version: 2
updates:
  - package-ecosystem: "github-actions"
    directory: "/"
    schedule:
      interval: "weekly"
    ignore:
      # gh-aw generated files — action SHAs are managed by `gh aw compile`
      # via .github/aw/actions-lock.json, not by Dependabot.
      # Dependabot's find-and-replace breaks lockfile metadata headers.
      - dependency-name: "actions/github-script"
      - dependency-name: "github/gh-aw-actions"
      # Major version bumps may have breaking changes and must be
      # evaluated and applied manually.
      - dependency-name: "*"
        update-types: ["version-update:semver-major"]
    groups:
      github-actions:
        patterns:
          - "*"

  - package-ecosystem: "maven"
    directory: "/"
    schedule:
      interval: "weekly"
    ignore:
      # Major version bumps often drop Java 17 support or have breaking
      # API changes. These must be evaluated and applied manually.
      - dependency-name: "*"
        update-types: ["version-update:semver-major"]
    groups:
      maven-deps:
        patterns:
          - "*"