1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
|
version: 2
# Keeps the pinned action SHAs moving.
#
# Every action reference under .github/workflows is a 40-character commit SHA
# with the version in a trailing comment. A SHA pin *without* this file is worse
# than a floating tag: it freezes CI on whatever was current the day it was
# written, which is how actions/cache@v1 came to sit in ci_cortex_m.yml until
# GitHub started auto-failing every request that used it. Measured on
# 2026-08-24, before the catch-up: download-artifact was four majors behind,
# checkout and upload-artifact three each, cache and upload-pages-artifact two.
# Nothing had ever reported that, because there was no configuration here -- nor
# in netxduo, filex, guix or rtos-docs-asciidoc, so this file sets the pattern
# rather than following one.
#
# Dependabot understands the SHA form and rewrites the trailing version comment
# together with the pin, so the comment cannot drift away from the SHA it
# describes. That is what keeps "which exact code ran in our CI" answerable from
# the repository, which the SBOM and certification work needs on its own.
#
# Two things this does not fix. It reports drift, not silence: a workflow that
# never triggers rots unnoticed no matter what is pinned in it, and the trigger
# fixes in ci_cortex_m.yml and regression_test.yml are the cure for that. And it
# does nothing at all until this file reaches the default branch -- see the note
# on target-branch below.
#
# There is no entry for any other ecosystem, and that is a decision rather than
# an oversight: the project forbids external dependencies, there are no
# submodules, and the one pinned tool -- gcovr in scripts/install.sh -- lives in
# a shell script that no Dependabot ecosystem can parse. That pin moves by hand.
updates:
- package-ecosystem: "github-actions"
# "/" is the only accepted value for this ecosystem; it covers
# .github/workflows and .github/actions. The five reusable-workflow
# references in regression_test.yml are local paths
# (./.github/workflows/regression_template.yml) and are correctly left
# alone -- they carry no version to move.
directory: "/"
schedule:
interval: "weekly"
day: "monday"
time: "06:00"
timezone: "Etc/UTC"
# Dependabot reads this file from the repository's DEFAULT branch, which is
# master. But master is deliberately kept behind dev, and pull requests
# belong on dev, where the regression suites gate them. target-branch sends
# the pull requests to dev and makes Dependabot read the workflows it is
# updating from dev as well.
#
# The consequence to plan for: landing this file on dev arms it, it does not
# fire it. Nothing happens until a release merge carries it to master.
#
# Setting target-branch also opts out of Dependabot *security* updates,
# which only ever run against the default branch. For this ecosystem the
# cost is small -- an action advisory arrives as an ordinary version bump on
# the weekly run -- but it is a real trade and not a detail to rediscover
# later.
target-branch: "dev"
groups:
# Patch and minor arrive together in one pull request: they are the
# routine traffic, and reviewing them one at a time is how an update queue
# starts being ignored, which is the failure mode this file exists to
# prevent. Majors stay ungrouped, one pull request each, because every
# breaking change this repository has met in an action set has been a
# major -- download-artifact v8 defaulting digest-mismatch to error, and
# upload-artifact v6 requiring runner 2.327.1 or newer, are both from the
# last catch-up.
actions-minor-and-patch:
patterns:
- "*"
update-types:
- "minor"
- "patch"
# Nine distinct third-party and first-party actions are in use. Dependabot's
# default limit of five would hold majors back with nothing saying that it
# had; ten leaves room for a wave without becoming a silent cap.
open-pull-requests-limit: 10
labels:
- "dependencies"
# Reviewers are not listed here. .github/CODEOWNERS already routes every
# path to @eclipse-threadx/admins and Dependabot honours it.
#
# Commit subjects are left at Dependabot's own "Bump x from a to b" wording.
# The project asks for a past-tense subject and still gets one: these pull
# requests are squash-merged, and the subject is set at that point.
|
