dependabot.yml

# Keeps the five dependency manifests moving without anyone having to
# remember to look. Before this file, an upstream release was noticed when
# someone happened to run `npm outdated` - which is to say, rarely.
#
# THE GROUPING IS THE POINT. Five ecosystems left ungrouped produce a PR per
# package per week, and a queue nobody reads is worse than no queue: it
# trains people to close Dependabot PRs unread, including the one that
# mattered. So minor and patch updates arrive as one PR per manifest per
# week, and majors - the ones that actually need a human to think - come
# separately, one at a time, where they are visible.
#
# This is the same reasoning check-upstream-freshness.yml applies to data:
# a signal that fires constantly is not a signal.
#
# THE `no-issue` LABEL IS PART OF THE BUMP, NOT PAPERWORK ABOUT IT.
# pr-issue-link.yml fails any pull request that closes no issue, and a
# dependency bump has none to close - it is the first example CONTRIBUTING.md
# gives of a change the `no-issue` exemption exists for. Until these `labels:`
# lines, nothing applied it: every bump opened red and stayed red until a human
# labelled it by hand, five to seven times a week. That failed in the expensive
# direction, because it taught everyone to read a red Dependabot check as
# normal - the same reflex the grouping above exists to prevent, arriving by a
# different door.
#
# `labels:` REPLACES Dependabot's defaults rather than adding to them, which is
# why `dependencies` and the ecosystem label are written out again below. Drop
# them and the bump arrives carrying only its exemption, which is the one label
# nothing else in the repository searches by.
#
# The exemption is also a changelog decision, and that is the reason it is
# spelled this way rather than as an author check inside pr-issue-link.yml.
# release_notes.py reads `no-issue` as INTERNAL_ONLY, so a labelled bump stays
# out of the hiker-facing section of the notes. Exempting `dependabot[bot]` by
# name would turn the check green and quietly file every weekly bump under
# things a hiker can observe - green CI, wrong release notes, and nothing
# anywhere to say why.

version: 2

updates:
  # ---------------------------------------------------------------- client
  - package-ecosystem: npm
    directory: /client
    schedule:
      interval: weekly
      day: monday
    open-pull-requests-limit: 5
    labels: [dependencies, javascript, "no-issue"]
    groups:
      client-minor-and-patch:
        patterns: ["*"]
        update-types: [minor, patch]

  # -------------------------------------------------------------- pipeline
  # requirements.txt here is compiled output, not a hand-written list.
  # Dependabot recognises the uv/pip-compile header and regenerates the file
  # rather than editing the pin in place, so requirements.in stays the source
  # of truth. A duckdb bump is the one that needs care - its spatial
  # extension is ABI-locked to the exact version and the sandbox hook reads
  # the pin back out. See the comment in pipeline/requirements.in.
  - package-ecosystem: pip
    directory: /pipeline
    schedule:
      interval: weekly
      day: monday
    open-pull-requests-limit: 5
    labels: [dependencies, python, "no-issue"]
    groups:
      pipeline-minor-and-patch:
        patterns: ["*"]
        update-types: [minor, patch]

  # --------------------------------------------------------------- backend
  - package-ecosystem: pip
    directory: /backend
    schedule:
      interval: weekly
      day: monday
    open-pull-requests-limit: 5
    labels: [dependencies, python, "no-issue"]
    groups:
      backend-minor-and-patch:
        patterns: ["*"]
        update-types: [minor, patch]

  # ------------------------------------------------- repository-settings tests
  - package-ecosystem: pip
    directory: /.github/tests
    schedule:
      interval: weekly
      day: monday
    open-pull-requests-limit: 3
    labels: [dependencies, python, "no-issue"]
    groups:
      repo-tests-minor-and-patch:
        patterns: ["*"]
        update-types: [minor, patch]

  # ------------------------------------------------------- github actions
  # Every workflow pins its actions by major tag (actions/checkout@v4), which
  # silently absorbs minor releases already. This catches the major bumps
  # that tag will never deliver, and any action that stops being maintained.
  - package-ecosystem: github-actions
    directory: /
    schedule:
      interval: weekly
      day: monday
    open-pull-requests-limit: 3
    labels: [dependencies, github_actions, "no-issue"]
    groups:
      actions-minor-and-patch:
        patterns: ["*"]
        update-types: [minor, patch]