72207e3722
Problem: The Dependabot configuration monitors Cargo and GitHub Actions dependencies but does not track Docker base image updates. Stale base images in the Dockerfile can accumulate unpatched vulnerabilities. Solution: Add a Docker package-ecosystem entry to dependabot.yml that proposes weekly base image updates, grouped by minor/patch, with a 3-PR concurrency limit. Labels (ci, dependencies) match the existing GitHub Actions ecosystem entry for consistent triage routing. Testing: Validated YAML syntax. Dependabot will activate automatically on the next scheduled scan after merge. Ref: zeroclaw-labs/zeroclaw#618 (item 1 — Dependency Update Automation) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
52 lines
No EOL
975 B
YAML
52 lines
No EOL
975 B
YAML
version: 2
|
|
|
|
updates:
|
|
- package-ecosystem: cargo
|
|
directory: "/"
|
|
schedule:
|
|
interval: weekly
|
|
target-branch: main
|
|
open-pull-requests-limit: 5
|
|
labels:
|
|
- "dependencies"
|
|
groups:
|
|
rust-minor-patch:
|
|
patterns:
|
|
- "*"
|
|
update-types:
|
|
- minor
|
|
- patch
|
|
|
|
- package-ecosystem: github-actions
|
|
directory: "/"
|
|
schedule:
|
|
interval: weekly
|
|
target-branch: main
|
|
open-pull-requests-limit: 3
|
|
labels:
|
|
- "ci"
|
|
- "dependencies"
|
|
groups:
|
|
actions-minor-patch:
|
|
patterns:
|
|
- "*"
|
|
update-types:
|
|
- minor
|
|
- patch
|
|
|
|
- package-ecosystem: docker
|
|
directory: "/"
|
|
schedule:
|
|
interval: weekly
|
|
target-branch: main
|
|
open-pull-requests-limit: 3
|
|
labels:
|
|
- "ci"
|
|
- "dependencies"
|
|
groups:
|
|
docker-minor-patch:
|
|
patterns:
|
|
- "*"
|
|
update-types:
|
|
- minor
|
|
- patch |