mirror of
https://github.com/MBombeck/HealthLog.git
synced 2026-11-11 05:42:19 +00:00
Marc-André Bombeck
79c4c3631f
The bundled PostgreSQL was pinned to 16.14 while 16.15 had been out for five weeks. The pin itself is deliberate, a database change should be reviewable rather than whatever the registry serves on pull day, but nothing watched it: Dependabot was configured with the docker ecosystem, which reads the Dockerfile and never opens a compose file, so no update PR was ever raised. CI and the integration suite meanwhile run against the floating 16-alpine, so the shipped database was older than the tested one. Adds the docker-compose ecosystem so each PostgreSQL minor release arrives as a reviewable PR, moves the pin to 16.15, and pins both halves with a test that fails if the exact minor or the watch is dropped. Refs #987
41 lines
1.3 KiB
YAML
41 lines
1.3 KiB
YAML
version: 2
|
|
updates:
|
|
- package-ecosystem: "npm"
|
|
directory: "/"
|
|
schedule:
|
|
interval: "weekly"
|
|
open-pull-requests-limit: 5
|
|
groups:
|
|
security-patches:
|
|
applies-to: security-updates
|
|
update-types:
|
|
- "patch"
|
|
- package-ecosystem: "github-actions"
|
|
directory: "/"
|
|
schedule:
|
|
interval: "weekly"
|
|
open-pull-requests-limit: 3
|
|
groups:
|
|
# init, analyze and upload-sarif are one release pinned in three places.
|
|
# Bumped separately, a run mixes two versions and analyze refuses the
|
|
# config init wrote ("Loaded a configuration file for version 4.37.7, but
|
|
# running version 4.37.9"), so none of the single-action pull requests can
|
|
# reach green on its own. They travel together.
|
|
codeql-action:
|
|
patterns:
|
|
- "github/codeql-action*"
|
|
- package-ecosystem: "docker"
|
|
directory: "/"
|
|
schedule:
|
|
interval: "weekly"
|
|
open-pull-requests-limit: 3
|
|
# The `docker` ecosystem above reads the Dockerfile only. The bundled
|
|
# database lives in `docker-compose.yml`, which GitHub treats as its own
|
|
# ecosystem, so without this block a new PostgreSQL minor release never
|
|
# reaches us and the pin ages silently.
|
|
- package-ecosystem: "docker-compose"
|
|
directory: "/"
|
|
schedule:
|
|
interval: "weekly"
|
|
open-pull-requests-limit: 3
|