From d5a8ad32bc190cbda160c5f658cfd54e7bdb2b18 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Konstantin=20Str=C3=BCmpf?= <k.struempf@icloud.com>
Date: Thu, 6 Aug 2026 11:51:30 +0200
Subject: [PATCH] ci(dependabot): add version update configuration

The repository has no dependency automation, so drift is only caught when
someone notices -- the deleted capacitor-swift-pm branch behind #697 and the
13 npm advisories cleared in #698 are both instances of that.

Configure Dependabot for the four ecosystems it can see: npm (root),
gradle (/android), swift (Package.swift) and github-actions. CocoaPods has
no Dependabot ecosystem, so CapacitorCommunitySqlite.podspec still needs
manual bumps; noted in a comment.

Tuned for low maintenance rather than maximum freshness:

- Weekly schedule, Monday 06:00 UTC, capped at 5 open PRs per ecosystem.
- Grouped so a normal week is a handful of PRs: @capacitor/* together
  (they release in lockstep and CI validates them together), dev
  dependencies together, production dependencies together, all actions/*
  together. Majors outside the Capacitor group stay ungrouped so they get
  their own review.
- A cooldown of 7 days (14 for majors, 3 for patches) so releases that get
  pulled or hotfixed within days never reach a PR.

None of this throttles security updates: those are a separate Dependabot
feature that ignores schedule, cooldown and open-pull-requests-limit, so
advisories still open a PR as soon as a fix ships.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 .github/dependabot.yml | 123 +++++++++++++++++++++++++++++++++++++++++
 1 file changed, 123 insertions(+)
 create mode 100644 .github/dependabot.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 00000000..0a1da6a9
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,123 @@
+# Dependabot configuration.
+#
+# Version updates run once a week, on Monday mornings UTC, and are grouped so a
+# normal week produces a handful of PRs rather than a dozen. Security updates
+# are deliberately not throttled here: they are a separate Dependabot feature
+# that ignores `schedule`, `cooldown` and `open-pull-requests-limit`, so
+# advisories still land as soon as a fix is published.
+#
+# CocoaPods (CapacitorCommunitySqlite.podspec) is not covered — Dependabot has
+# no CocoaPods ecosystem. That manifest still needs manual bumps.
+version: 2
+
+updates:
+  # ---------------------------------------------------------------- npm ----
+  - package-ecosystem: npm
+    directory: "/"
+    schedule:
+      interval: weekly
+      day: monday
+      time: "06:00"
+      timezone: "Etc/UTC"
+    open-pull-requests-limit: 5
+    # Let a release settle before proposing it, so we skip versions that get
+    # pulled or hotfixed within days. Majors wait longer.
+    cooldown:
+      default-days: 7
+      semver-major-days: 14
+      semver-patch-days: 3
+    commit-message:
+      prefix: chore
+      include: scope
+    groups:
+      # The Capacitor packages are released in lockstep and are validated
+      # together by CI, so a split across PRs would just produce a broken
+      # intermediate state.
+      capacitor:
+        patterns:
+          - "@capacitor/*"
+      # Toolchain noise: one PR a week for the whole lot.
+      dev-dependencies:
+        dependency-type: development
+        exclude-patterns:
+          - "@capacitor/*"
+        update-types:
+          - minor
+          - patch
+      production-dependencies:
+        dependency-type: production
+        update-types:
+          - minor
+          - patch
+    # Majors outside the Capacitor group stay ungrouped on purpose — they get
+    # their own PR because they need their own review.
+
+  # ------------------------------------------------------------- gradle ----
+  - package-ecosystem: gradle
+    directory: "/android"
+    schedule:
+      interval: weekly
+      day: monday
+      time: "06:00"
+      timezone: "Etc/UTC"
+    open-pull-requests-limit: 5
+    cooldown:
+      default-days: 7
+      semver-major-days: 14
+      semver-patch-days: 3
+    commit-message:
+      prefix: chore
+      include: scope
+    groups:
+      android-minor-patch:
+        update-types:
+          - minor
+          - patch
+
+  # -------------------------------------------------------------- swift ----
+  # Reads Package.swift. `Package.resolved` is gitignored in this repo, so
+  # Dependabot updates the declared version requirements only — which is
+  # exactly the class of drift that produced #697.
+  - package-ecosystem: swift
+    directory: "/"
+    schedule:
+      interval: weekly
+      day: monday
+      time: "06:00"
+      timezone: "Etc/UTC"
+    open-pull-requests-limit: 5
+    cooldown:
+      default-days: 7
+      semver-major-days: 14
+      semver-patch-days: 3
+    commit-message:
+      prefix: chore
+      include: scope
+    groups:
+      swift-minor-patch:
+        update-types:
+          - minor
+          - patch
+
+  # ----------------------------------------------------- github-actions ----
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: weekly
+      day: monday
+      time: "06:00"
+      timezone: "Etc/UTC"
+    open-pull-requests-limit: 5
+    cooldown:
+      default-days: 7
+    commit-message:
+      prefix: ci
+      include: scope
+    groups:
+      # actions/* move together often enough that separate PRs are pure noise.
+      github-actions:
+        patterns:
+          - "*"
+        update-types:
+          - minor
+          - patch