[Eduardo Villalpando Mello (edvilme)]

Summary

• Group all npm dependencies across the root and /api manifests into one version-update PR, including development/production dependencies and major/minor/patch updates.
• Group npm security updates separately, since Dependabot does not combine security and version updates into the same group.
• Keep GitHub Actions updates grouped and cap each ecosystem at one open version-update PR.
• Automatically apply dependencies and skip package*.json labels to npm and GitHub Actions PRs, preserve github_actions for Actions updates, and accept dependencies as a valid PR impact label.
• Automatically approve non-draft Dependabot-authored PRs using a minimal-permission workflow that never checks out PR code.
• Use daily checks and a 14-day cooldown for version updates; security updates are not delayed by the cooldown.

Validation

• YAML parsing and focused assertions for both npm manifests, wildcard groups, security grouping, PR limits, labels, and approval gating passed.
• npm run lint passed.
• npm run compile-tests passed.
• npm run unittest passed: 3423 passing, 9 pending.
• Required checks ran in an isolated worktree to exclude unrelated untracked local files.

Operational notes

• Security updates are not subject to the version-update PR limit and remain separate from version-update PRs.
• Repository settings must allow GitHub Actions to create and approve pull requests; checking that setting returned HTTP 403.
• The local branch is dependabot; the remote branch is dependabot-config because existing dependabot/* refs prevent pushing a branch named dependabot.

[Bill Schnurr (bschnurr)]

🔒 Automated review in progress — Bill Schnurr (@bschnurr) is auto-reviewing this PR.