(cordova-browser) branch master updated: chore: action workflow updates & add dependabot (#167)

[ma...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

GitToTheHub pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/cordova-browser.git


The following commit(s) were added to refs/heads/master by this push:
     new b888178  chore: action workflow updates & add dependabot (#167)
b888178 is described below

commit b888178ff5b3cf5d4b8917470cfc57d972f603c4
Author: エリス <er...@users.noreply.github.com>
AuthorDate: Thu Aug 27 02:19:00 2026 +0900

    chore: action workflow updates & add dependabot (#167)
    
    * chore(dependabot): add configurations
    
    * chore(workflow): release-audit
    
    * chore(workflow): removed licence_checker.yml & update actions
---
 licence_checker.yml => .github/dependabot.yml | 37 +++++++++++++++++++++++++--
 .github/workflows/ci.yml                      | 11 ++++----
 .github/workflows/release-audit.yml           |  5 ++--
 3 files changed, 42 insertions(+), 11 deletions(-)

diff --git a/licence_checker.yml b/.github/dependabot.yml
similarity index 53%
rename from licence_checker.yml
rename to .github/dependabot.yml
index 6456f79..609ac46 100644
--- a/licence_checker.yml
+++ b/.github/dependabot.yml
@@ -15,5 +15,38 @@
 # specific language governing permissions and limitations
 # under the License.
 
-# Empty for the release audit workflow.
-# The `license-config` is required even if there are no custom configs
+version: 2
+
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    cooldown:
+      default-days: 5
+    schedule:
+      interval: "weekly" # Every Monday
+    groups:
+      gh-actions-patch-minor:
+        patterns:
+          - "*"
+        update-types:
+          - "patch"
+          - "minor"
+
+  - package-ecosystem: "npm"
+    directory: "/"
+    cooldown:
+      default-days: 5
+      semver-major-days: 14
+    schedule:
+      interval: "weekly" # Every Monday
+    groups:
+      npm-patch:
+        patterns:
+          - "*"
+        update-types:
+          - "patch"
+      npm-minor:
+        patterns:
+          - "*"
+        update-types:
+          - "minor"
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c32a5ed..feebff1 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -41,12 +41,12 @@ jobs:
         os: [ubuntu-latest, windows-latest, macos-26]
 
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           fetch-depth: 1
 
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: ${{ matrix.node-version }}
 
@@ -59,7 +59,7 @@ jobs:
       # It contains mixed content from the npm package "cordova-js" and "./cordova-js-src".
       # The report might not be resolvable because of the external package.
       # If the report is related to this repository, it would be detected when scanning "./cordova-js-src".
-      - uses: github/codeql-action/init@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0
+      - uses: github/codeql-action/init@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
         with:
           languages: javascript
           queries: security-and-quality
@@ -75,10 +75,9 @@ jobs:
         env:
           CI: true
 
-      - uses: github/codeql-action/analyze@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0
+      - uses: github/codeql-action/analyze@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
 
-      # v4.6.0
-      - uses: codecov/codecov-action@b9fd7d16f6d7d1b5d2bec1a2887e65ceed900238
+      - uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
         if: success()
         with:
           name: ${{ runner.os }} node.js ${{ matrix.node-version }}
diff --git a/.github/workflows/release-audit.yml b/.github/workflows/release-audit.yml
index 28a6b87..f50edfc 100644
--- a/.github/workflows/release-audit.yml
+++ b/.github/workflows/release-audit.yml
@@ -34,7 +34,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       # Checkout project
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           fetch-depth: 1
@@ -43,7 +43,7 @@ jobs:
       - uses: erisu/apache-rat-action@30c94d10ed21e6f6fd5590dc5c158f58cae7a0dd # v3.0.0
 
       # Setup environment with node
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 24
 
@@ -54,5 +54,4 @@ jobs:
       # Check node package licenses
       - uses: erisu/license-checker-action@04511f4c052b5773f11e1c65b42cda88235c62ae # v2.1.0
         with:
-          license-config: 'licence_checker.yml'
           include-asf-category-a: true


---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@cordova.apache.org
For additional commands, e-mail: commits-help@cordova.apache.org