From d2c8fcb51d5ae0bd9ca338ebae9f0c13c14496b1 Mon Sep 17 00:00:00 2001 From: Brady Holt Date: Tue, 11 Aug 2026 10:00:35 -0500 Subject: [PATCH 1/2] Configure Dependabot version updates Adds a dependabot.yml enabling weekly version updates with a 7-day cooldown, matching what we run in evergreen. Cooldown applies to version updates only, so security updates still land immediately. Reviewers come from CODEOWNERS since Dependabot's reviewers option was retired in favor of code owners. The owned paths are limited to the files Dependabot touches so unrelated PRs aren't gated. --- .github/CODEOWNERS | 10 ++++++++++ .github/dependabot.yml | 22 ++++++++++++++++++++++ 2 files changed, 32 insertions(+) create mode 100644 .github/CODEOWNERS create mode 100644 .github/dependabot.yml diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS new file mode 100644 index 0000000..a0e3c87 --- /dev/null +++ b/.github/CODEOWNERS @@ -0,0 +1,10 @@ +# See https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners#codeowners-syntax +# +# Order is important; the last matching pattern takes the most precedence. + +# Paths that Dependabot PRs can touch +/pyproject.toml @ynab/full-stack +/poetry.lock @ynab/full-stack +/requirements.txt @ynab/full-stack +/test-requirements.txt @ynab/full-stack +/.github/ @ynab/full-stack diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..f73ee00 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,22 @@ +# Documentation on this file: https://docs.github.com/en/code-security/dependabot/working-with-dependabot/dependabot-options-reference +# +# Reviewers are assigned via .github/CODEOWNERS (the `reviewers` option was +# retired by GitHub in favor of code owners). + +version: 2 +updates: + # Covers pyproject.toml/poetry.lock, requirements.txt, and test-requirements.txt + - package-ecosystem: "pip" + directory: "/" + schedule: + interval: "weekly" + open-pull-requests-limit: 3 + cooldown: + default-days: 7 + - package-ecosystem: "github-actions" + directory: "/" + schedule: + interval: "weekly" + open-pull-requests-limit: 3 + cooldown: + default-days: 7 From d2bb9373379aa72bf27f731994d7fd12352a1b70 Mon Sep 17 00:00:00 2001 From: Brady Holt Date: Tue, 11 Aug 2026 10:09:29 -0500 Subject: [PATCH 2/2] Remove unnecessary comment --- .github/CODEOWNERS | 2 -- 1 file changed, 2 deletions(-) diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS index a0e3c87..5f09abb 100644 --- a/.github/CODEOWNERS +++ b/.github/CODEOWNERS @@ -1,6 +1,4 @@ # See https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners#codeowners-syntax -# -# Order is important; the last matching pattern takes the most precedence. # Paths that Dependabot PRs can touch /pyproject.toml @ynab/full-stack