From 4bf06f056a486e79aa330790346e2ab1835a1209 Mon Sep 17 00:00:00 2001 From: Nils Homer Date: Tue, 25 Aug 2026 00:39:31 -0700 Subject: [PATCH] ci: add dependabot for cargo deps, daily Ungrouped so each dependency (fgumi in particular) gets its own PR rather than being bundled with unrelated bumps. fgumi is a normal crates.io dependency (never vendored, per CLAUDE.md), so a plain cargo-ecosystem entry covers detecting and bumping it -- including the Cargo.toml version requirement itself when a new fgumi release moves the 0.x minor, which is the case a `cargo update` alone can't cross. CI already runs check.yml on every PR; a bump that breaks the build or a test just sits there to be fixed manually, same as any other PR. --- .github/dependabot.yml | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..6475c99 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,19 @@ +version: 2 +updates: + # Maintain dependencies for Cargo (one PR per dependency, so a fgumi bump + # opens on its own rather than getting bundled with unrelated deps). + - package-ecosystem: cargo + directory: "/" + schedule: + interval: daily + open-pull-requests-limit: 5 + + # Maintain dependencies for GitHub Actions + - package-ecosystem: github-actions + directory: "/" + schedule: + interval: weekly + open-pull-requests-limit: 5 + groups: + all-actions: + patterns: ["*"]