# Dependabot configuration for supply-chain hygiene.
# Docs: https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
#
# Notes:
# - Dependabot's `npm` ecosystem reads root package.json + the pnpm-lock.yaml.
#   Workspace packages under apps/* and packages/* are covered transitively via
#   the root lockfile, so a single `directory: "/"` entry is sufficient.
# - assignees/reviewers are intentionally left empty so each fork/clone can
#   wire them up via repo-level settings without editing this file.
version: 2
updates:
  - package-ecosystem: npm
    directory: "/"
    schedule:
      interval: weekly
    open-pull-requests-limit: 10
    commit-message:
      prefix: "chore(deps):"
    labels:
      - dependencies
    assignees: []
    reviewers: []
    groups:
      ai-providers:
        patterns:
          - "@mistralai/*"
          - "mistralai"
          - "@scaleway/*"
          - "scaleway"
          - "@scaleway-sdk/*"
          - "aleph-alpha*"
          - "@aleph-alpha/*"
      react-stack:
        patterns:
          - "react"
          - "react-dom"
          - "react-router"
          - "@react-router/*"
          - "vite"
          - "@vitejs/*"
      test-tooling:
        patterns:
          - "vitest"
          - "@vitest/*"
          - "@testing-library/*"
      lint-tooling:
        patterns:
          - "eslint"
          - "eslint-*"
          - "@eslint/*"
          - "@typescript-eslint/*"

  - package-ecosystem: github-actions
    directory: "/"
    schedule:
      interval: weekly
    open-pull-requests-limit: 10
    commit-message:
      prefix: "chore(deps):"
    labels:
      - dependencies
    assignees: []
    reviewers: []

  - package-ecosystem: docker
    directory: "/"
    schedule:
      interval: monthly
    open-pull-requests-limit: 10
    commit-message:
      prefix: "chore(deps):"
    labels:
      - dependencies
    assignees: []
    reviewers: []