nextcloud/.github/dependabot.yml

# SPDX-FileCopyrightText: 2020 Nextcloud GmbH and Nextcloud contributors
# SPDX-License-Identifier: AGPL-3.0-or-later

version: 2
updates:
# GitHub Actions
- package-ecosystem: "github-actions"
  directory: "/"
  schedule:
    interval: monthly
    timezone: Europe/Paris
  groups:
    github-actions:
      patterns:
        - "*"
  labels:
    - "3. to review"
    - "feature: dependencies"

# Main composer (linting, testing, openapi)
- package-ecosystem: composer
  directories:
    - "/"
    - "/vendor-bin/behat"
    - "/vendor-bin/cs-fixer"
    - "/vendor-bin/openapi-extractor"
    - "/vendor-bin/phpunit"
    - "/vendor-bin/psalm"
    - "/vendor-bin/rector"
  schedule:
    interval: weekly
    day: saturday
    time: "03:00"
    timezone: Europe/Paris
  labels:
    - "3. to review"
    - "feature: dependencies"

# Main master npm frontend dependencies
- package-ecosystem: npm
  directories:
    - "/"
    - "/build/frontend"
    - "/build/frontend-legacy"
  schedule:
    interval: weekly
    day: saturday
    time: "03:00"
    timezone: Europe/Paris
  open-pull-requests-limit: 20
  labels:
    - "3. to review"
    - "feature: dependencies"
  # Disable automatic rebasing because without a build CI will likely fail anyway
  rebase-strategy: "disabled"
  cooldown:
    default-days: 4
    semver-major-days: 8
  groups:
    eslint:
      patterns:
        - "eslint*"
        - "@nextcloud/eslint-config"
    vite:
      patterns:
        - "vite"
        - "@nextcloud/vite-config"
    vitest:
      patterns:
        - "vitest"
        - "@vitest/*"

# Latest stable release

# Composer dependencies for linting and testing
- package-ecosystem: composer
  target-branch: stable33
  directories:
    - "/"
    - "/vendor-bin/behat"
    - "/vendor-bin/cs-fixer"
    - "/vendor-bin/openapi-extractor"
    - "/vendor-bin/phpunit"
    - "/vendor-bin/psalm"
    - "/vendor-bin/rector"
  schedule:
    interval: weekly
    day: saturday
    time: "03:30"
    timezone: Europe/Paris
  labels:
    - "3. to review"
    - "feature: dependencies"
  ignore:
    # only patch updates on stable branches
    - dependency-name: "*"
      update-types: ["version-update:semver-major", "version-update:semver-minor"]

# frontend dependencies
- package-ecosystem: npm
  target-branch: stable33
  directories:
    - "/"
    - "/build/frontend"
    - "/build/frontend-legacy"
  schedule:
    interval: weekly
    day: saturday
    time: "03:30"
    timezone: Europe/Paris
  cooldown:
    default-days: 4
    semver-major-days: 8
  open-pull-requests-limit: 20
  labels:
    - "3. to review"
    - "feature: dependencies"
  # Disable automatic rebasing because without a build CI will likely fail anyway
  rebase-strategy: "disabled"
  groups:
    vite:
      patterns:
        - "vite"
        - "@nextcloud/vite-config"
    vitest:
      patterns:
        - "vitest"
        - "@vitest/*"
  ignore:
    # no major updates on stable branches
    - dependency-name: "*"
      update-types: ["version-update:semver-major"]

# Older stable releases

# Composer dependencies for linting and testing
- package-ecosystem: composer
  target-branch: stable32
  directories:
    - "/"
    - "/vendor-bin/behat"
    - "/vendor-bin/cs-fixer"
    - "/vendor-bin/openapi-extractor"
    - "/vendor-bin/phpunit"
    - "/vendor-bin/psalm"
  schedule:
    interval: weekly
    day: saturday
    time: "04:30"
    timezone: Europe/Paris
  labels:
    - "3. to review"
    - "feature: dependencies"
  ignore:
    # only patch updates on stable branches
    - dependency-name: "*"
      update-types: ["version-update:semver-major", "version-update:semver-minor"]

# frontend dependencies
- package-ecosystem: npm
  target-branch: stable32
  directory: "/"
  schedule:
    interval: weekly
    day: saturday
    time: "04:30"
    timezone: Europe/Paris
  cooldown:
    default-days: 4
    semver-major-days: 8
  open-pull-requests-limit: 20
  labels:
    - "3. to review"
    - "feature: dependencies"
  # Disable automatic rebasing because without a build CI will likely fail anyway
  rebase-strategy: "disabled"
  ignore:
    # no major updates on stable branches
    - dependency-name: "*"
      update-types: ["version-update:semver-major"]