version: 2

updates:
  # GitHub Actions — keeps workflow action versions (and their SHA pins) current.
  - package-ecosystem: github-actions
    directory: /
    schedule:
      interval: weekly
    open-pull-requests-limit: 5
    groups:
      github-actions:
        patterns:
          - "*"
    commit-message:
      prefix: "ci"

  # pnpm owns the single repository lockfile for all workspace packages.
  - package-ecosystem: npm
    directory: /
    schedule:
      interval: weekly
    cooldown:
      default-days: 3
    open-pull-requests-limit: 5
    groups:
      workspace-dependencies:
        patterns:
          - "*"
    commit-message:
      prefix: "deps"