version: 2 updates: - package-ecosystem: "github-actions" directory: "/" schedule: interval: "weekly" open-pull-requests-limit: 3 groups: actions: patterns: - "*" ignore: # git-town/action v1.3.x crashes on cyclic PR graphs (self-loop main->main # fork PRs) via its topological-sort visualization. Pinned to v1.2.1 in # git-town.yml; block v1.3.x until upstream tolerates cyclic edges. - dependency-name: "git-town/action" update-types: - "version-update:semver-minor" - "version-update:semver-major" - package-ecosystem: "gomod" directories: - "/" schedule: interval: "weekly" open-pull-requests-limit: 15 groups: golang-x-packages: patterns: - "golang.org/x/*" aws-sdk: patterns: - "github.com/aws/aws-sdk-go-v2/*" pion: patterns: - "github.com/pion/*" gorm: patterns: - "gorm.io/*" otel: patterns: - "go.opentelemetry.io/*" testcontainers: patterns: - "github.com/testcontainers/testcontainers-go/*" wireguard: patterns: - "golang.zx2c4.com/wireguard*" # Base images of the source-build Dockerfiles, pinned by digest (Chainguard # publishes only :latest for free). Dockerfile.release files feed goreleaser # and keep the published images as they are, so their bases are left alone. - package-ecosystem: "docker" directories: - "/upload-server" schedule: interval: "weekly" open-pull-requests-limit: 3 groups: base-images: patterns: - "*" ignore: - dependency-name: "gcr.io/distroless/base" # Go minor and major versions move with the rest of the repository; # patch releases and new digests of the pinned tag still come through. - dependency-name: "golang" update-types: - "version-update:semver-minor" - "version-update:semver-major"