mirror of
https://github.com/iptv-org/iptv
synced 2026-10-21 18:46:20 -04:00
jogerj
4ed2a1f0af
Pin every action reference to the full commit SHA that its current tag already resolves to, with the version kept in a trailing comment. No action changes version as a result of this commit -- including actions/setup-node in validate_issue.yml, which stays on v4.4.0 rather than being lifted to the v6 used by the other workflows. Version bumps are left to Dependabot so they arrive as reviewable PRs. Add .github/dependabot.yml for the github-actions ecosystem: weekly on Monday, minor/patch grouped into a single PR (majors always get their own), "ci" commit prefix. tibdex/github-app-token is ignored to match iptv-org-database; it is archived upstream, so replacing it should be a considered migration rather than an automated bump.
18 lines
558 B
YAML
18 lines
558 B
YAML
version: 2
|
|
updates:
|
|
- package-ecosystem: "github-actions"
|
|
directory: "/"
|
|
schedule:
|
|
interval: "weekly"
|
|
day: "monday"
|
|
groups:
|
|
actions-minor-patch:
|
|
update-types: ["minor", "patch"]
|
|
commit-message:
|
|
prefix: "ci"
|
|
ignore:
|
|
# Held deliberately, matching iptv-org-database. The action is archived
|
|
# upstream, so moving off it should be a considered migration to
|
|
# actions/create-github-app-token, not an automated version bump.
|
|
- dependency-name: "tibdex/github-app-token"
|