mirror of
https://github.com/anchore/syft.git
synced 2026-10-30 22:12:28 +01:00
Alex Goodman
f8ffa7382e
The go-make module and its action need to move in lockstep, but dependabot bumps them in separate PRs that drift apart. Automation now bumps both together, so dependabot ignores go-make in both ecosystems. Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
45 lines
1.2 KiB
YAML
45 lines
1.2 KiB
YAML
# Dependabot configuration
|
|
|
|
version: 2
|
|
|
|
updates:
|
|
|
|
- package-ecosystem: gomod
|
|
directories:
|
|
- "/"
|
|
- "/.make"
|
|
cooldown:
|
|
default-days: 7
|
|
schedule:
|
|
interval: "weekly"
|
|
day: "friday"
|
|
open-pull-requests-limit: 10
|
|
labels:
|
|
- "dependencies"
|
|
ignore:
|
|
- dependency-name: "github.com/aquasecurity/go-pep440-version"
|
|
- dependency-name: "github.com/aquasecurity/go-version"
|
|
- dependency-name: "github.com/knqyf263/go-apk-version"
|
|
- dependency-name: "github.com/knqyf263/go-deb-version"
|
|
# v1 changed SlicesAsSets hashing, which changes every artifact ID syft produces
|
|
- dependency-name: "github.com/gohugoio/hashstructure"
|
|
update-types: ["version-update:semver-major"]
|
|
# go-make module and action refs are bumped together by automation
|
|
- dependency-name: "github.com/anchore/go-make"
|
|
|
|
- package-ecosystem: "github-actions"
|
|
directories:
|
|
- "/"
|
|
- "/.github/actions/*"
|
|
cooldown:
|
|
default-days: 7
|
|
schedule:
|
|
interval: "weekly"
|
|
day: "friday"
|
|
open-pull-requests-limit: 10
|
|
labels:
|
|
- "dependencies"
|
|
ignore:
|
|
# go-make module and action refs are bumped together by automation
|
|
- dependency-name: "anchore/go-make/*"
|