From 23777cb9dceafb548f834772a5c298b6f0c41b18 Mon Sep 17 00:00:00 2001 From: hugoer Date: Fri, 4 Sep 2026 10:22:39 +0200 Subject: [PATCH] ci: watch the action versions with dependabot The node20 runtime deprecation in #25 was found by reading a job log. Nothing watched the action versions pinned in .github/workflows/, so they had gone a full major behind before anything said so. Every action is grouped into a single PR, so a quiet week opens none and a week where three actions cut releases still costs one review. The commit prefix matches the conventional-commit style already in the log. Only the github-actions ecosystem. Pointing dependabot at npm is a separate decision about PR volume and lockfile churn on a tree that includes lighthouse and puppeteer-core, and it should be made on its own rather than as a side effect of this. Closes #27 --- .github/dependabot.yml | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..dac7e7e --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,20 @@ +version: 2 + +updates: + # Watches the action versions pinned in .github/workflows/. "/" is the whole + # repository for this ecosystem, not a hint that the workflows live at the root. + # + # The actions went a full major behind without anyone noticing, until a job log + # started printing a node20 deprecation notice (#25). This is what catches the + # next one. + - package-ecosystem: github-actions + directory: / + schedule: + interval: weekly + # One PR for every action rather than one each. Most weeks that is no PR at + # all; a week where three actions cut releases is still a single review. + groups: + actions: + patterns: ['*'] + commit-message: + prefix: ci