mirror of
https://github.com/MBombeck/HealthLog.git
synced 2026-11-08 12:32:43 +00:00
Marc-André Bombeck
1606099005
A red Next bump inside the production group held the twelve harmless updates next to it red as well. The three Next packages open as single pull requests, so each is judged on its own checks.
85 lines
3.3 KiB
YAML
85 lines
3.3 KiB
YAML
version: 2
|
|
updates:
|
|
- package-ecosystem: "npm"
|
|
directory: "/"
|
|
schedule:
|
|
interval: "weekly"
|
|
open-pull-requests-limit: 5
|
|
groups:
|
|
security-patches:
|
|
applies-to: security-updates
|
|
update-types:
|
|
- "patch"
|
|
# One weekly pull request per dependency kind instead of a trickle of
|
|
# single bumps: patch and minor updates travel together and pass the
|
|
# same checks once. Majors stay single so each gets its own review.
|
|
#
|
|
# The Next.js line travels alone: while a 16.4 patch is still being
|
|
# re-measured, a red Next bump inside the group holds every harmless
|
|
# update in it red as well.
|
|
production-weekly:
|
|
dependency-type: "production"
|
|
update-types:
|
|
- "patch"
|
|
- "minor"
|
|
exclude-patterns:
|
|
- "next"
|
|
development-weekly:
|
|
dependency-type: "development"
|
|
update-types:
|
|
- "patch"
|
|
- "minor"
|
|
exclude-patterns:
|
|
- "eslint-config-next"
|
|
- "@next/bundle-analyzer"
|
|
ignore:
|
|
# Next 16.4.0 breaks URL state after history traversal: with a sheet
|
|
# opened through `?doc=`, Back leaves it open, and `[` / `]` sometimes
|
|
# do not move `?day=`. Reproduced in three end-to-end journeys (3 of 40
|
|
# repeated runs on 16.4.0, 0 of 80 on 16.3.8 with everything else
|
|
# equal). 16.3.8 carries every published security fix, so the line
|
|
# waits for a 16.4 patch; the two packages that move with it wait too.
|
|
- dependency-name: "next"
|
|
versions: ["16.4.0"]
|
|
- dependency-name: "eslint-config-next"
|
|
versions: ["16.4.0"]
|
|
- dependency-name: "@next/bundle-analyzer"
|
|
versions: ["16.4.0"]
|
|
- package-ecosystem: "github-actions"
|
|
directory: "/"
|
|
schedule:
|
|
interval: "weekly"
|
|
open-pull-requests-limit: 3
|
|
groups:
|
|
# init, analyze and upload-sarif are one release pinned in three places.
|
|
# Bumped separately, a run mixes two versions and analyze refuses the
|
|
# config init wrote ("Loaded a configuration file for version 4.37.7, but
|
|
# running version 4.37.9"), so none of the single-action pull requests can
|
|
# reach green on its own. They travel together.
|
|
codeql-action:
|
|
patterns:
|
|
- "github/codeql-action*"
|
|
- package-ecosystem: "docker"
|
|
directory: "/"
|
|
schedule:
|
|
interval: "weekly"
|
|
open-pull-requests-limit: 3
|
|
# The `docker` ecosystem above reads the Dockerfile only. The bundled
|
|
# database lives in `docker-compose.yml`, which GitHub treats as its own
|
|
# ecosystem, so without this block a new PostgreSQL minor release never
|
|
# reaches us and the pin ages silently.
|
|
- package-ecosystem: "docker-compose"
|
|
directory: "/"
|
|
schedule:
|
|
interval: "weekly"
|
|
open-pull-requests-limit: 3
|
|
ignore:
|
|
# A PostgreSQL major is a migration, not an update: the on-disk format
|
|
# changes, so the operator has to run pg_upgrade or dump and restore.
|
|
# The first run of this ecosystem proposed 16.15 -> 18.6, which would
|
|
# have handed self-hosters a database their data directory cannot be
|
|
# read by. Minor releases still arrive as PRs; a major is a deliberate
|
|
# project decision with a migration guide behind it.
|
|
- dependency-name: "postgres"
|
|
update-types: ["version-update:semver-major"]
|