Group Dependabot security-advisory PRs per ecosystem

[3uzbcqje]

Groups Dependabot's security-advisory PRs, which the existing config does not cover.

A groups entry without applies-to defaults to version-updates only. So while minor/patch version updates have been arriving grouped since the last PR merged, security advisories still open one PR per advisory. This adds a second group per ecosystem that sets applies-to: security-updates.

Groups after this change

Ecosystem	Version updates	Security updates
pip	pip	pip-security
github-actions	github-actions	github-actions-security

Notes

• The security groups use patterns: ["*"], so they include major bumps. That is deliberate — declining a security fix on the grounds that it is a major version bump is not a real option.
• This only affects PRs opened from the merge onward. Security PRs already open are not retroactively grouped and still need merging or closing by hand.
• Cooldown is untouched. Security updates are driven by Dependabot alerts, so urgent fixes are not delayed by the version-update schedule.

🤖 Generated with Claude Code

https://claude.ai/code/session_01LpZM2dqedR4fXiLn7272XQ

Summary by CodeRabbit

• Chores
  • Security-related dependency updates are now grouped by ecosystem, including GitHub Actions and Python packages.
  • This consolidates related security update pull requests, including major-version updates, into fewer reviews.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 8bab0f89-7bad-4fd7-8fbd-9d3358d834c2

📥 Commits

Reviewing files that changed from the base of the PR and between a24be9c and b3017b2.

📒 Files selected for processing (1)

• .github/dependabot.yml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

Dependabot now groups security updates by ecosystem. The configuration adds pip-security and github-actions-security groups that include all patterns and major security updates.

Changes

Dependabot security grouping

Layer / File(s)	Summary
Configure ecosystem security groups .github/dependabot.yml	The configuration documents security-update grouping and adds wildcard groups for the pip and GitHub Actions ecosystems.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to b3017

This configuration-only change is ready to merge.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: grouping Dependabot security-advisory pull requests by ecosystem.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/dependabot-security-grouping

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[3uzbcqje]

Superseded by the Dependabot consolidation, now merged on the default branch.

That config already includes a <ecosystem>-security group with applies-to: security-updates for every ecosystem in this repo — the exact change this PR proposed. Verified against the live config rather than assumed.

This PR is also based on the pre-consolidation file, so it would conflict rather than apply cleanly.

The reasoning it documented is preserved in the new config's header comments, including the point that a group without applies-to: security-updates covers version updates only, which would leave advisories arriving one PR per advisory.