From 2af134939fc2abaf2a4d857999ee2c31fa061faf Mon Sep 17 00:00:00 2001
From: dongjiang <dongjiang1989@126.com>
Date: Wed, 15 Jul 2026 14:33:41 +0800
Subject: [PATCH] Add dependabot.yml for automated dependency updates

Configure Dependabot to weekly update GitHub Actions and Python dev
dependencies. Production dependencies remain manually managed,
consistent with the existing renovate.json policy.

Signed-off-by: dongjiang <dongjiang1989@126.com>
---
 .github/dependabot.yml | 52 ++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 52 insertions(+)
 create mode 100644 .github/dependabot.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..91fbad2
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,52 @@
+version: 2
+updates:
+  # GitHub Actions
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "00:00"
+    commit-message:
+      prefix: "ci"
+    groups:
+      github-actions:
+        patterns:
+          - "*"
+
+  # Python dependencies (uv workspace)
+  # Only the root directory is needed because all workspace members
+  # share a single uv.lock file at the repository root.
+  - package-ecosystem: "pip"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "00:00"
+    commit-message:
+      prefix: "deps"
+    # Production dependencies are managed manually and bumped only when
+    # necessary — consistent with the previous renovate.json policy.
+    ignore:
+      # Root production deps
+      - dependency-name: "protobuf-py"
+      - dependency-name: "pyqwest"
+      # connectrpc-otel production deps
+      - dependency-name: "opentelemetry-api"
+      - dependency-name: "opentelemetry-instrumentation"
+      - dependency-name: "opentelemetry-instrumentation-asgi"
+      - dependency-name: "opentelemetry-instrumentation-wsgi"
+      - dependency-name: "opentelemetry-sdk"
+      # Sub-project production deps
+      - dependency-name: "connectrpc"
+      - dependency-name: "flask"
+      - dependency-name: "starlette"
+    groups:
+      otel-dependencies:
+        patterns:
+          - "opentelemetry-*"
+      python-dev-dependencies:
+        exclude-patterns:
+          - "opentelemetry-*"
+        patterns:
+          - "*"