From 4054041aa42882dd888dd9c8749169a95c4909f3 Mon Sep 17 00:00:00 2001 From: JasonZQH Date: Tue, 28 Jul 2026 04:24:11 -0700 Subject: [PATCH] chore: group Dependabot updates and move them to monthly MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit A separate PR per dependency per week is a treadmill for a solo maintainer, and five simultaneously open bumps is what it produced. One group per ecosystem on a monthly cadence caps that at two PRs a month. Grouping matches on patterns alone. Splitting runtime from dev tooling would need `dependency-type`, which Dependabot documents as supported for pip but not uv — and a group that matches nothing falls back to one PR per dependency, which is the sprawl this is removing. Security advisories are unaffected: those are raised as they land, outside both this schedule and the grouping. Co-Authored-By: Claude Opus 5 (1M context) --- .github/dependabot.yml | 20 ++++++++++++++++++-- 1 file changed, 18 insertions(+), 2 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index c6fc0dd..3b3fb2b 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -5,15 +5,31 @@ # target-branch is set on every entry because Dependabot otherwise opens against the # default branch (main), while CONTRIBUTING requires PRs to be based on dev. Without # it, a merged bump lands on main only and dev's CI keeps testing the old version. +# +# Version updates are grouped and monthly: one solo maintainer triaging a separate PR +# per dependency every week is a treadmill, and five open bumps is what that produced. +# This caps it at two PRs a month. Security advisories are unaffected — Dependabot +# raises those as they land, outside this schedule and outside the grouping. +# +# One group per ecosystem, matched on patterns alone. Splitting runtime from dev tools +# would need `dependency-type`, which Dependabot supports for pip but not uv, and a +# group matching nothing falls back to one PR per dependency — the very sprawl this +# is meant to remove. version: 2 updates: - package-ecosystem: "github-actions" directory: "/" target-branch: "dev" schedule: - interval: "weekly" + interval: "monthly" + groups: + github-actions: + patterns: ["*"] - package-ecosystem: "uv" directory: "/" target-branch: "dev" schedule: - interval: "weekly" + interval: "monthly" + groups: + python-dependencies: + patterns: ["*"]