From a21449ced8040df2dc84f57b898e997a46645cc5 Mon Sep 17 00:00:00 2001
From: Atliac <Atliac@outlook.com>
Date: Wed, 16 Sep 2026 03:06:11 +0800
Subject: [PATCH] chore(ci): add PR welcome and refine Dependabot

Add a pull_request_target workflow that posts a welcome comment on
newly opened pull requests via Atliac/pr-welcome, scoped to issue and
pull-request write permissions.

Extend the Dependabot config with monthly schedules, dependency labels,
Conventional Commit prefixes, and grouped updates to reduce PR noise.
---
 .github/dependabot.yml           | 67 +++++++++++++++++++++++++++++++-
 .github/workflows/pr-welcome.yml | 19 +++++++++
 2 files changed, 84 insertions(+), 2 deletions(-)
 create mode 100644 .github/workflows/pr-welcome.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index d062b44..e7af59b 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -1,10 +1,73 @@
 version: 2
+
 updates:
+  # ==============================================================================
+  # GitHub Actions Updates
+  # Keeps your CI/CD workflows up to date.
+  # ==============================================================================
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
-      interval: "weekly"
+      interval: "monthly" # Options: "daily", "weekly", "monthly"
+
+    # --- Optional Settings ---
+    open-pull-requests-limit: 3
+    labels:
+      - "ci"
+      - "dependencies"
+    groups:
+      actions:
+        patterns:
+          - "*"
+
+  # ==============================================================================
+  # Cargo (Rust) Updates
+  # Pointing to the root "/" manages the entire workspace via the root Cargo.lock.
+  # ==============================================================================
   - package-ecosystem: "cargo"
     directory: "/"
     schedule:
-      interval: "weekly"
+      interval: "monthly" # Options: "daily", "weekly", "monthly"
+
+    # --- Optional Settings ---
+
+    # Limit the number of open cargo-related pull requests at any given time (default is 5)
+    # open-pull-requests-limit: 5
+
+    # Automatically apply labels, assignees, or reviewers to generated PRs
+    labels:
+      - "dependencies"
+      - "rust"
+    # assignees:
+    #   - "your-github-username"
+    # reviewers:
+    #   - "reviewer-github-username"
+
+    # Enforce formatting rules (like Conventional Commits) on Dependabot's commits
+    commit-message:
+      prefix: "chore"
+      include: "scope" # Generates "chore(deps): bump serde..."
+
+    # Group updates together to reduce PR noise and save CI minutes
+    groups:
+      # Specific ecosystem rules are listed first so they are processed first (Group specific high-frequency ecosystems)
+      tokio-ecosystem:
+        patterns:
+          - "tokio*"
+          - "axum*"
+
+      # General rules are listed last to catch everything else
+      cargo-minor-patch:
+        patterns:
+          - "*"
+        update-types:
+          - "minor"
+          - "patch"
+
+    # Ignore specific versions or restrict upgrades
+    # ignore:
+    #   # Example: Ignore major version bumps for tokio to avoid unexpected breaking changes
+    #   - dependency-name: "tokio"
+    #     update-types: ["version-update:semver-major"]
+    #   # Example: Entirely ignore updates for a specific crate
+    #   - dependency-name: "some-unstable-dependency"
diff --git a/.github/workflows/pr-welcome.yml b/.github/workflows/pr-welcome.yml
new file mode 100644
index 0000000..88755d3
--- /dev/null
+++ b/.github/workflows/pr-welcome.yml
@@ -0,0 +1,19 @@
+name: PR Welcome
+
+on:
+  pull_request_target:
+    types: [opened]
+
+# Required permissions for reading and writing PR comments
+permissions:
+  issues: write
+  pull-requests: write
+
+jobs:
+  pr-welcome:
+    runs-on: ubuntu-latest
+    steps:
+      - name: PR Welcome
+        uses: Atliac/pr-welcome@v1
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}