From e4a8ab0dd81a5c3f5f98d9914f76bb40a5b968fc Mon Sep 17 00:00:00 2001
From: Tim Bradgate <timbradgate@hotmail.co.uk>
Date: Mon, 21 Sep 2026 21:12:44 +0100
Subject: [PATCH] Group dependabot version updates per ecosystem (#1402)
 (#1408)

dev requires branches to be up to date before merging, so every merged
dependabot PR forces the remaining ones to rebase and rerun the full CI
suite. On 2026-09-21 dependabot opened 13 separate PRs; on 2026-09-18 five
pip bumps merged one CI cycle (~6-7 min) apart.

Add one group per npm directory (client, client-v3, electron), pip and
github-actions so each produces a single PR. Groups cover minor and patch
updates only; majors remain ignored. Docker is left ungrouped.


(cherry picked from commit c85c4ec0710553614fdec659cb8b28e49eecc5cd)

Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
---
 .github/dependabot.yml | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 1552610ee..96ca87c53 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -1,4 +1,8 @@
 version: 2
+# Version updates are grouped per ecosystem/directory so each one produces a single
+# PR (and a single CI run) instead of one PR per dependency. `dev` requires branches
+# to be up to date before merging, so N separate PRs means N serial rebase + full-CI
+# cycles. Security updates are not affected: they are opened separately and immediately.
 updates:
   - package-ecosystem: "npm"
     directory: "/client"
@@ -16,6 +20,10 @@ updates:
         versions: [">=5.0.0"]
       - dependency-name: "*"
         update-types: ["version-update:semver-major"]
+    groups:
+      client-npm:
+        patterns: ["*"]
+        update-types: ["minor", "patch"]
     versioning-strategy: increase
     target-branch: dev
   - package-ecosystem: "npm"
@@ -25,6 +33,10 @@ updates:
     ignore:
       - dependency-name: "*"
         update-types: ["version-update:semver-major"]
+    groups:
+      client-v3-npm:
+        patterns: ["*"]
+        update-types: ["minor", "patch"]
     versioning-strategy: increase
     target-branch: dev
   - package-ecosystem: "npm"
@@ -34,6 +46,10 @@ updates:
     ignore:
       - dependency-name: "*"
         update-types: [ "version-update:semver-major" ]
+    groups:
+      electron-npm:
+        patterns: ["*"]
+        update-types: ["minor", "patch"]
     versioning-strategy: increase
     target-branch: dev
   - package-ecosystem: "pip"
@@ -43,6 +59,10 @@ updates:
     ignore:
       - dependency-name: "*"
         update-types: ["version-update:semver-major"]
+    groups:
+      server-pip:
+        patterns: ["*"]
+        update-types: ["minor", "patch"]
     versioning-strategy: increase
     target-branch: dev
   - package-ecosystem: "docker"
@@ -60,4 +80,8 @@ updates:
     ignore:
       - dependency-name: "*"
         update-types: ["version-update:semver-major"]
+    groups:
+      github-actions:
+        patterns: ["*"]
+        update-types: ["minor", "patch"]
     target-branch: dev