diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 996a5c7..62b61e7 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -1,52 +1,33 @@ +# Version updates are monthly and grouped into one PR per ecosystem. +# Security updates are separate and run whenever an advisory is published. version: 2 - -# Dependency updates land on `dev`, never on `main`. -# -# `main` here is a RELEASE POINTER that freemkv's release-orchestrate.yml -# moves to each tag. A bot commit on it would put work there that no tag -# contains, which is exactly the state that aborted the 1.6.2 cascade at the -# last step -- so pointing Dependabot at main would recreate that failure on a -# schedule. updates: - - package-ecosystem: cargo - directory: / - target-branch: dev - schedule: - interval: weekly - open-pull-requests-limit: 5 - # One PR per week for the routine bumps instead of one per crate. - groups: - minor-and-patch: - update-types: - - minor - - patch - ignore: - # The freemkv crates depend on each other by GIT TAG, re-pinned by - # release-orchestrate.yml in the release commit. A bot bump would fight - # the release cascade and could pin a tag that does not exist yet. - - dependency-name: freemkv-unlock - - dependency-name: libfreemkv - - dependency-name: freemkv-keysources - - dependency-name: freemkv-i18n - - dependency-name: freemkv-engine - - - package-ecosystem: github-actions - directory: / - target-branch: dev - schedule: - interval: weekly - open-pull-requests-limit: 5 - groups: - actions: - update-types: - - minor - - patch - ignore: - # Versioned by the Rust release it installs; CI picks the toolchain via - # `toolchain:` on @master/@stable. Dependabot proposes Rust versions that - # do not exist. Toolchain bumps are a deliberate all-repo change. - - dependency-name: dtolnay/rust-toolchain - # The org's own reusable workflows/actions. @v1 and @v2 are independent - # moving tags (v2 is only the comment guard), not semver releases: a - # "bump" from v1 to v2 would move a caller onto an OLDER guard. - - dependency-name: "freemkv/.github*" +- package-ecosystem: cargo + directory: / + target-branch: dev + schedule: + interval: monthly + open-pull-requests-limit: 5 + groups: + all: + patterns: + - '*' + ignore: + - dependency-name: freemkv-unlock + - dependency-name: libfreemkv + - dependency-name: freemkv-keysources + - dependency-name: freemkv-i18n + - dependency-name: freemkv-engine +- package-ecosystem: github-actions + directory: / + target-branch: dev + schedule: + interval: monthly + open-pull-requests-limit: 5 + groups: + all: + patterns: + - '*' + ignore: + - dependency-name: dtolnay/rust-toolchain + - dependency-name: freemkv/.github* diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index e71d3d6..059978d 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -53,7 +53,7 @@ jobs: outputs: v: ${{ steps.msrv.outputs.v }} steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@v7 - id: msrv shell: bash run: echo "v=$(grep -m1 '^rust-version' Cargo.toml | sed -E 's/.*\"([^\"]+)\".*/\1/')" >> "$GITHUB_OUTPUT" @@ -67,7 +67,7 @@ jobs: changelog: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@v7 - name: Require a CHANGELOG entry for the crate version on main shell: bash run: | @@ -88,7 +88,7 @@ jobs: needs: resolve-msrv runs-on: ubuntu-latest steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@v7 with: path: freemkv-keysources - uses: freemkv/.github/.github/actions/checkout-siblings@v1 @@ -119,7 +119,7 @@ jobs: needs: resolve-msrv runs-on: ubuntu-latest steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@v7 with: path: freemkv-keysources - uses: freemkv/.github/.github/actions/checkout-siblings@v1 @@ -143,7 +143,7 @@ jobs: deny: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@v7 with: path: freemkv-keysources - uses: freemkv/.github/.github/actions/checkout-siblings@v1 @@ -176,7 +176,7 @@ jobs: if: github.ref_name == 'qa' || github.ref_name == 'main' runs-on: macos-latest steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@v7 with: path: freemkv-keysources - uses: freemkv/.github/.github/actions/checkout-siblings@v1 @@ -203,7 +203,7 @@ jobs: needs: resolve-msrv runs-on: ubuntu-latest steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@v7 with: path: freemkv-keysources - uses: freemkv/.github/.github/actions/checkout-siblings@v1 @@ -244,7 +244,7 @@ jobs: if: github.ref_name == 'qa' || github.ref_name == 'main' runs-on: windows-latest steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@v7 with: path: freemkv-keysources - uses: freemkv/.github/.github/actions/checkout-siblings@v1 diff --git a/.github/workflows/qa.yml b/.github/workflows/qa.yml index 14ca3da..3ce231a 100644 --- a/.github/workflows/qa.yml +++ b/.github/workflows/qa.yml @@ -37,7 +37,7 @@ jobs: outputs: v: ${{ steps.msrv.outputs.v }} steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@v7 - id: msrv shell: bash run: echo "v=$(grep -m1 '^rust-version' Cargo.toml | sed -E 's/.*\"([^\"]+)\".*/\1/')" >> "$GITHUB_OUTPUT" @@ -61,7 +61,7 @@ jobs: permissions: contents: write steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@v7 with: fetch-depth: 0 - name: Stamp the next rc @@ -90,7 +90,7 @@ jobs: os: ['ubuntu-latest', 'macos-latest'] runs-on: ${{ matrix.os }} steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@v7 with: path: freemkv-keysources - uses: freemkv/.github/.github/actions/checkout-siblings@v1 @@ -113,7 +113,7 @@ jobs: cross-lint: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@v7 with: path: freemkv-keysources - uses: freemkv/.github/.github/actions/checkout-siblings@v1 @@ -139,7 +139,7 @@ jobs: needs: resolve-msrv runs-on: windows-latest steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@v7 with: path: freemkv-keysources - uses: freemkv/.github/.github/actions/checkout-siblings@v1 diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index f5a7883..c9802eb 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -17,7 +17,7 @@ jobs: verify: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@v7 - name: Verify Cargo.toml version matches tag run: | CARGO_VER="v$(grep '^version' Cargo.toml | head -1 | sed 's/.*"\(.*\)"/\1/')" @@ -41,7 +41,7 @@ jobs: needs: verify runs-on: ubuntu-latest steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@v7 - id: msrv shell: bash run: echo "v=$(grep -m1 '^rust-version' Cargo.toml | sed -E 's/.*\"([^\"]+)\".*/\1/')" >> "$GITHUB_OUTPUT" @@ -62,7 +62,7 @@ jobs: needs: verify runs-on: ubuntu-latest steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@v7 - name: Create GitHub Release uses: softprops/action-gh-release@v3 with: