version: 2

# Third-party actions are pinned to immutable commit SHAs. SHAs never move on
# their own, so this entry is what keeps them current — without it the pins rot.
#
# GitHub-maintained actions (`actions/*`) stay on version tags. That is a decision
# to extend trust to those repositories, not a claim that pinning them would buy
# nothing: a tag is mutable, and anyone with push rights on the action's repo can
# move it, so SHA-pinning `actions/*` would genuinely narrow the exposure. We take
# the residual risk in exchange for a pin set small enough to keep honestly current
# at this repo's size — stale pins nobody bumps are their own hazard. Worth
# revisiting if the number of workflows or actions grows.
#
# Only the github-actions ecosystem is enabled. npm version-update PRs are
# deliberately off: frozen-lockfile installs plus the release cooldown in
# pnpm-workspace.yaml already manage dependency drift, and a PR per release is
# noise nobody reads. Dependabot *alerts* are enabled in repo settings and are
# the signal layer we do want; automated *security-update* PRs are off for the
# same reason — advisories get triaged against real exposure, not auto-patched.
updates:
  - package-ecosystem: "github-actions"
    directory: "/"
    schedule:
      interval: "monthly"
    # One PR for all action bumps instead of one per action.
    groups:
      actions:
        patterns:
          - "*"
    commit-message:
      prefix: "ci"