` or `xdg-portal` (PR #1405). Even
      # where it links, it just builds rfd twice. Our version must track the
      # plugin's -- drop this entry once tauri-plugin-dialog moves to 0.17.
      # Patch updates within 0.16.x still flow through.
      - dependency-name: "rfd"
        update-types: ["version-update:semver-minor"]

  # GitHub Actions
  - package-ecosystem: github-actions
    directory: /
    target-branch: dev
    schedule:
      interval: weekly
      day: monday
    commit-message:
      prefix: "ci(deps):"
    labels:
      - dependencies
      - ci
    open-pull-requests-limit: 5
    groups:
      actions-dependencies:
        patterns:
          - "*"
    ignore:
      - dependency-name: "*"
        update-types: ["version-update:semver-major"]