From d013e60c581ba6a167eae4bce3fbeabd4452dbbb Mon Sep 17 00:00:00 2001
From: Amayyas <amayyas.aouadene@epitech.eu>
Date: Thu, 23 Jul 2026 20:53:13 +0200
Subject: [PATCH 1/2] chore(deps): add Dependabot for npm and GitHub Actions

Weekly checks on both ecosystems, grouped into one PR each so the strict
CI vets a batch at once. Major bumps are ignored on purpose: the stack is
pinned for Node 18, so majors are manual upgrades tied to the Node
baseline, not automated ones.
---
 .github/dependabot.yml | 51 ++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 51 insertions(+)
 create mode 100644 .github/dependabot.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..5bf012b
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,51 @@
+# Dependabot keeps dependencies current without drowning the repo in pull
+# requests. Two deliberate choices fit this project:
+#
+#  - Major updates are ignored. The stack is pinned for Node 18 (React Router 6,
+#    Vite 5, Tailwind 3...), so a major bump would break CI on every run; those
+#    are handled by hand, when the Node baseline moves.
+#  - Minor and patch updates are grouped into a single weekly PR per ecosystem,
+#    so the strict CI (five checks, tests, bundle budget) vets them together
+#    rather than one noisy PR at a time.
+version: 2
+updates:
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+    open-pull-requests-limit: 5
+    labels:
+      - dependencies
+    # Conventional Commits, like the rest of the history: "chore(deps): ...".
+    commit-message:
+      prefix: chore
+      include: scope
+    groups:
+      npm-minor-patch:
+        patterns:
+          - '*'
+        update-types:
+          - minor
+          - patch
+    ignore:
+      # Majors are intentional, manual upgrades — never automated here.
+      - dependency-name: '*'
+        update-types:
+          - version-update:semver-major
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+    labels:
+      - dependencies
+      - github-actions
+    commit-message:
+      prefix: ci
+      include: scope
+    groups:
+      github-actions:
+        patterns:
+          - '*'

From 5948c5499be16fbb467f7360cc1c9f42151cdc41 Mon Sep 17 00:00:00 2001
From: Amayyas <amayyas.aouadene@epitech.eu>
Date: Thu, 23 Jul 2026 21:01:00 +0200
Subject: [PATCH 2/2] chore(deps): exclude major action bumps too, matching npm

The GitHub Actions group still caught majors while npm excluded them. A
major action bump can change the runner contract and break CI unattended,
so hold it to minor and patch as well; majors stay manual.
---
 .github/dependabot.yml | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 5bf012b..5b58926 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -49,3 +49,12 @@ updates:
       github-actions:
         patterns:
           - '*'
+        update-types:
+          - minor
+          - patch
+    ignore:
+      # Like npm: a major action bump can change the runner contract and break
+      # CI, so it is a manual upgrade rather than an automated one.
+      - dependency-name: '*'
+        update-types:
+          - version-update:semver-major