teleport/.github/dependabot.yml

version: 2
updates:
  - package-ecosystem: gomod
    directory: '/'
    schedule:
      interval: cron
      cronjob: '0 9 1 6,12 *' # On December 1 and June 1 at 9am UTC
    cooldown:
      default-days: 2
    ignore:
      # Forked/replaced dependencies
      - dependency-name: github.com/alecthomas/kingpin/v2
      - dependency-name: github.com/go-mysql-org/go-mysql
      - dependency-name: github.com/gogo/protobuf
      - dependency-name: github.com/julienschmidt/httprouter
      - dependency-name: github.com/keys-pub/go-libfido2
      - dependency-name: github.com/microsoft/go-mssqldb
      - dependency-name: github.com/redis/go-redis/v9
      - dependency-name: github.com/vulcand/predicate
      - dependency-name: github.com/hinshun/vt10x
    open-pull-requests-limit: 20
    groups:
      go:
        update-types:
          - 'minor'
          - 'patch'
    labels:
      - 'dependencies'
      - 'go'
      - 'no-changelog'

  - package-ecosystem: gomod
    directory: '/api'
    schedule:
      interval: cron
      cronjob: '0 9 1 6,12 *' # On December 1 and June 1 at 9am UTC
    cooldown:
      default-days: 2
    open-pull-requests-limit: 20
    groups:
      go:
        update-types:
          - 'minor'
          - 'patch'
    labels:
      - 'dependencies'
      - 'go'
      - 'no-changelog'

  - package-ecosystem: gomod
    directory: '/assets/aws'
    schedule:
      interval: cron
      cronjob: '0 9 1 6,12 *' # On December 1 and June 1 at 9am UTC
    cooldown:
      default-days: 2
    ignore:
      # Forked/replaced dependencies
      - dependency-name: github.com/alecthomas/kingpin/v2
    open-pull-requests-limit: 20
    groups:
      go:
        update-types:
          - 'minor'
          - 'patch'
    labels:
      - 'dependencies'
      - 'go'
      - 'no-changelog'

  - package-ecosystem: gomod
    directory: '/assets/backport'
    schedule:
      interval: cron
      cronjob: '0 9 1 6,12 *' # On December 1 and June 1 at 9am UTC
    cooldown:
      default-days: 2
    open-pull-requests-limit: 20
    groups:
      go:
        update-types:
          - 'minor'
          - 'patch'
    labels:
      - 'dependencies'
      - 'go'
      - 'no-changelog'

  - package-ecosystem: gomod
    directory: '/build.assets/tooling'
    schedule:
      interval: cron
      cronjob: '0 9 1 6,12 *' # On December 1 and June 1 at 9am UTC
    cooldown:
      default-days: 2
    ignore:
      # Forked/replaced dependencies
      - dependency-name: github.com/alecthomas/kingpin/v2
    open-pull-requests-limit: 20
    groups:
      go:
        update-types:
          - 'minor'
          - 'patch'
    labels:
      - 'dependencies'
      - 'go'
      - 'no-changelog'

  - package-ecosystem: gomod
    directory: '/integrations/terraform'
    schedule:
      interval: cron
      cronjob: '0 9 1 6,12 *' # On December 1 and June 1 at 9am UTC
    cooldown:
      default-days: 2
    ignore:
      # breaks compatibility
      - dependency-name: github.com/hashicorp/terraform-plugin-framework
      - dependency-name: github.com/hashicorp/terraform-plugin-go
      - dependency-name: github.com/hashicorp/terraform-plugin-sdk/v2
    open-pull-requests-limit: 20
    groups:
      go:
        update-types:
          - 'minor'
          - 'patch'
    labels:
      - 'dependencies'
      - 'go'
      - 'no-changelog'

  - package-ecosystem: gomod
    directory: '/integrations/terraform-mwi'
    schedule:
      interval: cron
      cronjob: '0 9 1 6,12 *' # On December 1 and June 1 at 9am UTC
    cooldown:
      default-days: 2
    open-pull-requests-limit: 20
    groups:
      go:
        update-types:
          - 'minor'
          - 'patch'
    labels:
      - 'dependencies'
      - 'go'
      - 'no-changelog'

  - package-ecosystem: gomod
    directory: '/integrations/event-handler'
    schedule:
      interval: cron
      cronjob: '0 9 1 6,12 *' # On December 1 and June 1 at 9am UTC
    cooldown:
      default-days: 2
    open-pull-requests-limit: 20
    groups:
      go:
        update-types:
          - 'minor'
          - 'patch'
    labels:
      - 'dependencies'
      - 'go'
      - 'no-changelog'

  # go tools:
  # Tool configs are mostly the same, but dependabot has no way to reuse common configs:
  # https://github.com/dependabot/dependabot-core/issues/1582
  - package-ecosystem: gomod
    directory: '/build.assets/tools/gci'
    schedule:
      interval: monthly
    cooldown:
      default-days: 2
    open-pull-requests-limit: 3
    groups:
      go:
        update-types:
          - 'minor'
          - 'patch'
    labels:
      - 'dependencies'
      - 'go'
      - 'no-changelog'
      - 'backport/branch/v17'
      - 'backport/branch/v18'

  - package-ecosystem: gomod
    directory: '/build.assets/tools/gotestsum'
    schedule:
      interval: monthly
    cooldown:
      default-days: 2
    open-pull-requests-limit: 3
    groups:
      go:
        update-types:
          - 'minor'
          - 'patch'
    labels:
      - 'dependencies'
      - 'go'
      - 'no-changelog'
      - 'backport/branch/v17'
      - 'backport/branch/v18'

  - package-ecosystem: gomod
    directory: '/build.assets/tools/goda'
    schedule:
      interval: monthly
    cooldown:
      default-days: 2
    open-pull-requests-limit: 3
    groups:
      go:
        update-types:
          - 'minor'
          - 'patch'
    labels:
      - 'dependencies'
      - 'go'
      - 'no-changelog'
      - 'backport/branch/v17'
      - 'backport/branch/v18'

  - package-ecosystem: gomod
    directory: '/build.assets/tools/benchstat'
    schedule:
      interval: monthly
    cooldown:
      default-days: 2
    open-pull-requests-limit: 3
    groups:
      go:
        update-types:
          - 'minor'
          - 'patch'
    labels:
      - 'dependencies'
      - 'go'
      - 'no-changelog'
      - 'backport/branch/v17'
      - 'backport/branch/v18'

  - package-ecosystem: cargo
    directory: '/'
    schedule:
      interval: monthly
      day: 'sunday'
      time: '09:00' # 9am UTC
    cooldown:
      default-days: 2
    open-pull-requests-limit: 20
    groups:
      rust:
        update-types:
          - 'minor'
          - 'patch'
    labels:
      - 'dependencies'
      - 'rust'
      - 'no-changelog'

  - package-ecosystem: cargo
    directory: '/lib/srv/desktop/rdp/rdpclient'
    schedule:
      interval: monthly
      day: 'sunday'
      time: '09:00' # 9am UTC
    cooldown:
      default-days: 2
    open-pull-requests-limit: 20
    groups:
      rust:
        update-types:
          - 'minor'
          - 'patch'
    labels:
      - 'dependencies'
      - 'rust'
      - 'no-changelog'

  - package-ecosystem: cargo
    directory: '/tool/fdpass-teleport'
    schedule:
      interval: monthly
      day: 'sunday'
      time: '09:00' # 9am UTC
    cooldown:
      default-days: 2
    open-pull-requests-limit: 20
    groups:
      rust:
        update-types:
          - 'minor'
          - 'patch'
    labels:
      - 'dependencies'
      - 'rust'
      - 'no-changelog'

  - package-ecosystem: cargo
    directory: '/web/packages/shared/libs/ironrdp/Cargo.toml'
    schedule:
      interval: monthly
      day: 'sunday'
      time: '09:00' # 9am UTC
    cooldown:
      default-days: 2
    open-pull-requests-limit: 20
    groups:
      rust:
        update-types:
          - 'minor'
          - 'patch'
    labels:
      - 'dependencies'
      - 'rust'
      - 'no-changelog'

  - package-ecosystem: npm
    directory: '/'
    schedule:
      interval: monthly
      day: 'sunday'
      time: '09:00' # 9am UTC
    cooldown:
      default-days: 2
    labels:
      - 'dependencies'
      - 'ui'
      - 'no-changelog'
    groups:
      # These packages are either directly involved in the process of building Teleport Connect or
      # they make use of native dependencies. Verifying that updating them didn't break anything
      # involves making a tag build.
      electron:
        patterns:
          - 'electron*'
          - node-gyp
          - node-pty
      ui:
        update-types:
          - 'minor'
          - 'patch'
        # Contrary to what the docs say, if a dependency matches more than one rule, it is _not_
        # included in the first group that it matches. Other groups must be explicitly excluded,
        # otherwise Dependabot is going to perform minor Electron updates in the UI group.
        # https://docs.github.com/en/code-security/dependabot/working-with-dependabot/dependabot-options-reference#groups--
        exclude-patterns:
          - 'electron*'
          - node-gyp
          - node-pty
    open-pull-requests-limit: 20
  - package-ecosystem: github-actions
    directory: '/.github/workflows'
    schedule:
      interval: monthly
      day: monday
      time: '09:00'
      timezone: 'America/Los_Angeles'
    cooldown:
      default-days: 2
    labels:
      - 'dependencies'
      - 'github-actions'
      - 'no-changelog'

  - package-ecosystem: github-actions
    directory: '/.github/actions'
    schedule:
      interval: monthly
      day: monday
      time: '09:00'
      timezone: 'America/Los_Angeles'
    cooldown:
      default-days: 2
    labels:
      - 'dependencies'
      - 'github-actions'
      - 'no-changelog'