mirror of
https://github.com/MBombeck/HealthLog.git
synced 2026-11-08 20:42:43 +00:00
85 lines
3.6 KiB
YAML
85 lines
3.6 KiB
YAML
version: 2
|
|
updates:
|
|
- package-ecosystem: "npm"
|
|
directory: "/"
|
|
schedule:
|
|
interval: "weekly"
|
|
open-pull-requests-limit: 5
|
|
groups:
|
|
security-patches:
|
|
applies-to: security-updates
|
|
update-types:
|
|
- "patch"
|
|
# One weekly pull request per dependency kind instead of a trickle of
|
|
# single bumps: patch and minor updates travel together and pass the
|
|
# same checks once. Majors stay single so each gets its own review.
|
|
#
|
|
# The Next.js line travels alone. Its bumps are the ones that move
|
|
# URL state after history traversal (see the note on 16.4 below), and a
|
|
# red Next bump inside the group would hold every harmless update in
|
|
# it red as well.
|
|
production-weekly:
|
|
dependency-type: "production"
|
|
update-types:
|
|
- "patch"
|
|
- "minor"
|
|
exclude-patterns:
|
|
- "next"
|
|
development-weekly:
|
|
dependency-type: "development"
|
|
update-types:
|
|
- "patch"
|
|
- "minor"
|
|
exclude-patterns:
|
|
- "eslint-config-next"
|
|
- "@next/bundle-analyzer"
|
|
# No ignore for the Next.js line any more. 16.4.0 lost URL state after
|
|
# history traversal: with a sheet opened through `?doc=`, Back left it
|
|
# open, and `[` / `]` sometimes did not move `?day=` (3 of 40 repeated
|
|
# runs of three end-to-end journeys, 0 of 80 on 16.3.8). 16.4.2 does the
|
|
# same (the day keys lost a step in 2 of 20 runs locally, the `?doc=`
|
|
# journey failed once in CI). Both were ours to fix: the sheet followed
|
|
# `useSearchParams`, which 16.4 updates after the write it copies, and a
|
|
# day step wrote the URL before Next had adopted the previous step, whose
|
|
# late adoption then put the older URL back. The sheet now follows the
|
|
# address bar and a step waits for the layer. Measured after both fixes:
|
|
# 200 of 200 repeated runs of the three journeys, and another 80 of 80
|
|
# each for the `?doc=` and day-key journeys.
|
|
- package-ecosystem: "github-actions"
|
|
directory: "/"
|
|
schedule:
|
|
interval: "weekly"
|
|
open-pull-requests-limit: 3
|
|
groups:
|
|
# init, analyze and upload-sarif are one release pinned in three places.
|
|
# Bumped separately, a run mixes two versions and analyze refuses the
|
|
# config init wrote ("Loaded a configuration file for version 4.37.7, but
|
|
# running version 4.37.9"), so none of the single-action pull requests can
|
|
# reach green on its own. They travel together.
|
|
codeql-action:
|
|
patterns:
|
|
- "github/codeql-action*"
|
|
- package-ecosystem: "docker"
|
|
directory: "/"
|
|
schedule:
|
|
interval: "weekly"
|
|
open-pull-requests-limit: 3
|
|
# The `docker` ecosystem above reads the Dockerfile only. The bundled
|
|
# database lives in `docker-compose.yml`, which GitHub treats as its own
|
|
# ecosystem, so without this block a new PostgreSQL minor release never
|
|
# reaches us and the pin ages silently.
|
|
- package-ecosystem: "docker-compose"
|
|
directory: "/"
|
|
schedule:
|
|
interval: "weekly"
|
|
open-pull-requests-limit: 3
|
|
ignore:
|
|
# A PostgreSQL major is a migration, not an update: the on-disk format
|
|
# changes, so the operator has to run pg_upgrade or dump and restore.
|
|
# The first run of this ecosystem proposed 16.15 -> 18.6, which would
|
|
# have handed self-hosters a database their data directory cannot be
|
|
# read by. Minor releases still arrive as PRs; a major is a deliberate
|
|
# project decision with a migration guide behind it.
|
|
- dependency-name: "postgres"
|
|
update-types: ["version-update:semver-major"]
|