version: 2
updates:
  # Fifteen Go modules, each with its own go.mod and no workspace tying them
  # together, so a single entry cannot reach them: `directories` with a glob
  # is what covers the hack/ fixtures without listing every one by hand.
  # Grouped, because the alternative is what prompted this file -- one
  # advisory in a shared dependency opened nine separate alerts.
  - package-ecosystem: gomod
    directories:
      - "/api"
      - "/ingest"
      - "/alerting"
      - "/enterprise"
      - "/proto"
      - "/cli"
      - "/terraform"
      - "/deploy/operator"
      - "/hack/*"
    schedule:
      interval: weekly
      day: tuesday
      time: "09:00"
      timezone: Etc/UTC
    open-pull-requests-limit: 5
    groups:
      # Majors stay out: a Go major is an import path change, never a bump.
      go-minor-and-patch:
        update-types:
          - minor
          - patch
  - package-ecosystem: cargo
    directories:
      - "/agent"
      - "/search"
    schedule:
      interval: weekly
      day: tuesday
      time: "09:00"
      timezone: Etc/UTC
    groups:
      cargo-minor-and-patch:
        update-types:
          - minor
          - patch
  - package-ecosystem: npm
    directory: "/web"
    schedule:
      interval: weekly
      day: tuesday
      time: "09:00"
      timezone: Etc/UTC
    groups:
      npm-minor-and-patch:
        update-types:
          - minor
          - patch
  - package-ecosystem: github-actions
    directory: "/"
    schedule:
      interval: weekly
      day: tuesday
      time: "09:00"
      timezone: Etc/UTC
    groups:
      actions:
        patterns:
          - "*"