version: 2
updates:
  # Workflow actions are pinned to commit SHAs; this keeps the pins current
  # (new releases, runtime moves such as Node 20 -> 24) in one PR a month.
  - package-ecosystem: github-actions
    directory: /
    schedule:
      interval: monthly
    groups:
      actions:
        patterns: ["*"]
    commit-message:
      prefix: ci