From ae12772b48c451ba6c5ab636ed33ae83c69a5011 Mon Sep 17 00:00:00 2001 From: Imani Manyara Date: Mon, 12 Oct 2026 16:26:44 -0400 Subject: [PATCH] Run Dependabot weekly with minor and patch updates grouped The org policy is weekly, Monday 06:00 America/New_York, one grouped pull request per ecosystem for minor and patch. Daily schedules opened a pull request and a CI run per dependency per day. --- .github/dependabot.yml | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index d6fd0fc..7b70348 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -4,13 +4,26 @@ updates: - package-ecosystem: "composer" directory: "/" schedule: - interval: "daily" + interval: "weekly" + day: "monday" + time: "06:00" + timezone: "America/New_York" + groups: + composer-minor-and-patch: + patterns: + - '*' + update-types: + - minor + - patch # Maintain dependencies for GitHub Actions - package-ecosystem: "github-actions" directory: "/" schedule: - interval: "daily" + interval: "weekly" + day: "monday" + time: "06:00" + timezone: "America/New_York" groups: # codeql-action/init and /analyze MUST move together: CodeQL fails with # "Loaded a configuration file for version X, but running version Y" when