From 467ad3e2bb0fd7cb705aabedd26ca6f5ea9c99e3 Mon Sep 17 00:00:00 2001
From: Jake Fineman <jakefineman@gmail.com>
Date: Tue, 8 Sep 2026 09:52:54 -0400
Subject: [PATCH 1/2] chore(ci): add dependabot.yml with npm + github-actions
 grouping

No dependabot.yml existed in this repo. Renovate is currently the
only bot raising dependency PRs here; adding Dependabot grouping
mirrors the sibling-repo pattern (sdk, mcp-server, adk) that
demonstrably self-collapses same-hunk pileups. See PR body for the
Renovate/Dependabot overlap flag.
---
 .github/dependabot.yml | 40 ++++++++++++++++++++++++++++++++++++++++
 1 file changed, 40 insertions(+)
 create mode 100644 .github/dependabot.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..250c1d5
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,40 @@
+version: 2
+updates:
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 5
+    reviewers:
+      - "wave-av/engineering"
+    labels:
+      - "dependencies"
+    commit-message:
+      prefix: "chore(deps):"
+    groups:
+      npm-dependencies:
+        patterns:
+          - "*"
+    cooldown:
+      default-days: 7
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 5
+    reviewers:
+      - "wave-av/engineering"
+    labels:
+      - "dependencies"
+      - "github-actions"
+    commit-message:
+      prefix: "chore(deps):"
+    groups:
+      github-actions-dependencies:
+        patterns:
+          - "*"
+    cooldown:
+      default-days: 7

From 90b00ded36788bfbaae0f5202e90a8b2e980e174 Mon Sep 17 00:00:00 2001
From: Jake Fineman <jakefineman@gmail.com>
Date: Tue, 8 Sep 2026 10:05:20 -0400
Subject: [PATCH 2/2] fix: correct dependency-pileup lever to Renovate
 grouping, drop dependabot.yml

Re-verified the premise: this repo has dependabot_security_updates
enabled with no dependabot.yml (Dependabot raises security PRs with
zero config), and every dependency PR in this repos history is
authored by renovate[bot] -- Dependabot has never run version updates
here. Adding a dependabot.yml with an updates: block would switch on
a second, competing version-update bot instead of collapsing the
pileup.

- Remove .github/dependabot.yml
- Add root-level renovate.json extending the shared org preset
  (local>wave-av/.github) plus the group:all preset, so Renovate
  bundles same-hunk version bumps into one PR instead of many.
- GitHub docs confirm dependabot.yml groups.applies-to: security-updates
  cannot be scoped without an enclosing updates: entry, and that entry
  is what enables version updates for the ecosystem, so grouping
  security-only PRs via dependabot.yml is not possible without also
  turning on a second version-update source.
---
 .github/dependabot.yml | 40 ----------------------------------------
 renovate.json          |  4 ++++
 2 files changed, 4 insertions(+), 40 deletions(-)
 delete mode 100644 .github/dependabot.yml
 create mode 100644 renovate.json

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
deleted file mode 100644
index 250c1d5..0000000
--- a/.github/dependabot.yml
+++ /dev/null
@@ -1,40 +0,0 @@
-version: 2
-updates:
-  - package-ecosystem: "npm"
-    directory: "/"
-    schedule:
-      interval: "weekly"
-      day: "monday"
-    open-pull-requests-limit: 5
-    reviewers:
-      - "wave-av/engineering"
-    labels:
-      - "dependencies"
-    commit-message:
-      prefix: "chore(deps):"
-    groups:
-      npm-dependencies:
-        patterns:
-          - "*"
-    cooldown:
-      default-days: 7
-
-  - package-ecosystem: "github-actions"
-    directory: "/"
-    schedule:
-      interval: "weekly"
-      day: "monday"
-    open-pull-requests-limit: 5
-    reviewers:
-      - "wave-av/engineering"
-    labels:
-      - "dependencies"
-      - "github-actions"
-    commit-message:
-      prefix: "chore(deps):"
-    groups:
-      github-actions-dependencies:
-        patterns:
-          - "*"
-    cooldown:
-      default-days: 7
diff --git a/renovate.json b/renovate.json
new file mode 100644
index 0000000..cac34c0
--- /dev/null
+++ b/renovate.json
@@ -0,0 +1,4 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": ["local>wave-av/.github", "group:all"]
+}