dependabot.yml

version: 2
updates:
  - package-ecosystem: pip
    directory: /
    schedule:
      interval: weekly
      day: monday
    open-pull-requests-limit: 5
  - package-ecosystem: github-actions
    directory: /
    schedule:
      interval: weekly
      day: monday
    open-pull-requests-limit: 5
    # One PR for the whole CodeQL action set: init, analyze, autobuild and
    # upload-sarif must always run the same version. Since CodeQL Action
    # 3.30.4 the non-init steps hard-error when they load a configuration
    # file written by a different version, so a half-applied bump breaks the
    # scan rather than merely warning.
    groups:
      codeql-action:
        patterns:
          - github/codeql-action*