status-go/.dependabot/config.yml

# https://dependabot.com/docs/config-file/

version: 1
update_configs:
  # Keep go.mod and go.sum up to date, batching pull requests weekly
  - package_manager: "go:modules"
    directory: "/"
    update_schedule: "weekly"
    default_assignees:
    - "cammellos"
    - "Samyoul"
    allowed_updates:
      - match:
          update_type: "security"
Add dependabot config file (#1636) * Add dependabot config file * Fix status-protocol-go dependency 2019-10-11 07:00:46 +02:00			`# https://dependabot.com/docs/config-file/`

			`version: 1`
			`update_configs:`
			`# Keep go.mod and go.sum up to date, batching pull requests weekly`
			`- package_manager: "go:modules"`
			`directory: "/"`
			`update_schedule: "weekly"`
			`default_assignees:`
			`- "cammellos"`
Updated dependabot config to assign Samyoul (#1972) 2020-05-14 08:47:38 +01:00			`- "Samyoul"`
Updated dependabot config to security only (#1975) see for details : https://dependabot.com/docs/config-file/#allowed_updates ## Why make the change? @dependabot makes PRs for upgrading dependencies, but it doesn't automatically call `make vendor`, which is a problem because that means any merge for a @dependabot PR will require manual intervention. I've looked through the @dependabot PR history and there has never been a successfully merged PR. [See here](https://github.com/status-im/status-go/pulls?q=is%3Apr+author%3Aapp%2Fdependabot-preview+is%3Aclosed) If we are going to use this service we should only be warned of security updates, until we can implement a `make-vendor-bot` to automatically update the vendored files. ## What has changed? Changed @dependabot settings to only make a PR for security updates. 2020-05-15 16:01:41 +01:00			`allowed_updates:`
			`- match:`
Minor dependabot config yml format fix (#1979) resolved GH-1977 2020-05-15 19:46:29 +01:00			`update_type: "security"`