Configuration (teire.yml)
One optional file decides what Teire upgrades, how many PRs it opens, which checks it runs and what it reads. Every key has a default, and a mistake never stops a scan.
- .github/
teire.ymloptional - Schemaa mistake → its default
- Organisationteire-config defaults
- Next scanreads it
Teire keeps no settings of its own. Everything lives in the repository, in the first of these files that exists:
.github/teire.yaml, teire.yml and teire.yaml at the root work too.
An organisation can share defaults in a repository named teire-config, as teire.yml or .github/teire.yml. Values resolve repository → organisation → defaults:
- Objects merge key by key.
- The
ignoreandsourceslists add up: the organisation's first, then the repository's.
Models, endpoints and keys can't be set from a repository.
The defaults
The Configure Teire pull request adds this file:
# yaml-language-server: $schema=https://teire.vercel.app/schema.json
# Teire configuration. Every key is optional; these are the defaults.
# Reference: https://teire.vercel.app/docs/config
upgrades:
majors: true # open upgrade PRs across major versions
plainBumps: true # open verified upgrades with no code change (last in the queue)
cooldownDays: 7 # wait this long after a release before proposing it
schedule: daily # daily and on pushes that change dependencies or code; weekly, push (pushes only) or off
pullRequests:
limit: 5 # open Teire PRs at most
perHour: 2 # new Teire PRs per hour at most
dashboardIssue: trueThe first line points editors that use the YAML language server at /schema.json. They complete keys and flag mistakes as you type.
Every key
Read from the same schema the worker validates with:
| Key | Type | What it does |
|---|---|---|
| ecosystems | object | Turn an ecosystem (or API-host checks, `apis`) off for this repo; all are on by default. |
| ecosystems.npm | boolean | |
| ecosystems.pypi | boolean | |
| ecosystems.maven | boolean | |
| ecosystems.go | boolean | |
| ecosystems.cargo | boolean | |
| ecosystems.rubygems | boolean | |
| ecosystems.apis | boolean | |
| paths | string[] | Only scan these paths (globs). |
| ignorePaths | string[] | Never scan these paths (globs). |
| ignore | string[] | Change ids, packages (`openai`, `npm:openai`) or providers (`provider:groq`) to ignore. |
| upgrades | object | |
| upgrades.majors | boolean | Open PRs for new majors (default true). |
| upgrades.plainBumps | boolean | Open PRs for upgrades with no located break (default true). |
| upgrades.cooldownDays | integer | Skip versions younger than this many days. |
| upgrades.allow | string[] | Only upgrade these packages. |
| upgrades.deny | string[] | Never upgrade these packages. |
| upgrades.prerelease | string[] | Packages whose pre-releases Teire proposes (`react`, `npm:react`, or `*` for all). |
| upgrades.distTags | object | npm packages that follow a dist-tag instead of `latest` (`{ next: canary }`). |
| upgrades.versioning | "auto" | "increase" | "widen" | auto (the default): a published library's ranges widen to admit the new version, an app's move to it. increase: always move. widen: always widen. |
| schedule | "push" | "daily" | "weekly" | "off" | When to rescan: daily (the default) or weekly, plus every push that touches dependencies or code; push = pushes only; off = no automatic scans. |
| verify | object[] | Commands that replace the detected ones, per workspace. |
| verify[].workspace | string | Project directory, `.` for the root. |
| verify[].install | string | |
| verify[].typecheck | string | |
| verify[].test | string | |
| pullRequests | object | |
| pullRequests.limit | integer | Open Teire PRs at most (default 5). |
| pullRequests.perHour | integer | New Teire PRs per hour at most (default 2). |
| pullRequests.labels | string[] | Extra labels on every Teire PR. |
| pullRequests.commitMessage | object | |
| pullRequests.commitMessage.prefix | string | |
| pullRequests.targetBranch | string | Base branch for PRs (default: the repo's default branch). |
| dashboardIssue | boolean | Keep the Teire Dashboard issue (default true). |
| fixes | "automatic" | "ask" | "off" | automatic (the default): a fix starts when a change reaches your code. ask: nothing new is written until someone asks (Fix now, @teire fix). off: findings are listed, nothing is fixed. |
| securityFixes | "automatic" | "ask" | automatic (the default): a security fix starts on its own, even when fixes are ask. ask: security fixes wait for a person too. fixes: off turns these off as well. |
| sources | object[] | Changelogs or API specs Teire should read for a host or package. |
| sources[].host | string | |
| sources[].package | string | |
| sources[].changelogUrl | string | |
| sources[].specUrl | string |
Examples
upgrades:
plainBumps: false # only upgrades that change your code, and security fixes
deny: [react, react-dom] # never these
pullRequests:
limit: 2
labels: [dependencies]
ignore:
- provider:stripe # don't report Stripe API changesWhen the file has a mistake
The file is read leniently:
- A key with the wrong type falls back to its default.
- An unknown key is reported.
- The valid parts of a list or object are kept.
A mistake never stops a scan. Problems show up in three places:
- a Teire config check run on the scanned commit, with an annotation on each bad line,
- Config problems (defaults used) in the Dashboard issue,
- the reply to
@teire config, which also shows where every value came from.
A problem reads like .github/teire.yml line 3: upgrades.cooldownDays Too big: expected number to be <=90, or line 4: foo unknown key "foo".
When changes take effect
Teire stores the resolved file with each scan. Push the change to the default branch: a push that touches teire.yml triggers a scan. @teire rescan works too.
@teire commands
Comment on any issue or pull request to rescan, fix, ignore, rebase, explain or pause. Teire answers in the thread and links the live run.
dependabot.yml
Teire reads your existing dependabot.yml and honours it, so moving from Dependabot changes nothing you already decided. teire.yml wins where both say something, and Teire says so.