From 5ea0ecf703f68b31e2d0fafce95498d0b69ade3f Mon Sep 17 00:00:00 2001
From: Fahad <71817337+fahad-ali7@users.noreply.github.com>
Date: Fri, 11 Sep 2026 10:08:38 +0200
Subject: [PATCH] chore(deps): Dependabot security updates only, labelled
 type:security

Scheduled version updates off (open-pull-requests-limit: 0); security updates
are exempt from that limit and still open. labels: applies to security-update
PRs, so they now carry a type: label and satisfy the pr-type-label gate.

Claude-Session: https://claude.ai/code/session_01XUThLXzfRd4RVtxXCQo2Ui
---
 .github/dependabot.yml | 26 +++++++++++++++++++-------
 1 file changed, 19 insertions(+), 7 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 7c2c166..59030f8 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -1,17 +1,29 @@
+# Dependabot policy: SECURITY UPDATES ONLY.
+#
+# `open-pull-requests-limit: 0` switches off scheduled *version* updates for the
+# ecosystem. Security updates are explicitly exempt from that limit, so
+# Dependabot still opens a PR for every open Dependabot alert with a patch.
+# See docs.github.com/code-security/dependabot/working-with-dependabot/dependabot-options-reference
+#
+# `labels` applies to security-update PRs too, which is the point: `pr-type-label`
+# is a required check and Dependabot applies no `type:` label of its own, so
+# without this every Dependabot PR is unmergeable and gets closed unread.
+# The label is scoped per `package-ecosystem`/`directory` entry, so EVERY manifest
+# directory in the repo needs an entry here even though version updates are off.
+#
+# If scheduled version updates are ever turned back on (limit > 0), revisit the
+# label: `type:security` would then be wrong for routine bumps.
 version: 2
 updates:
   - package-ecosystem: "gomod"
     directory: "/"
     schedule:
       interval: "monthly"
-    open-pull-requests-limit: 5
-    groups:
-      go-deps:
-        patterns: ["*"]
+    open-pull-requests-limit: 0
+    labels: ["type:security", "dependencies"]
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
       interval: "monthly"
-    groups:
-      actions-deps:
-        patterns: ["*"]
+    open-pull-requests-limit: 0
+    labels: ["type:security", "dependencies"]