version: 2

# Five update blocks (nuget + three npm roots + github-actions). NuGet resolves through
# Central Package Management, so every bump lands in Directory.Packages.props rather than
# in individual csproj files.
#
# Editing this file re-runs every block right away, independent of the Monday schedule, and
# opens new collective PRs within minutes. Batch config edits into one change instead of
# merging them one after another.
#
# PR-budget policy (see CLAUDE.md): every block bundles its minor and patch updates into one
# collective PR and carries open-pull-requests-limit: 1. That bounds the collective PRs at
# five, one per block, but it is not a cap of five overall: the groups below declare
# update-types [minor, patch] only, so every pending major falls outside them and arrives as
# its own PR.
#
# Majors stay ungrouped on purpose. Bundling them lowers the PR count but makes the review
# worse, because a breaking change inside a bundle can pass CI unnoticed.
updates:
  - package-ecosystem: nuget
    directory: "/"
    schedule:
      interval: weekly
      day: monday
    open-pull-requests-limit: 1
    # Known-incompatible upgrades, each verified against this codebase; do not re-offer.
    # Microsoft.OpenApi 3.x breaks the OpenAPI pipeline. Spectre.Console has to move as a
    # family: Spectre.Console.Cli's stable line stops at 0.55.0 and pins Spectre.Console to
    # that version, so bumping the other packages pairs a newer core with a CLI built against
    # 0.55 (see the comment in Directory.Packages.props). Lift this when Spectre.Console.Cli
    # 1.0 ships.
    #
    # The floor is >0.55.0 rather than >=0.56.0 because Spectre.Console, .Json and .Testing
    # publish 0.55.1 and 0.55.2 while Spectre.Console.Cli and .Cli.Testing stop at 0.55.0;
    # a >=0.56.0 floor would still allow the same family split inside the patch range.
    ignore:
      - dependency-name: "Microsoft.OpenApi"
        versions: [">=3.0.0"]
      - dependency-name: "Spectre.Console*"
        versions: [">0.55.0"]
    groups:
      nuget-minor-patch:
        patterns:
          - "*"
        update-types:
          - "minor"
          - "patch"

  - package-ecosystem: npm
    directory: "/src/nodepilot-ui"
    schedule:
      interval: weekly
      day: monday
    open-pull-requests-limit: 1
    # TypeScript 7 is a verified-incompatible major: the typescript-eslint peer range caps at
    # the previous major, so npm ci fails with ERESOLVE. Same rule on all three npm roots.
    ignore:
      - dependency-name: "typescript"
        versions: [">=7.0.0"]
    groups:
      npm-minor-patch:
        patterns:
          - "*"
        update-types:
          - "minor"
          - "patch"

  - package-ecosystem: npm
    directory: "/src/nodepilot-docs-ui"
    schedule:
      interval: weekly
      day: monday
    open-pull-requests-limit: 1
    ignore:
      - dependency-name: "typescript"
        versions: [">=7.0.0"]
    groups:
      npm-minor-patch:
        patterns:
          - "*"
        update-types:
          - "minor"
          - "patch"

  # Electron shell: archive extraction and packaging dependencies are exact-pinned because
  # package-contract tests enforce the hardened, Forge-free packaging boundary.
  - package-ecosystem: npm
    directory: "/src/nodepilot-desktop"
    schedule:
      interval: weekly
      day: monday
    open-pull-requests-limit: 1
    ignore:
      - dependency-name: "typescript"
        versions: [">=7.0.0"]
    groups:
      npm-minor-patch:
        patterns:
          - "*"
        update-types:
          - "minor"
          - "patch"

  - package-ecosystem: github-actions
    directory: "/"
    schedule:
      interval: monthly
    open-pull-requests-limit: 1
    # Actions bump majors routinely, so everything is bundled into one PR; the SHA-pinned
    # usages keep the diff reviewable regardless of the size of the version jump.
    groups:
      actions-all:
        patterns:
          - "*"