Group Dependabot security-advisory PRs per ecosystem

[3uzbcqje]

Groups Dependabot's security-advisory PRs, which the existing config does not cover.

A groups entry without applies-to defaults to version-updates only. So while minor/patch version updates have been arriving grouped since the last PR merged, security advisories still open one PR per advisory. This adds a second group per ecosystem that sets applies-to: security-updates.

Groups after this change

Ecosystem	Version updates	Security updates
terraform	terraform	terraform-security
github-actions	github-actions	github-actions-security

Notes

• The security groups use patterns: ["*"], so they include major bumps. That is deliberate — declining a security fix on the grounds that it is a major version bump is not a real option.
• This only affects PRs opened from the merge onward. Security PRs already open are not retroactively grouped and still need merging or closing by hand.
• Cooldown is untouched. Security updates are driven by Dependabot alerts, so urgent fixes are not delayed by the version-update schedule.

🤖 Generated with Claude Code

https://claude.ai/code/session_01LpZM2dqedR4fXiLn7272XQ

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 9cc1eaf6-bd2c-4ab7-a681-dd0274da0f73

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

OpenTofu Format and Style success

OpenTofu Initialization ⚙️success

OpenTofu Validation success

Validation Output

Success! The configuration is valid.

OpenTofu Plan success

Show Plan

No changes. Your infrastructure matches the configuration.

OpenTofu has compared your real infrastructure against your configuration and
found no differences, so no changes are needed.

Pusher: @3uzbcqje, Action: pull_request, Working Directory: ``, Workflow: .github/workflows/opentofu.yml

[3uzbcqje]

Superseded by the Dependabot consolidation, now merged on the default branch.

That config already includes a <ecosystem>-security group with applies-to: security-updates for every ecosystem in this repo — the exact change this PR proposed. Verified against the live config rather than assumed.

This PR is also based on the pre-consolidation file, so it would conflict rather than apply cleanly.

The reasoning it documented is preserved in the new config's header comments, including the point that a group without applies-to: security-updates covers version updates only, which would leave advisories arriving one PR per advisory.