chore(deps): consolidate dependabot into one grouped PR, minor/patch only

[3uzbcqje]

Pilot for an org-wide Dependabot change. There are currently 106 open Dependabot PRs across 10 Equal-Vote repos; ~60% of them are major-version bumps that were deliberately left ungrouped by the previous config.

What changes

1. Minor and patch only for routine updates.

ignore:
  - dependency-name: "*"
    update-types:
      - version-update:semver-major

The version-update: prefix scopes this to version updates. Security updates are filtered separately and are unaffected, so an advisory whose only fix is a major bump still opens a PR. Dropping the update-types: key would turn this into a blanket ignore that silences security updates too — there's a comment in the file saying so.

2. One PR instead of one per dependency. multi-ecosystem-groups merges pip and github-actions into a single weekly PR. (Single-ecosystem repos in the rollout get a plain patterns: ["*"] group instead — cross-ecosystem grouping buys nothing there.)

3. open-pull-requests-limit 10 → 3. Worth knowing this is a backstop, not the real control: it's counted per ecosystem entry rather than per repo, and security PRs are exempt from it entirely. The grouping in #2 is what actually holds the PR count down.

Cooldown windows are carried over from the existing config unchanged.

Why this repo first

multi-ecosystem-groups is GA, but its reference docs don't spell out how it interacts with ignore and open-pull-requests-limit. A config Dependabot rejects means this repo silently stops getting updates, so this lands on starpy (2 ecosystems, 4 open PRs) first. Once it's merged and confirmed working, the same generator rolls out to the other 10 repos.

This needs to merge before it can be verified — Dependabot only reads config from the default branch.

🤖 Generated with Claude Code

https://claude.ai/code/session_01XKNMLCKoVr8Xz1HePmDBXs

Summary by CodeRabbit

• Chores
  • Dependency updates are now consolidated into a single weekly pull request.
  • Major version updates are excluded from automated update requests.
  • The number of open automated dependency update requests is limited to three.
  • Automated dependency update requests now include a standard dependencies label.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 6d46b152-246d-4731-b266-ed11eca67920

📥 Commits

Reviewing files that changed from the base of the PR and between a24be9c and ec53956.

📒 Files selected for processing (1)

• .github/dependabot.yml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The Dependabot configuration now groups pip and GitHub Actions updates into one weekly pull request, ignores semver-major updates, limits each ecosystem to three open pull requests, and applies a dependencies label.

Changes

Dependabot update policy

Layer / File(s)	Summary
Grouped update configuration .github/dependabot.yml	Adds the all-dependencies multi-ecosystem group with a weekly schedule and dependencies label. Both ecosystems match all dependencies, ignore semver-major updates, and use an open pull request limit of 3.

Priority: ⚪ Not assessed

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to ec539

The Dependabot configuration supports the intended grouped weekly update policy and has no actionable merge risk.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the main change: consolidating Dependabot updates into one grouped pull request and limiting routine updates to minor and patch versions. It omits the security-update excep…
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/dependabot-consolidate

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[3uzbcqje]

Pushed a correction before this gets reviewed.

The first version of this config dropped the per-ecosystem groups in favour of multi-ecosystem-group. That was a regression for security updates. Checking the config schema, a multi-ecosystem group has no applies-to key, and its open-pull-requests-limit is described as "Limit number of open pull requests for version updates." — so cross-ecosystem grouping covers version updates only. Security advisories would have gone back to one PR per advisory.

Fixed by keeping both, which the schema allows on the same entry:

• multi-ecosystem-group: all-dependencies — one PR for all version updates across pip + github-actions
• groups: {<eco>-security: {applies-to: security-updates}} — advisories still bundle per ecosystem

Also added open-pull-requests-limit: 3 at the group level.

All 11 configs in the planned rollout now validate clean against the official schema. The validator was negative-tested first (bogus ecosystem name, unknown keys, wrong types, missing required keys — all six caught), so "valid" here means something. Runtime behaviour still needs this merged to confirm.