group Go dependency updates weekly

Some dependencies are excluded because of known issues upgrading them in the past. Signed-off-by: Spencer Schrock <[email protected]>
ossf · Dec 11, 2024 · beddef9 · beddef9
1 parent 213bae3
commit beddef9
Showing 1 changed file with 9 additions and 2 deletions.
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
@@ -5,11 +5,18 @@ updates:
     - "/"
     - "/tools"
   schedule:
-    interval: daily
+    interval: weekly
   rebase-strategy: disabled
   commit-message:
       prefix: ":seedling:"
-  open-pull-requests-limit: 3
+  groups:
+    gomod:
+      patterns:
+        - "*"
+      exclude-patterns:
+        - "github.com/rhysd/actionlint" # has had breaking changes in the past
+        - "github.com/google/osv-scanner" # influences Vulnerabilities check and may require go directive fixes
+        - "github.com/golangci/golangci-lint" # require linter fixes before merge
 - package-ecosystem: "github-actions"
   directory: "/"
   schedule: