# Keeps the actions of .github/workflows/ci.yml up to date. The workflow pins
# each action by commit SHA with the version in a comment; Dependabot updates
# both and opens one pull request a week for all actions.
version: 2
updates:
  - package-ecosystem: github-actions
    directory: /
    schedule:
      interval: weekly
    # Waits a week before it proposes a new release, so that a compromised
    # release is more likely to be found and withdrawn first.
    cooldown:
      default-days: 7
    commit-message:
      prefix: ci
    groups:
      github-actions:
        patterns:
          - "*"