---
version: 2
updates:
  - package-ecosystem: "github-actions"
    directory: "/"
    schedule:
      interval: "weekly"
    groups:
      actions:
        patterns: ["*"]

  - package-ecosystem: "bun"
    directory: "/studio/frontend"
    schedule:
      interval: "weekly"
    groups:
      bun-frontend:
        patterns: ["*"]

  - package-ecosystem: "npm"
    directory: "/studio/backend/core/data_recipe/oxc-validator"
    schedule:
      interval: "weekly"
    groups:
      npm-oxc-validator:
        patterns: ["*"]

  # pip + cargo so security advisories on Python deps + the Tauri shell
  # auto-generate PRs alongside the github-actions / bun / npm updates.
  # Grouped weekly so we don't get one PR per dep; security advisories
  # bypass the group and open immediately.
  - package-ecosystem: "pip"
    directory: "/"
    schedule:
      interval: "weekly"
    open-pull-requests-limit: 5
    groups:
      python:
        patterns: ["*"]

  - package-ecosystem: "cargo"
    directory: "/studio/src-tauri"
    schedule:
      interval: "weekly"
    groups:
      cargo-tauri:
        patterns: ["*"]
...