# Dependabot version-updates (security updates run separately, no config needed).
# Grouped minor+patch so a week's routine bumps arrive as one reviewable PR;
# majors come individually so they get scrutiny. Conventional-commit titles
# (`chore(deps):` / `ci(deps):`) satisfy the reusable pr-title validator, and
# ci-core runs the full suite on these because uv.lock/pyproject are in its
# path filter (#494).
version: 2
updates:
  - package-ecosystem: "uv"
    directory: "/"
    schedule:
      interval: "weekly"
      day: "monday"
    open-pull-requests-limit: 10
    commit-message:
      prefix: "chore"
      include: "scope"
    groups:
      python-minor-patch:
        update-types:
          - "minor"
          - "patch"

  # Every Dockerfile's base image is pinned by digest, which freezes it: a
  # digest with no updater behind it is a base image quietly accumulating CVEs,
  # which is a worse problem than the movable tag it replaced. `directories`
  # (plural) covers every path holding a Dockerfile in one entry.
  - package-ecosystem: "docker"
    directories:
      - "/"
      - "/examples/discovery"
      - "/examples/provider_math"
      - "/examples/task_upstream"
      - "/.clusterfuzzlite"
    schedule:
      interval: "weekly"
      day: "monday"
    open-pull-requests-limit: 5
    commit-message:
      prefix: "build"
      include: "scope"
    groups:
      docker-base-images:
        update-types:
          - "minor"
          - "patch"

  - package-ecosystem: "github-actions"
    directory: "/"
    schedule:
      interval: "weekly"
      day: "monday"
    open-pull-requests-limit: 5
    commit-message:
      prefix: "ci"
      include: "scope"
    groups:
      github-actions:
        update-types:
          - "minor"
          - "patch"