From 298224af1026a43260ef47e49900156c286570d0 Mon Sep 17 00:00:00 2001
From: santidev21 <orsantiago21@gmail.com>
Date: Wed, 30 Sep 2026 08:45:45 -0500
Subject: [PATCH] chore(deps): tune Dependabot for quiet, safe updates

- Monthly schedule and rebase-strategy: disabled, so no weekly PR/rebase churn.
- Explicit open-pull-requests-limit of 5 on every ecosystem.
- Major version updates are ignored: majors are planned manual upgrades
  (framework migrations, base image jumps), not bot PRs. Minor and patch
  updates keep flowing, grouped into one PR per ecosystem.
- Dependabot security alerts are not affected.
---
 .github/dependabot.yml | 48 +++++++++++++++++++++++++++++-------------
 1 file changed, 33 insertions(+), 15 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 05e432b..84a4afe 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -1,28 +1,32 @@
 # Dependabot configuration for SplitIt.
 # Keeps NuGet, npm, GitHub Actions and Docker base images up to date and surfaces
 # known vulnerabilities as security alerts/PRs.
+#
+# Tuned to stay quiet and safe:
+#   - monthly schedule and rebase-strategy: disabled → no weekly PR/rebase churn.
+#   - explicit open-pull-requests-limit for every ecosystem.
+#   - major version updates are ignored on purpose: majors are planned manual
+#     upgrades (framework migrations, base image jumps), not bot PRs. Minor and
+#     patch updates keep flowing, grouped into one PR per ecosystem.
+#   - Dependabot security alerts are not affected by these settings.
 version: 2
 updates:
   # .NET backend (solution lives in SplitIt.API, tests in SplitIt.Tests).
   - package-ecosystem: "nuget"
-    directory: "/SplitIt.API"
-    schedule:
-      interval: "weekly"
-    open-pull-requests-limit: 5
-    groups:
-      nuget-minor-patch:
-        patterns: ["*"]
-        update-types: ["minor", "patch"]
-
-  - package-ecosystem: "nuget"
-    directory: "/SplitIt.Tests"
+    directories:
+      - "/SplitIt.API"
+      - "/SplitIt.Tests"
     schedule:
-      interval: "weekly"
+      interval: "monthly"
     open-pull-requests-limit: 5
+    rebase-strategy: disabled
     groups:
       nuget-minor-patch:
         patterns: ["*"]
         update-types: ["minor", "patch"]
+    ignore:
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major"]
 
   # Node tooling: root orchestration package and the Angular app.
   - package-ecosystem: "npm"
@@ -30,18 +34,27 @@ updates:
       - "/"
       - "/split-it-ui"
     schedule:
-      interval: "weekly"
+      interval: "monthly"
     open-pull-requests-limit: 5
+    rebase-strategy: disabled
     groups:
       npm-minor-patch:
         patterns: ["*"]
         update-types: ["minor", "patch"]
+    ignore:
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major"]
 
   # Workflow actions and Docker base images.
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
-      interval: "weekly"
+      interval: "monthly"
+    open-pull-requests-limit: 5
+    rebase-strategy: disabled
+    ignore:
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major"]
 
   - package-ecosystem: "docker"
     directories:
@@ -49,4 +62,9 @@ updates:
       - "/docker/frontend"
       - "/docker/proxy"
     schedule:
-      interval: "weekly"
+      interval: "monthly"
+    open-pull-requests-limit: 5
+    rebase-strategy: disabled
+    ignore:
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major"]