From 230f7c5fcd644ff7b24a5f9bbda3e7ec137d5950 Mon Sep 17 00:00:00 2001 From: dipen Date: Sun, 7 Jun 2026 14:37:53 -0700 Subject: [PATCH] ci: add Dependabot config for gradle and github-actions Weekly version bumps + security updates. Compose artifacts are grouped so they move together with the BOM. Gradle coverage becomes complete once the version catalog migration (#189) lands. Refs #215 Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/dependabot.yml | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 00000000..a387b9e3 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,21 @@ +# Dependabot: security updates + routine version bumps. +# The gradle ecosystem watches build files and (once the project migrates) +# gradle/libs.versions.toml; the github-actions ecosystem watches workflows. +version: 2 +updates: + - package-ecosystem: gradle + directory: / + schedule: + interval: weekly + open-pull-requests-limit: 5 + groups: + # Compose artifacts must move together with the BOM + compose: + patterns: + - "androidx.compose*" + + - package-ecosystem: github-actions + directory: / + schedule: + interval: weekly + open-pull-requests-limit: 5