From 1cd263e207ca5b2f51fb0e3df3e3c6a989f0a140 Mon Sep 17 00:00:00 2001
From: Maurice Schmicking <maurice.schmicking@gmail.com>
Date: Sat, 8 Aug 2026 00:07:07 +0200
Subject: [PATCH] ci: add dependabot for npm and github actions

Weekly updates for the npm dependency and the pinned action versions.

Titles are configured as 'chore(deps): ...' rather than Dependabot's default
'Bump x from 1 to 2'. The default carries no conventional-commit type, so
pr-title.yml would fail every Dependabot pull request and make it unmergeable.

Minor and patch bumps are grouped into one pull request per ecosystem to keep
the noise down. Majors are left ungrouped: node-addon-api is the binding layer,
and a major there can break compilation on one platform and not another, so it
deserves its own run of the full matrix.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 .github/dependabot.yml | 61 ++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 61 insertions(+)
 create mode 100644 .github/dependabot.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..5dd5838
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,61 @@
+version: 2
+
+# NOTE: this file only takes effect once it is on the default branch (master).
+#
+# Titles matter here. pr-title.yml requires Conventional Commits, and Dependabot's
+# default title ("Bump x from 1 to 2") has no type, so every Dependabot pull request
+# would fail that check and become unmergeable. The commit-message settings below
+# produce "chore(deps): bump x from 1 to 2" instead — 'chore' is an allowed type and
+# 'deps' an allowed scope in pr-title.yml. Keep the two files in step.
+#
+# The vendored Lua and LuaFileSystem sources under vendor/ are deliberately not
+# covered: Dependabot has no ecosystem for copied-in C source, and Lua 5.1.5 is
+# frozen upstream. Updating those stays a manual, deliberate act.
+
+updates:
+  - package-ecosystem: npm
+    directory: "/"
+    schedule:
+      interval: weekly
+      day: monday
+      time: "06:00"
+      timezone: Europe/Berlin
+    open-pull-requests-limit: 5
+    commit-message:
+      prefix: chore
+      # Adds the (deps) / (deps-dev) scope, giving "chore(deps): ...".
+      include: scope
+    groups:
+      # One pull request a week for the routine bumps, so the noise stays low on a
+      # package with a single runtime dependency. Majors are deliberately excluded:
+      # node-addon-api is the C++ binding layer, and a major there can break
+      # compilation on some platforms and not others, which deserves its own pull
+      # request and its own CI matrix run to look at.
+      npm-minor-and-patch:
+        patterns:
+          - "*"
+        update-types:
+          - minor
+          - patch
+
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: weekly
+      day: monday
+      time: "06:00"
+      timezone: Europe/Berlin
+    open-pull-requests-limit: 5
+    commit-message:
+      prefix: chore
+      include: scope
+    groups:
+      # Action bumps are almost always safe and arrive in batches; grouping them
+      # keeps five separate workflow files from producing five separate pull
+      # requests for the same version bump.
+      actions-minor-and-patch:
+        patterns:
+          - "*"
+        update-types:
+          - minor
+          - patch