version: 2
updates:
  # Keep the SHA-pinned GitHub Actions current (Dependabot bumps the pinned
  # commit and the trailing `# vX` comment together).
  - package-ecosystem: "github-actions"
    directory: "/"
    schedule:
      interval: "weekly"
    commit-message:
      prefix: "ci"

  # Surface Rust dependency updates, including security advisories.
  - package-ecosystem: "cargo"
    directory: "/"
    schedule:
      interval: "weekly"
    commit-message:
      prefix: "deps"
    open-pull-requests-limit: 5
