# Dependabot keeps crates, Actions, and container base images current between
# the `cargo audit` / `cargo deny` gates on push (see docs/TODO.md T4-2).
# The `docker` entry aligns with the SHA-pinned bases in T4-1; the
# `github-actions` entry tracks the SHA-pinned `uses:` refs the same way.
# Conservative on purpose: one weekly run, few concurrent PRs.
version: 2
updates:
  - package-ecosystem: "cargo"
    directory: "/"
    schedule:
      interval: "weekly"
      day: "monday"
      time: "06:00"
      timezone: "UTC"
    open-pull-requests-limit: 5
    labels:
      - "dependencies"
    commit-message:
      prefix: "chore"
    groups:
      minor-patch:
        patterns:
          - "*"
        update-types:
          - "minor"
          - "patch"
  - package-ecosystem: "github-actions"
    directory: "/"
    schedule:
      interval: "weekly"
      day: "monday"
      time: "06:00"
      timezone: "UTC"
    open-pull-requests-limit: 5
    labels:
      - "dependencies"
    commit-message:
      prefix: "chore"
    groups:
      actions:
        patterns:
          - "*"
        update-types:
          - "minor"
          - "patch"
  - package-ecosystem: "docker"
    directory: "/"
    schedule:
      interval: "weekly"
      day: "monday"
      time: "06:00"
      timezone: "UTC"
    open-pull-requests-limit: 3
    labels:
      - "dependencies"
    commit-message:
      prefix: "chore"
    groups:
      base-images:
        patterns:
          - "*"
        update-types:
          - "minor"
          - "patch"
  - package-ecosystem: "docker"
    directory: "/.clusterfuzzlite"
    schedule:
      interval: "weekly"
      day: "monday"
      time: "06:00"
      timezone: "UTC"
    open-pull-requests-limit: 1
    labels:
      - "dependencies"
    commit-message:
      prefix: "chore"
    groups:
      base-images:
        patterns:
          - "*"
        update-types:
          - "minor"
          - "patch"