# Dependabot version updates — sdk-python
# Ubicación obligatoria: .github/dependabot.yml
# Ecosistemas: pip (Python) + github-actions
version: 2

updates:
  # ── Python / pip ─────────────────────────────────────────────────────
  - package-ecosystem: "pip"
    directory: "/"
    schedule:
      interval: "weekly"
      day: "monday"
      time: "09:00"
      timezone: "America/Bogota"
    open-pull-requests-limit: 5
    assignees:
      - "luismeli10"
      - "orojaspardo"
      - "barajas-d"
    labels:
      - "dependencies"
    commit-message:
      prefix: "chore(deps)"
      include: "scope"
    # pip puede ejecutar código de setup.py durante el update — lo bloqueamos
    insecure-external-code-execution: "deny"
    ignore:
      - dependency-name: "*"
        update-types: ["version-update:semver-major"]

  # ── GitHub Actions (CI) ──────────────────────────────────────────────
  - package-ecosystem: "github-actions"
    directory: "/"
    schedule:
      interval: "weekly"
      day: "monday"
      time: "09:00"
      timezone: "America/Bogota"
    open-pull-requests-limit: 1
    labels:
      - "dependencies"
      - "ci"
    commit-message:
      prefix: "chore(ci)"
