version: 2
multi-ecosystem-groups:
  all:
    schedule:
      interval: 'weekly'
# npm, PyPI, and NuGet cooldowns accommodate downstream registry quarantine.
updates:
  - package-ecosystem: 'github-actions'
    directory: '/'
    multi-ecosystem-group: 'all'
    patterns: ['*']
    ignore:
      # gh-aw generated files — action SHAs are managed by `gh aw compile`
      # via .github/aw/actions-lock.json, not by Dependabot.
      # Dependabot's find-and-replace breaks lockfile metadata headers.
      - dependency-name: "actions/github-script"
      - dependency-name: "github/gh-aw-actions"
    cooldown:
      default-days: 7
  - package-ecosystem: 'devcontainers'
    directory: '/'
    multi-ecosystem-group: 'all'
    patterns: ['*']
  # Node.js dependencies
  - package-ecosystem: 'npm'
    directory: '/nodejs'
    cooldown:
      default-days: 7
      exclude: ['@github/*']
    multi-ecosystem-group: 'all'
    patterns: ['*']
  - package-ecosystem: 'npm'
    directory: '/test/harness'
    cooldown:
      default-days: 7
      exclude: ['@github/*']
    multi-ecosystem-group: 'all'
    patterns: ['*']
  # Python dependencies
  - package-ecosystem: 'pip'
    directory: '/python'
    cooldown:
      default-days: 7
    multi-ecosystem-group: 'all'
    patterns: ['*']
  # Go dependencies
  - package-ecosystem: 'gomod'
    directory: '/go'
    multi-ecosystem-group: 'all'
    patterns: ['*']
  # .NET dependencies
  - package-ecosystem: 'nuget'
    directory: '/dotnet'
    cooldown:
      default-days: 7
    multi-ecosystem-group: 'all'
    patterns: ['*']
  # Java dependencies
  - package-ecosystem: 'maven'
    directory: '/java'
    schedule:
      interval: 'weekly'
    ignore:
      # Major version bumps often drop Java 17 support or have breaking
      # API changes. These must be evaluated and applied manually.
      - dependency-name: "*"
        update-types: ["version-update:semver-major"]
    groups:
      java-maven-deps:
        patterns:
          - "*"
  # Java codegen dependencies
  - package-ecosystem: 'npm'
    directory: '/java/scripts/codegen'
    cooldown:
      default-days: 7
      exclude: ['@github/*']
    schedule:
      interval: 'weekly'
    groups:
      java-codegen-deps:
        patterns:
          - "*"