mirror of
https://github.com/microsoft/regorus.git
synced 2026-08-05 02:16:11 +00:00
f69974dc1b
* ci(dependabot): fix cargo workspace updates and refresh lockfiles Remove nested Cargo workspace members from Dependabot's cargo directories to avoid manifest resolution failures during grouped updates. Add a Dependabot-only workflow that refreshes affected Cargo lockfiles, including the no_std target-specific resolution path, so CI can continue enforcing --locked and --frozen builds. Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com> * ci(dependabot): address workflow review comments Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com> * ci(dependabot): address workflow permission and toolchain comments Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com> * ci(dependabot): stage no-std lockfile refresh Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com> * ci(dependabot): harden refresh workflow * ci(dependabot): refine workflow gating and staging * ci(dependabot): harden workflow git operations --------- Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
99 lines
2.4 KiB
YAML
99 lines
2.4 KiB
YAML
# Copyright (c) Microsoft Corporation. All rights reserved.
|
|
#
|
|
# To get started with Dependabot version updates, you'll need to specify which
|
|
# package ecosystems to update and where the package manifests are located.
|
|
# Please see the documentation for all configuration options:
|
|
# https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
|
|
|
|
version: 2
|
|
updates:
|
|
# All Rust/Cargo directories are grouped into a single entry so that
|
|
# when a dependency is updated, Dependabot creates ONE PR that bumps it
|
|
# across the root workspace AND every binding, preventing version skew.
|
|
- package-ecosystem: "cargo"
|
|
directories:
|
|
- "/"
|
|
- "/bindings/ffi"
|
|
- "/bindings/java"
|
|
- "/bindings/python"
|
|
- "/bindings/ruby"
|
|
- "/bindings/wasm"
|
|
schedule:
|
|
interval: "weekly"
|
|
commit-message:
|
|
prefix: "build(deps)"
|
|
groups:
|
|
rust-dependencies:
|
|
patterns:
|
|
- "*"
|
|
# Ignore vendored mimalloc crates; updates are managed manually.
|
|
ignore:
|
|
- dependency-name: "regorus-mimalloc"
|
|
- dependency-name: "regorus-mimalloc-sys"
|
|
|
|
- package-ecosystem: "gomod"
|
|
directory: "/bindings/go"
|
|
schedule:
|
|
interval: "weekly"
|
|
commit-message:
|
|
prefix: "build(deps)"
|
|
groups:
|
|
per-dependency:
|
|
patterns:
|
|
- "*"
|
|
|
|
- package-ecosystem: "maven"
|
|
directory: "/bindings/java"
|
|
schedule:
|
|
interval: "weekly"
|
|
commit-message:
|
|
prefix: "build(deps)"
|
|
groups:
|
|
per-dependency:
|
|
patterns:
|
|
- "*"
|
|
|
|
- package-ecosystem: "nuget"
|
|
directory: "/bindings/csharp"
|
|
schedule:
|
|
interval: "weekly"
|
|
commit-message:
|
|
prefix: "build(deps)"
|
|
groups:
|
|
per-dependency:
|
|
patterns:
|
|
- "*"
|
|
|
|
- package-ecosystem: "pip"
|
|
directory: "/bindings/python"
|
|
schedule:
|
|
interval: "weekly"
|
|
commit-message:
|
|
prefix: "build(deps)"
|
|
groups:
|
|
per-dependency:
|
|
patterns:
|
|
- "*"
|
|
|
|
- package-ecosystem: "bundler"
|
|
directory: "/bindings/ruby"
|
|
schedule:
|
|
interval: "weekly"
|
|
commit-message:
|
|
prefix: "build(deps)"
|
|
groups:
|
|
per-dependency:
|
|
patterns:
|
|
- "*"
|
|
|
|
- package-ecosystem: "github-actions"
|
|
directory: "/"
|
|
schedule:
|
|
interval: "weekly"
|
|
commit-message:
|
|
prefix: "ci(deps)"
|
|
groups:
|
|
github-actions:
|
|
patterns:
|
|
- "*"
|