Artifact [819d94fc40]

Artifact 819d94fc402007d16297d0bbc73fcf40f087ef9b269ec4bf061ca489ab9a1b1f:

• File .github/dependabot.yml — part of check-in [a8beeb09dc] at 2026-10-03 19:00:18 on branch main — ci: track go-libfossil with Dependabot instead of a release dispatch (#199)

  bump-upstream.yml waited for an upstream-bump event from go-libfossil's release workflow. That path has been dead since the rename: go-libfossil sends repo=go-libfossil and module github.com/danmestas/go-libfossil, while this workflow only accepted libfossil and github.com/danmestas/libfossil and ignored anything else. The sending side has also failed with 401 since v0.8.1, because its token expired.

  Dependabot now watches github.com/danmestas/go-libfossil and its driver modules in the root, bridge and leaf go.mod files, daily, and opens one pull request per module path across all three. No token is needed, and a broken update shows up in Dependabot's own status rather than as a dispatch nobody sees fail. Security updates for other dependencies are unaffected.

  Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> (user: [email protected], size: 710) [annotate] [blame] [check-ins using]

# Keep go-libfossil current. A new go-libfossil release is picked up within a
# day as one pull request per module path, updating every go.mod that uses it.
# This replaces a cross-repo dispatch from go-libfossil's release workflow,
# which needed a personal access token and broke silently when it expired.
version: 2
updates:
  - package-ecosystem: gomod
    directories:
      - "/"
      - "/bridge"
      - "/leaf"
    schedule:
      interval: daily
    allow:
      - dependency-name: "github.com/danmestas/go-libfossil*"
    groups:
      go-libfossil:
        patterns:
          - "github.com/danmestas/go-libfossil*"
        group-by: dependency-name
    commit-message:
      prefix: "build(deps)"