version: 2
updates:
  # Runtime + dev dependencies. Weekly on Mondays — keeps the noise
  # predictable and aligns with a normal review cycle.
  - package-ecosystem: npm
    directory: "/"
    schedule:
      interval: weekly
      day: monday
    open-pull-requests-limit: 5
    reviewers:
      - ArnasDon
    labels:
      - dependencies
    groups:
      # Batch related upgrades into one PR so we're not closing six
      # independent Supabase-bumps per week.
      supabase:
        patterns:
          - "@supabase/*"
      types:
        patterns:
          - "@types/*"
        update-types:
          - minor
          - patch
      dev-dependencies:
        dependency-type: development
        update-types:
          - minor
          - patch
    ignore:
      # Next + React + Tailwind are pinned exactly on purpose. Let
      # them flow through manual major bumps when we're ready.
      - dependency-name: next
      - dependency-name: react
      - dependency-name: react-dom
      - dependency-name: tailwindcss
      - dependency-name: eslint-config-next

  # GitHub Actions in .github/workflows/. Catches setup-node /
  # checkout version bumps that keep the CI matrix healthy.
  - package-ecosystem: github-actions
    directory: "/"
    schedule:
      interval: weekly
      day: monday
    open-pull-requests-limit: 3
    reviewers:
      - ArnasDon
    labels:
      - dependencies
      - github-actions