version: 2
# @NOTE(gfanton): we use 0 as pull-request-limit to only enable security update.
# see: https://docs.github.com/en/code-security/dependabot/dependabot-security-updates/configuring-dependabot-security-updates#overriding-the-default-behavior-with-a-configuration-file
updates:
  - package-ecosystem: "npm"
    directory: "/js"
    schedule:
      interval: "daily"
    # Disable version updates for npm dependencies (enable only security update)
    open-pull-requests-limit: 0
    commit-message:
      prefix: "fix"
      include: "scope"
    labels:
      - "security"
      - "t/javascript"
      - "dependencies"

  - package-ecosystem: docker
    directory: "/"
    schedule:
      interval: daily
    # Disable version updates for docker dependencies (enable only security update)
    open-pull-requests-limit: 0
    labels:
      - "security"
      - "t/docker"
      - "dependencies"

  - package-ecosystem: github-actions
    directory: "/"
    schedule:
      interval: daily
    # Disable version updates for github dependencies (enable only security update)
    open-pull-requests-limit: 0
    labels:
      - "security"
      - "t/github-actions"
      - "dependencies"

  - package-ecosystem: gomod
    directory: "/"
    schedule:
      interval: daily
    # Disable version updates for gomod dependencies (enable only security update)
    open-pull-requests-limit: 0
    labels:
      - "security"
      - "t/golang"
      - "dependencies"
