From 82b09ec7958366aceacdf9159f394fea4ea6d943 Mon Sep 17 00:00:00 2001
From: mw-w <mitchell.wilkinswheat@immutable.com>
Date: Thu, 22 Oct 2026 12:58:56 +1100
Subject: [PATCH] ci: add dependabot config for gomod, docker, actions and pip

Weekly version updates for the ecosystems bumped by hand in #49:
- gomod: golang.org/x/* grouped, other minor/patch grouped, majors
  ignored (go-ethereum fork); security updates grouped by module family
- docker: Dockerfile and Dockerfile.alltools base images grouped; golang
  minor/major ignored since a new Go minor needs a go.mod and CI change
- github-actions: workflows plus nested composite actions
- pip: cmd/clef requirements, monthly

All entries use a 3 day cooldown. A multi-ecosystem group that would
merge every update into one PR is included commented out.
---
 .github/dependabot.yml | 112 +++++++++++++++++++++++++++++++++++++++++
 1 file changed, 112 insertions(+)
 create mode 100644 .github/dependabot.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 000000000..76abb3acd
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,112 @@
+version: 2
+
+# To land every ecosystem's updates in a single weekly PR, uncomment this
+# block and the two `multi-ecosystem-group` / `patterns` lines marked
+# "single PR" in each update below.
+# multi-ecosystem-groups:
+#   all-updates:
+#     schedule:
+#       interval: weekly
+
+updates:
+  - package-ecosystem: gomod
+    directory: /
+    # single PR:
+    # multi-ecosystem-group: all-updates
+    # patterns: ["*"]
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 3
+    cooldown:
+      default-days: 3
+    commit-message:
+      prefix: build
+      include: scope
+    groups:
+      # Security updates: bundle related CVE fixes into one PR, as upstream does.
+      sec-golang-x:
+        applies-to: security-updates
+        patterns:
+          - "golang.org/x/*"
+      sec-google:
+        applies-to: security-updates
+        patterns:
+          - "google.golang.org/*"
+      # Version updates
+      golang-x:
+        applies-to: version-updates
+        patterns:
+          - "golang.org/x/*"
+      go-minor-patch:
+        applies-to: version-updates
+        update-types:
+          - minor
+          - patch
+        exclude-patterns:
+          - "golang.org/x/*"
+    ignore:
+      # This is a go-ethereum fork. Major bumps of its dependencies are
+      # handled by hand when rebasing on upstream.
+      - dependency-name: "*"
+        update-types:
+          - version-update:semver-major
+
+  # Builder and runtime images in Dockerfile and Dockerfile.alltools.
+  - package-ecosystem: docker
+    directory: /
+    # single PR:
+    # multi-ecosystem-group: all-updates
+    # patterns: ["*"]
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 3
+    commit-message:
+      prefix: build
+      include: scope
+    groups:
+      docker-images:
+        patterns:
+          - "*"
+    ignore:
+      # A new Go minor needs a go.mod and CI change in the same PR,
+      # so do those by hand. Patch releases still come through.
+      - dependency-name: golang
+        update-types:
+          - version-update:semver-major
+          - version-update:semver-minor
+
+  # Workflows, plus the composite actions under .github/actions, which
+  # the default "/" directory does not scan.
+  - package-ecosystem: github-actions
+    # single PR:
+    # multi-ecosystem-group: all-updates
+    # patterns: ["*"]
+    directories:
+      - /
+      - /.github/actions/**/*
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 3
+    commit-message:
+      prefix: ci
+      include: scope
+    groups:
+      github-actions:
+        patterns:
+          - "*"
+
+  # Only dependency is tinyrpc, used by the clef python signer example.
+  - package-ecosystem: pip
+    directory: /cmd/clef
+    # single PR:
+    # multi-ecosystem-group: all-updates
+    # patterns: ["*"]
+    schedule:
+      interval: monthly
+    cooldown:
+      default-days: 3
+    commit-message:
+      prefix: build
+      include: scope