9b786c1c95
- Add npm monitoring for apps/api, apps/web, and libs/mcp-servers directories alongside root workspace - Reduce open-pull-requests-limit from 10 to 5 per ecosystem - Add dependency groups for Next.js and React packages - Remove stale pip and docker entries for non-existent libs/ai-services - Add documentation header explaining security update strategy - Security updates rely on GitHub's built-in Dependabot Security Updates feature (daily automatic PRs for advisories) Co-Authored-By: Paperclip <noreply@paperclip.ing>
199 lines
5.6 KiB
YAML
199 lines
5.6 KiB
YAML
version: 2
|
|
|
|
# ─────────────────────────────────────────────────────────────────────
|
|
# Dependabot configuration for GoodGo Platform monorepo
|
|
#
|
|
# Version updates: weekly (Monday 06:00 ICT)
|
|
# Security updates: enabled repo-wide via GitHub Dependabot Security
|
|
# Updates (Settings → Code security → Dependabot security updates).
|
|
# Security PRs are created automatically within hours of advisory
|
|
# publication — no schedule entry needed here.
|
|
#
|
|
# PR limit: 5 per ecosystem/directory to keep review load manageable.
|
|
# Grouping: minor + patch bundled together to reduce PR noise.
|
|
# ─────────────────────────────────────────────────────────────────────
|
|
|
|
updates:
|
|
# ── npm: Root workspace (pnpm lockfile covers all packages) ────────
|
|
- package-ecosystem: "npm"
|
|
directory: "/"
|
|
schedule:
|
|
interval: "weekly"
|
|
day: "monday"
|
|
time: "06:00"
|
|
timezone: "Asia/Ho_Chi_Minh"
|
|
open-pull-requests-limit: 5
|
|
reviewers:
|
|
- "goodgo/platform-team"
|
|
labels:
|
|
- "dependencies"
|
|
groups:
|
|
dev-dependencies:
|
|
patterns:
|
|
- "@types/*"
|
|
- "eslint*"
|
|
- "prettier*"
|
|
- "typescript*"
|
|
- "vitest*"
|
|
- "@playwright/*"
|
|
- "husky"
|
|
- "lint-staged"
|
|
- "tsx"
|
|
- "turbo"
|
|
update-types:
|
|
- "minor"
|
|
- "patch"
|
|
nestjs:
|
|
patterns:
|
|
- "@nestjs/*"
|
|
update-types:
|
|
- "minor"
|
|
- "patch"
|
|
prisma:
|
|
patterns:
|
|
- "prisma"
|
|
- "@prisma/*"
|
|
update-types:
|
|
- "minor"
|
|
- "patch"
|
|
nextjs:
|
|
patterns:
|
|
- "next"
|
|
- "next-*"
|
|
update-types:
|
|
- "minor"
|
|
- "patch"
|
|
react:
|
|
patterns:
|
|
- "react"
|
|
- "react-dom"
|
|
- "@types/react*"
|
|
update-types:
|
|
- "minor"
|
|
- "patch"
|
|
commit-message:
|
|
prefix: "deps"
|
|
include: "scope"
|
|
|
|
# ── npm: apps/api ──────────────────────────────────────────────────
|
|
- package-ecosystem: "npm"
|
|
directory: "/apps/api"
|
|
schedule:
|
|
interval: "weekly"
|
|
day: "monday"
|
|
time: "06:00"
|
|
timezone: "Asia/Ho_Chi_Minh"
|
|
open-pull-requests-limit: 5
|
|
labels:
|
|
- "dependencies"
|
|
- "api"
|
|
groups:
|
|
api-minor-patch:
|
|
patterns:
|
|
- "*"
|
|
update-types:
|
|
- "minor"
|
|
- "patch"
|
|
commit-message:
|
|
prefix: "deps(api)"
|
|
include: "scope"
|
|
|
|
# ── npm: apps/web ──────────────────────────────────────────────────
|
|
- package-ecosystem: "npm"
|
|
directory: "/apps/web"
|
|
schedule:
|
|
interval: "weekly"
|
|
day: "monday"
|
|
time: "06:00"
|
|
timezone: "Asia/Ho_Chi_Minh"
|
|
open-pull-requests-limit: 5
|
|
labels:
|
|
- "dependencies"
|
|
- "web"
|
|
groups:
|
|
web-minor-patch:
|
|
patterns:
|
|
- "*"
|
|
update-types:
|
|
- "minor"
|
|
- "patch"
|
|
commit-message:
|
|
prefix: "deps(web)"
|
|
include: "scope"
|
|
|
|
# ── npm: libs/mcp-servers ──────────────────────────────────────────
|
|
- package-ecosystem: "npm"
|
|
directory: "/libs/mcp-servers"
|
|
schedule:
|
|
interval: "weekly"
|
|
day: "monday"
|
|
time: "06:00"
|
|
timezone: "Asia/Ho_Chi_Minh"
|
|
open-pull-requests-limit: 5
|
|
labels:
|
|
- "dependencies"
|
|
- "mcp"
|
|
groups:
|
|
mcp-minor-patch:
|
|
patterns:
|
|
- "*"
|
|
update-types:
|
|
- "minor"
|
|
- "patch"
|
|
commit-message:
|
|
prefix: "deps(mcp)"
|
|
include: "scope"
|
|
|
|
# ── GitHub Actions ───────────────────────────────────────────────
|
|
- package-ecosystem: "github-actions"
|
|
directory: "/"
|
|
schedule:
|
|
interval: "weekly"
|
|
day: "monday"
|
|
time: "06:00"
|
|
timezone: "Asia/Ho_Chi_Minh"
|
|
open-pull-requests-limit: 5
|
|
labels:
|
|
- "dependencies"
|
|
- "ci"
|
|
groups:
|
|
github-actions:
|
|
patterns:
|
|
- "*"
|
|
update-types:
|
|
- "minor"
|
|
- "patch"
|
|
commit-message:
|
|
prefix: "ci"
|
|
include: "scope"
|
|
|
|
# ── Docker: apps/api ────────────────────────────────────────────
|
|
- package-ecosystem: "docker"
|
|
directory: "/apps/api"
|
|
schedule:
|
|
interval: "weekly"
|
|
day: "monday"
|
|
time: "06:00"
|
|
timezone: "Asia/Ho_Chi_Minh"
|
|
open-pull-requests-limit: 3
|
|
labels:
|
|
- "dependencies"
|
|
- "docker"
|
|
commit-message:
|
|
prefix: "docker(api)"
|
|
|
|
# ── Docker: apps/web ────────────────────────────────────────────
|
|
- package-ecosystem: "docker"
|
|
directory: "/apps/web"
|
|
schedule:
|
|
interval: "weekly"
|
|
day: "monday"
|
|
time: "06:00"
|
|
timezone: "Asia/Ho_Chi_Minh"
|
|
open-pull-requests-limit: 3
|
|
labels:
|
|
- "dependencies"
|
|
- "docker"
|
|
commit-message:
|
|
prefix: "docker(web)"
|