# Dependabot configuration

version: 2

updates:

  - package-ecosystem: gomod
    directories:
      - "/"
      - "/.make"
    cooldown:
      default-days: 7
    schedule:
      interval: "weekly"
      day: "friday"
    open-pull-requests-limit: 10
    labels:
      - "dependencies"
    ignore:
      - dependency-name: "github.com/aquasecurity/go-pep440-version"
      - dependency-name: "github.com/aquasecurity/go-version"
      - dependency-name: "github.com/knqyf263/go-apk-version"
      - dependency-name: "github.com/knqyf263/go-deb-version"
      # v1 changed SlicesAsSets hashing, which changes every artifact ID syft produces
      - dependency-name: "github.com/gohugoio/hashstructure"
        update-types: ["version-update:semver-major"]

  - package-ecosystem: "github-actions"
    directories:
      - "/"
      - "/.github/actions/*"
    cooldown:
      default-days: 7
    schedule:
      interval: "weekly"
      day: "friday"
    open-pull-requests-limit: 10
    labels:
      - "dependencies"