Dependency Updates

# 1) Enable Dependabot
# .github/dependabot.yml
version: 2
updates:
    # ─── npm packages ───
    - package-ecosystem: 'npm'
      directory: '/'
      schedule:
          interval: 'weekly'
          day: 'monday'
          time: '09:00'
          timezone: 'Australia/Sydney'
      open-pull-requests-limit: 10
      labels: ['dependencies', 'npm']
      commit-message:
          prefix: 'chore(deps)'
          include: 'scope'
      reviewers:
          - 'my-team/frontend'
      groups:
          # Group all minor + patch updates into one PR
          minor-and-patch:
              applies-to: version-updates
              update-types: ['minor', 'patch']
          # Group all security updates into one PR
          security:
              applies-to: security-updates

    # ─── Docker base images ───
    - package-ecosystem: 'docker'
      directory: '/'
      schedule: { interval: 'weekly' }
      labels: ['dependencies', 'docker']

    # ─── GitHub Actions ───
    - package-ecosystem: 'github-actions'
      directory: '/'
      schedule: { interval: 'weekly' }
      labels: ['ci']

    # ─── Terraform ───
    - package-ecosystem: 'terraform'
      directory: '/infrastructure'
      schedule: { interval: 'weekly' }

    # ─── Python ───
    - package-ecosystem: 'pip'
      directory: '/'
      schedule: { interval: 'weekly' }

    # ─── Go ───
    - package-ecosystem: 'gomod'
      directory: '/'
      schedule: { interval: 'weekly' }

# Push the file → Dependabot wakes up next scheduled time.

# 2) Supported ecosystems
# bundler (Ruby), cargo (Rust), composer (PHP), docker, dotnet (NuGet),
# elm, gitsubmodule, gomod, gradle, maven, mix (Elixir), npm,
# pip (Python), pub (Dart), swift, terraform, github-actions

# 3) Security updates — opt-in by default
# • Watching a public repo: enabled automatically
# • Private repo: enable in Settings → Code security → Dependabot alerts + security updates
# • Security PRs ALWAYS open, regardless of version-updates config
# • Run independently of the weekly schedule

# 4) Grouping (Sept 2023+) — bundle related updates
version: 2
updates:
    - package-ecosystem: npm
      directory: '/'
      schedule: { interval: weekly }
      groups:
          react-stack:
              patterns:
                  - 'react'
                  - 'react-dom'
                  - '@types/react*'
          test-stack:
              patterns:
                  - 'vitest'
                  - '@vitest/*'
                  - 'playwright'
          all-minor-patch:
              update-types: ['minor', 'patch']

# Reduces PR noise from 20 PRs/week to 3.

# 5) Ignore specific packages
ignore:
    - dependency-name: 'lodash'
      versions: ['>= 5.0']
    - dependency-name: 'react'
      update-types: ['version-update:semver-major']
    - dependency-name: '@types/node'                          # ignore entirely

# Use sparingly. Document WHY in the file:
# 'lodash >= 5.0' — migration in progress, see ticket #1234

# 6) Auto-merge — combine with GitHub branch protection
# .github/workflows/auto-merge.yml
name: dependabot-auto-merge
on: pull_request

permissions:
    contents: write
    pull-requests: write

jobs:
    auto-merge:
        runs-on: ubuntu-latest
        if: github.actor == 'dependabot[bot]'
        steps:
            - name: Get Dependabot metadata
              id: meta
              uses: dependabot/fetch-metadata@v2
              with:
                  github-token: '${{ secrets.GITHUB_TOKEN }}'

            - name: Auto-merge minor and patch
              if: ${{ steps.meta.outputs.update-type == 'version-update:semver-minor' || steps.meta.outputs.update-type == 'version-update:semver-patch' }}
              run: gh pr merge --auto --squash '${{ github.event.pull_request.html_url }}'
              env:
                  GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

# Requires branch protection with required CI checks — Dependabot PR gets auto-merged once CI passes.
# Reserve major upgrades for human review.

# 7) Run CI on Dependabot PRs
# By default, secrets are NOT available to Dependabot PRs (security).
# If your CI needs them:
#   • Use 'pull_request_target' trigger (security caveats — read carefully)
#   • Or expose dependency tests in 'pull_request' workflow that doesn't need secrets
#   • Configure 'Allow GitHub Actions to create and approve pull requests' in settings

# 8) Schedule windows — avoid weekend reviews
schedule:
    interval: 'weekly'
    day: 'monday'
    time: '06:00'
    timezone: 'Australia/Sydney'

# Tuesday morning PRs reviewed by Friday → green start to weekend.

# 9) Reviewers + assignees
reviewers:
    - 'my-org/frontend-team'
assignees:
    - 'mara'

# Default labels:
labels: ['dependencies', 'auto']

# 10) Workspace + monorepos
# For pnpm/npm/yarn workspaces, set directory to the WORKSPACE ROOT.
version: 2
updates:
    - package-ecosystem: npm
      directory: '/'
      schedule: { interval: weekly }

# Dependabot reads root package.json + workspace packages.

# 11) Rebase strategy
rebase-strategy: 'auto'    # auto / disabled
# Dependabot rebases its PR if main moves forward — keeps it mergeable.

# 12) Beyond Dependabot
# Alternatives:
# • Renovate — more powerful, more configuration; self-hosted or app
# • Snyk Open Source — security focus + license compliance
# • Mend.io — enterprise security
# • GitHub Advanced Security — includes Dependabot + CodeQL + secret scanning

# Renovate adds:
# • Schedule per package
# • Group by glob
# • Workflow comments + interactive merge
# • Self-hosted operations

# 13) Cost
# Dependabot is FREE on GitHub for all repos. No reason not to enable.

# 14) Common bugs / mistakes
# • Limit too low (5) → backlog of updates; raise to 10-20
# • No grouping → 50 PRs / week; team ignores them
# • Ignoring security-update PRs → CVEs stay open
# • Auto-merge without required CI checks → broken main
# • Major version auto-merged → breaking changes shipped
# • Branch protection bypass → Dependabot can't open PRs; enable via settings
# • Secrets not exposed to Dependabot → CI fails; use pull_request_target carefully or refactor
# • Default labels missing — workflow filters break; configure
# • Dependabot can't auto-resolve conflicts → stale PRs; team merges manually
# • Updates roll back yesterday's fix → freeze critical paths with 'ignore' until verified

# .github/dependabot.yml
version: 2
updates:
    - package-ecosystem: npm
      directory: "/"
      schedule: { interval: weekly }