From 697fff84e4849a40a4bb0ade81e3ae9b2702b4aa Mon Sep 17 00:00:00 2001
From: Matthias Vogel <m.vogel@andersundsehr.com>
Date: Wed, 11 Nov 2026 06:48:44 +0000
Subject: [PATCH] [TASK] Configure Dependabot for ci/ and tests/serverspec/

Until now Dependabot only opened security updates, one pull request per
package, so the lock files of the PHP tools in ci/ and of the serverspec
gems aged between advisories.

.github/dependabot.yml adds monthly version updates for both
directories: one pull request per directory with all minor and patch
updates, also of the packages the listed ones depend on, and one per
new major version. A release is only proposed after seven days. The
commit messages start with [TASK].

The GitHub Actions in .github/workflows/build.yaml and the base images
of the Dockerfiles are left out: both files are generated, so an update
by Dependabot would fail the check of the generated files.
CONTRIBUTING.md names where the action versions are.
---
 .github/dependabot.yml | 46 ++++++++++++++++++++++++++++++++++++++++++
 CONTRIBUTING.md        |  3 +++
 2 files changed, 49 insertions(+)
 create mode 100644 .github/dependabot.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 000000000..4d9548bcc
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,46 @@
+# Once a month, one pull request per directory with all minor and patch updates,
+# also of the packages that the listed ones depend on; a new major version gets
+# a pull request of its own. Security updates come as soon as an advisory is
+# published.
+#
+# Not covered, because the files are generated:
+# - the GitHub Actions in .github/workflows/build.yaml; their versions are in
+#   ci/src/GithubJobBuilder.php
+# - the base images in docker/*/*/Dockerfile; the nightly build pulls them anew
+version: 2
+updates:
+  - package-ecosystem: composer
+    directory: /ci
+    schedule:
+      interval: monthly
+    allow:
+      - dependency-type: all
+    cooldown:
+      default-days: 7
+    commit-message:
+      prefix: '[TASK]'
+    groups:
+      ci:
+        patterns:
+          - '*'
+        update-types:
+          - minor
+          - patch
+
+  - package-ecosystem: bundler
+    directory: /tests/serverspec
+    schedule:
+      interval: monthly
+    allow:
+      - dependency-type: all
+    cooldown:
+      default-days: 7
+    commit-message:
+      prefix: '[TASK]'
+    groups:
+      serverspec:
+        patterns:
+          - '*'
+        update-types:
+          - minor
+          - patch
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index d24df642a..b8fb814ff 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -47,6 +47,9 @@ It installs the PHP tools of `ci/` and runs GrumPHP as your user. `make test` ru
 
 The CI job "Check ci/" runs the same checks. No image build waits for it.
 
+Dependabot proposes updates of the PHP packages in `ci/` and of the gems of the serverspec tests in `tests/serverspec/` once a month: one pull request per directory with all minor and patch updates, and one for each new major version.
+It does not update the actions in `.github/workflows/build.yaml`, because that file is generated; their versions are in `ci/src/GithubJobBuilder.php`.
+
 GitHub Actions builds every image independently and runs the serverspec and structure tests
 defined for it before pushing it to Docker Hub. The CI also uses `ghcr.io/webdevops/`, but only
 internally; pull the images from Docker Hub.