From 2e660fb3de67b1194151e80f1fcc4182aaec0d77 Mon Sep 17 00:00:00 2001 From: phil Date: Tue, 6 Oct 2026 10:47:56 +0900 Subject: [PATCH] Add Dependabot for Go, Actions and Docker Scorecard DependencyUpdateTool is open: nothing proposes updates, so the grpc and otel advisories just closed sat until someone noticed. Dependabot now checks go.mod, workflow actions and the Dockerfile base images weekly, grouping minor and patch bumps into one PR per ecosystem, at most five open at a time. Co-Authored-By: Claude Fable 5.1 Signed-off-by: phil --- .github/dependabot.yml | 28 ++++++++++++++++++++++++++++ 1 file changed, 28 insertions(+) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..9566b6a --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,28 @@ +version: 2 +updates: + - package-ecosystem: gomod + directory: / + schedule: + interval: weekly + open-pull-requests-limit: 5 + groups: + gomod-minor-patch: + update-types: [minor, patch] + + - package-ecosystem: github-actions + directory: / + schedule: + interval: weekly + open-pull-requests-limit: 5 + groups: + actions-minor-patch: + update-types: [minor, patch] + + - package-ecosystem: docker + directory: / + schedule: + interval: weekly + open-pull-requests-limit: 5 + groups: + docker-minor-patch: + update-types: [minor, patch]