Skip to content

Commit 9b9fd94

Browse files
Skeptic-systemsSkeptic-systems
committed
chore: configure dependabot for all ecosystems
- Added .github/dependabot.yml with daily updates at 04:00 CET - Configured npm ecosystem for pnpm monorepo at root directory - Configured cargo ecosystem for Rust/Tauri at apps/desktop/src-tauri - Configured github-actions ecosystem for workflow automation - Configured docker ecosystem for apps/docs and apps/www containers - Added dependency grouping to reduce PR noise (tauri, react, ai-sdk, etc.) - Updated README with Dependabot enablement instructions
1 parent 9aaab0e commit 9b9fd94

2 files changed

Lines changed: 227 additions & 0 deletions

File tree

‎.github/dependabot.yml‎

Lines changed: 207 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,207 @@
1+
# Dependabot configuration for MiniFy monorepo
2+
# Docs: https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
3+
4+
version: 2
5+
6+
updates:
7+
# ============================================================================
8+
# NPM (pnpm monorepo) - Root directory
9+
# Covers: root, apps/desktop, apps/docs, apps/www via single lockfile
10+
# ============================================================================
11+
- package-ecosystem: "npm"
12+
directory: "/"
13+
schedule:
14+
interval: "daily"
15+
time: "04:00"
16+
timezone: "Europe/Berlin"
17+
open-pull-requests-limit: 20
18+
rebase-strategy: "auto"
19+
labels:
20+
- "dependencies"
21+
commit-message:
22+
prefix: "deps"
23+
prefix-development: "deps(dev)"
24+
groups:
25+
npm-tauri:
26+
patterns:
27+
- "@tauri-apps/*"
28+
- "tauri-*"
29+
npm-react:
30+
patterns:
31+
- "react"
32+
- "react-dom"
33+
- "@types/react"
34+
- "@types/react-dom"
35+
npm-ai-sdk:
36+
patterns:
37+
- "ai"
38+
- "@ai-sdk/*"
39+
npm-radix:
40+
patterns:
41+
- "@radix-ui/*"
42+
npm-astro-starlight:
43+
patterns:
44+
- "astro"
45+
- "@astrojs/*"
46+
npm-next:
47+
patterns:
48+
- "next"
49+
- "next-*"
50+
npm-tailwind:
51+
patterns:
52+
- "tailwindcss"
53+
- "@tailwindcss/*"
54+
- "tailwind-*"
55+
- "tailwindcss-*"
56+
- "tw-*"
57+
npm-vite:
58+
patterns:
59+
- "vite"
60+
- "@vitejs/*"
61+
npm-typescript:
62+
patterns:
63+
- "typescript"
64+
- "@types/*"
65+
npm-tooling:
66+
patterns:
67+
- "@biomejs/*"
68+
- "turbo"
69+
- "@turbo/*"
70+
- "lefthook"
71+
- "@changesets/*"
72+
npm-runtime-misc:
73+
patterns:
74+
- "*"
75+
exclude-patterns:
76+
- "@tauri-apps/*"
77+
- "tauri-*"
78+
- "react"
79+
- "react-dom"
80+
- "@types/react"
81+
- "@types/react-dom"
82+
- "ai"
83+
- "@ai-sdk/*"
84+
- "@radix-ui/*"
85+
- "astro"
86+
- "@astrojs/*"
87+
- "next"
88+
- "next-*"
89+
- "tailwindcss"
90+
- "@tailwindcss/*"
91+
- "tailwind-*"
92+
- "tailwindcss-*"
93+
- "tw-*"
94+
- "vite"
95+
- "@vitejs/*"
96+
- "typescript"
97+
- "@types/*"
98+
- "@biomejs/*"
99+
- "turbo"
100+
- "@turbo/*"
101+
- "lefthook"
102+
- "@changesets/*"
103+
104+
# ============================================================================
105+
# Cargo (Rust/Tauri) - Desktop app backend
106+
# ============================================================================
107+
- package-ecosystem: "cargo"
108+
directory: "/apps/desktop/src-tauri"
109+
schedule:
110+
interval: "daily"
111+
time: "04:00"
112+
timezone: "Europe/Berlin"
113+
open-pull-requests-limit: 20
114+
rebase-strategy: "auto"
115+
labels:
116+
- "dependencies"
117+
- "rust"
118+
commit-message:
119+
prefix: "deps(rust)"
120+
groups:
121+
cargo-tauri:
122+
patterns:
123+
- "tauri"
124+
- "tauri-*"
125+
cargo-serde:
126+
patterns:
127+
- "serde"
128+
- "serde_*"
129+
cargo-async:
130+
patterns:
131+
- "tokio"
132+
- "axum"
133+
- "reqwest"
134+
cargo-misc:
135+
patterns:
136+
- "*"
137+
exclude-patterns:
138+
- "tauri"
139+
- "tauri-*"
140+
- "serde"
141+
- "serde_*"
142+
- "tokio"
143+
- "axum"
144+
- "reqwest"
145+
146+
# ============================================================================
147+
# GitHub Actions - Workflow automation
148+
# ============================================================================
149+
- package-ecosystem: "github-actions"
150+
directory: "/"
151+
schedule:
152+
interval: "daily"
153+
time: "04:00"
154+
timezone: "Europe/Berlin"
155+
open-pull-requests-limit: 10
156+
rebase-strategy: "auto"
157+
labels:
158+
- "dependencies"
159+
- "github-actions"
160+
commit-message:
161+
prefix: "deps(actions)"
162+
groups:
163+
actions-all:
164+
patterns:
165+
- "*"
166+
167+
# ============================================================================
168+
# Docker - Docs container
169+
# ============================================================================
170+
- package-ecosystem: "docker"
171+
directory: "/apps/docs"
172+
schedule:
173+
interval: "daily"
174+
time: "04:00"
175+
timezone: "Europe/Berlin"
176+
open-pull-requests-limit: 5
177+
rebase-strategy: "auto"
178+
labels:
179+
- "dependencies"
180+
- "docker"
181+
commit-message:
182+
prefix: "deps(docker)"
183+
groups:
184+
docker-docs:
185+
patterns:
186+
- "*"
187+
188+
# ============================================================================
189+
# Docker - WWW container
190+
# ============================================================================
191+
- package-ecosystem: "docker"
192+
directory: "/apps/www"
193+
schedule:
194+
interval: "daily"
195+
time: "04:00"
196+
timezone: "Europe/Berlin"
197+
open-pull-requests-limit: 5
198+
rebase-strategy: "auto"
199+
labels:
200+
- "dependencies"
201+
- "docker"
202+
commit-message:
203+
prefix: "deps(docker)"
204+
groups:
205+
docker-www:
206+
patterns:
207+
- "*"

‎README.md‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -242,5 +242,25 @@ This includes Spotify tokens and AI API keys. No credentials are stored in plain
242242
| 📋 Roadmap | [Project Board](https://github.com/orgs/ModioStudio/projects/2) |
243243
| 💬 Discord | [discord.gg/haNyuz2zQ5](https://discord.gg/haNyuz2zQ5) |
244244

245+
## Dependency Management
246+
247+
This project uses [Dependabot](https://docs.github.com/en/code-security/dependabot) to keep dependencies up-to-date automatically.
248+
249+
### Enable Dependabot (Repository Admins)
250+
251+
1. **Dependency Graph** — Go to **Settings → Security → Code security** and enable "Dependency graph"
252+
2. **Dependabot Alerts** — Enable "Dependabot alerts" for security vulnerability notifications
253+
3. **Dependabot Security Updates** — Enable "Dependabot security updates" for automatic security PRs
254+
4. **Dependabot Version Updates** — Already configured via `.github/dependabot.yml`, runs daily at 04:00 CET
255+
256+
### Covered Ecosystems
257+
258+
| Ecosystem | Directory | Description |
259+
|-----------|-----------|-------------|
260+
| npm | `/` | pnpm monorepo (all JS/TS packages) |
261+
| cargo | `/apps/desktop/src-tauri` | Rust/Tauri dependencies |
262+
| github-actions | `/` | GitHub Actions workflows |
263+
| docker | `/apps/docs`, `/apps/www` | Docker base images |
264+
245265
## License
246266
Licensed under the MIT License. See `LICENSE` for details.

0 commit comments

Comments
 (0)