From 65c18a610f0430129ce4370e3f70a64a2c38f493 Mon Sep 17 00:00:00 2001 From: Mohammad Saddam Hossain Date: Sat, 19 Sep 2026 08:57:23 +0530 Subject: [PATCH] ci: add Dependabot for maven + github-actions MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit selenium-java sat 9 releases behind (4.40.0 vs 4.49.0 upstream), with no automation surfacing that drift — unlike selenium-mcp, which has had Dependabot on pip/github-actions since #5. pom.xml pins every dependency to an exact version, so Dependabot always has an update to compare against; no upper-bound trick needed the way pip required. Not auto-merge: bumped PRs still have to clear `mvn test` (480 tests) like any other change. Co-Authored-By: Claude Sonnet 5 --- .github/dependabot.yml | 34 ++++++++++++++++++++++++++++++++++ 1 file changed, 34 insertions(+) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..2077fec --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,34 @@ +# Dependency alerting for selenium-boot. +# +# pom.xml pins every dependency to an exact version, so Dependabot always has +# something to compare against — unlike selenium-mcp's pip pin, no upper +# bound is needed here for it to see updates. +# +# Not auto-merged: a bumped PR still has to clear `mvn test` (480 unit tests) +# before it's mergeable, same bar as any other change to this repo. +version: 2 +updates: + - package-ecosystem: "maven" + directory: "/" + schedule: + interval: "weekly" + day: "monday" + time: "06:00" + timezone: "Etc/UTC" + open-pull-requests-limit: 5 + labels: + - "dependencies" + commit-message: + prefix: "deps" + + # Workflows pin actions by major tag; this catches the ones that go stale. + - package-ecosystem: "github-actions" + directory: "/" + schedule: + interval: "monthly" + open-pull-requests-limit: 3 + labels: + - "dependencies" + - "ci" + commit-message: + prefix: "ci"