Create a dependabot group for all go deps

Dependabot seems to only update a dep in all go modoules, if it belongs to a group. This new group will cover all deps that are not part of an existing group, so they get updated in all go.mod. I think this will help avoid issues like #1939 Signed-off-by: Jin Dong <[email protected]>
containerd · Jan 15, 2025 · 331bf43 · 331bf43
1 parent 8c9ecb7
commit 331bf43
Showing 1 changed file with 11 additions and 0 deletions.
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
@@ -29,6 +29,17 @@ updates:
       k8s:
         patterns:
           - "k8s.io/*"
+      gomod:
+        # this pattern covers all go dependencies that are not in
+        # the above groups. dependabot doesn't seem to update sub-modules if
+        # a dependency doesn't belong to a group, so we define this group
+        # explicitly.
+        exclude-patterns:
+          - "golang.org/x/*" 
+          - "google.golang.org/*"
+          - "github.com/containerd/*"
+          - "github.com/opencontainers/*"
+          - "k8s.io/*"
 
   # Automatic upgrade for base images used in the Dockerfile
   - package-ecosystem: "docker"