mirror of
https://github.com/greenart7c3/Amber.git
synced 2026-10-30 14:57:34 +00:00
greenart7c3
9b391f3044
Now that every action is pinned to a commit SHA, nothing updates them. A weekly, grouped github-actions check proposes the new SHA and tag. Gradle is left out: each bump must regenerate verification-metadata.xml, which Dependabot cannot do.
17 lines
536 B
YAML
17 lines
536 B
YAML
# The workflows pin every action to a commit SHA (with its tag as a comment),
|
|
# so they never update on their own: Dependabot proposes the new SHA and tag.
|
|
# Gradle dependencies are left out on purpose: every bump has to regenerate
|
|
# gradle/verification-metadata.xml (see AGENTS.md), which Dependabot can't do.
|
|
version: 2
|
|
updates:
|
|
- package-ecosystem: "github-actions"
|
|
directory: "/"
|
|
schedule:
|
|
interval: "weekly"
|
|
groups:
|
|
github-actions:
|
|
patterns:
|
|
- "*"
|
|
commit-message:
|
|
prefix: "ci"
|