version: 2
updates:
  # Python dependencies
  # Dependabot supports uv version updates, but GitHub currently lists uv
  # security updates as "Not applicable"; daily checks keep uv.lock moving
  # while repo-level Dependabot alerts/security updates cover supported ecosystems.
  - package-ecosystem: "uv"
    directory: "/"
    schedule:
      interval: "daily"
      time: "05:00"
      timezone: "Europe/London"
    cooldown:
      default-days: 3
    open-pull-requests-limit: 10
    groups:
      python-deps:
        patterns: ["*"]
        update-types: ["minor", "patch"]

  # Frontend npm dependencies
  - package-ecosystem: "npm"
    directory: "/src/frontend"
    schedule:
      interval: "weekly"
    cooldown:
      default-days: 3
    open-pull-requests-limit: 10
    groups:
      npm-deps:
        patterns: ["*"]
        update-types: ["minor", "patch"]

  # Dockerfile base image digests. When a tag stays the same, Dependabot titles
  # can only show digest prefixes, so keep the group name explicit.
  - package-ecosystem: "docker"
    directory: "/"
    schedule:
      interval: "weekly"
    cooldown:
      default-days: 3
    open-pull-requests-limit: 5
    groups:
      docker-base-image-digests:
        # Exclude python from the group on purpose. Dependabot's Docker
        # pre-release filter is bypassed for *grouped* updates
        # (dependabot-core#9496), so a grouped python update proposes pre-release
        # tags like python:3.15.0b2 as if they were a normal stable minor bump.
        # node + uv stay grouped into a single digest PR.
        patterns: ["*"]
        exclude-patterns: ["python"]
    ignore:
      # Node.js: block major-version bumps so dependabot never proposes
      # moving from one LTS line to a non-LTS "Current" release (e.g. 24 -> 25).
      # Node LTS is even-numbered only; major bumps should be deliberate.
      - dependency-name: "node"
        update-types: ["version-update:semver-major"]

      # Python: block minor/major bumps. Ungrouping python (above) is NOT enough
      # to keep pre-releases out — dependabot-core#13815 rewrote the Docker
      # pre-release heuristic to catch PEP 440 tags like 3.15.0a2 / 3.5.0b3, but
      # the suffixed real tag still slipped through as PR #1169
      # (python:3.14.6-slim -> python:3.15.0b3-slim). CPython spells
      # pre-releases without a separator, so tag parsing reads 3.15.0b3 as an
      # ordinary version that sorts above 3.14.6.
      #
      # A minor-version ignore blocks it regardless of spelling. Patch bumps
      # (3.14.6 -> 3.14.7) and same-tag digest refreshes still land automatically.
      # Moving the runtime to a new Python minor is a manual, deliberate change:
      # bump the tag here and confirm C-extension wheels (greenlet/gevent) exist
      # for it — a source build against a pre-release ABI boots an app that binds
      # its port but never serves, which wedges e2e for the full 6h job limit.
      - dependency-name: "python"
        update-types:
          ["version-update:semver-major", "version-update:semver-minor"]

  # GitHub Actions
  - package-ecosystem: "github-actions"
    directory: "/"
    schedule:
      interval: "weekly"
    cooldown:
      default-days: 3
    open-pull-requests-limit: 5
    groups:
      gh-actions:
        patterns: ["*"]