dependabot.yml

# See the documentation for all configuration options https://help.github.com/github/administering-a-repository/configuration-options-for-dependency-updates

version: 2
updates:
  - package-ecosystem: 'github-actions'
    directory: '/'
    schedule:
      interval: 'weekly'
    commit-message:
      prefix: "chore(deps): "

  - package-ecosystem: 'npm'
    directory: '/'
    schedule:
      interval: 'weekly'
      # somewhat arbitrary, this is to spread Dependabot PRs throughout the week to avoid Monday overload
      day: "wednesday"
    commit-message:
      prefix: "chore(deps): "
    # force the lockfile and package.json to be updated
    versioning-strategy: increase

    # Users of `@guardian/cdk` must be on the exact version of these dependencies.
    # Any update to them in `package.json` should create a new major version of `@guardian/cdk`.
    # New versions of these dependencies are published quite often. In the case of `constructs`, see https://github.com/aws/constructs/issues/970.
    # In order to reduce the frequency of new major versions of `@guardian/cdk`, we'll manage these dependencies ourselves via `script/update-aws-cdk`.
    ignore:
      - dependency-name: "aws-cdk"
      - dependency-name: "aws-cdk-lib"
      - dependency-name: "constructs"

  - package-ecosystem: 'npm'
    directory: '/tools/integration-test'
    schedule:
      interval: 'weekly'
      # somewhat arbitrary, this is to spread Dependabot PRs throughout the week to avoid Monday overload
      day: "wednesday"
    commit-message:
      prefix: "chore(deps): "
    # The version of AWS CDK libraries must match those from @guardian/cdk.
    # We'd never be able to update them here independently, so just ignore them.
    ignore:
      - dependency-name: "aws-cdk"
      - dependency-name: "aws-cdk-lib"
      - dependency-name: "constructs"