ci(dependabot): broaden auto-merge coverage and rebalance update groups (#8939)

Auto-merge covered only dev dependencies, GitHub Actions, and the catch-all
test-version group. The test-only plugin-version cohorts and digest-pinned
docker images were reviewed by hand despite being fully CI-gated, and security
advisories matched no group at all, so a vulnerability in any manifest --
fixtures included -- lingered until a human noticed and tripped vulnerability
reporting.

1. Auto-merge the test-only plugin-version cohorts and docker base images;
   production npm and vendored version updates stay on manual review since they
   ship to customers.
2. Rebalance the plugin-version cohorts so the catch-all no longer holds most
   libraries: drop the standalone opentelemetry group, fold messaging into
   cloud-and-messaging, add web-frameworks, and broaden databases and
   testing-and-build.
3. Group security updates per manifest and auto-merge them, split into
   security-production (ships to customers, majors held for human review) and
   security-non-production (dev, fixtures, infra; auto-merges fully).

Author: BridgeAR

.github/dependabot.yml

@@ -23,6 +23,10 @@ updates:
       gh-actions-packages:
         patterns:
           - "*"
+      security-non-production:
+        applies-to: security-updates
+        patterns:
+          - "*"
     labels:
       - dependabot
       - dependencies
@@ -51,6 +55,10 @@ updates:
       docker-images:
         patterns:
           - "*"
+      security-non-production:
+        applies-to: security-updates
+        patterns:
+          - "*"
 
   # Regular npm packages that fall into our supported ranges besides OTEL
   - package-ecosystem: "npm"
@@ -112,6 +120,18 @@ updates:
         update-types:
           - "minor"
           - "patch"
+      # Security fixes for shipped (production) dependencies; a human reviews majors.
+      security-production:
+        applies-to: security-updates
+        dependency-type: "production"
+        patterns:
+          - "*"
+      # Security fixes for dev-only dependencies; auto-merges fully.
+      security-non-production:
+        applies-to: security-updates
+        dependency-type: "development"
+        patterns:
+          - "*"
 
   # Vendored dependencies
   - package-ecosystem: "npm"
@@ -159,6 +179,11 @@ updates:
         update-types:
           - "minor"
           - "patch"
+      # Vendored code is bundled into the shipped package, so it counts as production.
+      security-production:
+        applies-to: security-updates
+        patterns:
+          - "*"
 
   # Instrumented library support range
   - package-ecosystem: "npm"
@@ -182,7 +207,9 @@ updates:
       - dependency-name: "office-addin-mock"
         # Pinned to 2.x due to compatibility issues with newer major versions
         update-types: ["version-update:semver-major"]
-    # Cohort-based groups so a single breaking bump only blocks its own PR.
+    # Cohort-based groups so a single breaking bump only blocks its own PR. A dependency lands
+    # in the first cohort it matches; `test-versions` is the catch-all for the long tail
+    # (OpenTelemetry, OpenFeature, logging, templating, serialization, runtimes, misc).
     groups:
       ai-and-llm:
         patterns:
@@ -196,57 +223,148 @@ updates:
           - "ai"
           - "langchain"
           - "openai"
-      serverless:
+      cloud-and-messaging:
         patterns:
           - "@aws-sdk/*"
           - "@azure/*"
+          - "@confluentinc/kafka-javascript"
+          - "@google-cloud/*"
+          - "@nats-io/*"
           - "@smithy/*"
+          - "amqp10"
+          - "amqplib"
+          - "avsc"
           - "aws-sdk"
           - "azure-functions-core-tools"
+          - "bullmq"
           - "durable-functions"
-      opentelemetry:
-        patterns:
-          - "@opentelemetry/*"
-          - "opentracing"
-      test-optimization:
-        patterns:
-          - "@fast-check/jest"
-          - "@happy-dom/jest-environment"
-          - "@jest/*"
-          - "@playwright/test"
-          - "@vitest/*"
-          - "babel-jest"
-          - "jest-*"
-          - "jest"
-          - "mocha-each"
-          - "mocha"
-          - "nyc"
-          - "playwright-core"
-          - "playwright"
-          - "tinypool"
-          - "vitest"
+          - "kafkajs"
+          - "rhea"
       databases:
         patterns:
-          - "@node-redis/client"
+          - "@elastic/*"
+          - "@node-redis/*"
+          - "@opensearch-project/*"
           - "@prisma/*"
-          - "@redis/client"
+          - "@redis/*"
+          - "aerospike"
+          - "bson"
+          - "cassandra-driver"
+          - "couchbase"
+          - "elasticsearch"
+          - "generic-pool"
           - "ioredis"
-          - "mongodb-core"
+          - "iovalkey"
+          - "knex"
+          - "mariadb"
+          - "memcached"
           - "mongodb"
+          - "mongodb-core"
           - "mongoose"
+          - "mquery"
           - "mysql"
           - "mysql2"
+          - "oracledb"
+          - "pg"
           - "pg-cursor"
           - "pg-native"
           - "pg-query-stream"
-          - "pg"
           - "prisma"
           - "redis"
+          - "sequelize"
+          - "sharedb"
           - "sqlite3"
           - "tedious"
+      web-frameworks:
+        patterns:
+          - "@apollo/*"
+          - "@fastify/*"
+          - "@graphql-tools/*"
+          - "@grpc/*"
+          - "@hapi/*"
+          - "@hono/*"
+          - "@koa/*"
+          - "apollo-server-core"
+          - "apollo-server-express"
+          - "apollo-server-fastify"
+          - "axios"
+          - "body-parser"
+          - "connect"
+          - "cookie"
+          - "cookie-parser"
+          - "ejs"
+          - "express"
+          - "express-mongo-sanitize"
+          - "express-session"
+          - "fastify"
+          - "find-my-way"
+          - "graphql"
+          - "graphql-tag"
+          - "graphql-tools"
+          - "graphql-yoga"
+          - "handlebars"
+          - "hapi"
+          - "hono"
+          - "koa"
+          - "koa-route"
+          - "koa-router"
+          - "koa-websocket"
+          - "ldapjs"
+          - "ldapjs-promise"
+          - "light-my-request"
+          - "loopback"
+          - "microgateway-core"
+          - "middie"
+          - "multer"
+          - "passport"
+          - "passport-http"
+          - "passport-local"
+          - "pug"
+          - "request"
+          - "restify"
+          - "router"
+          - "undici"
+          - "ws"
+      testing-and-build:
+        patterns:
+          - "@babel/*"
+          - "@cucumber/*"
+          - "@electron/*"
+          - "@fast-check/jest"
+          - "@happy-dom/jest-environment"
+          - "@jest/*"
+          - "@playwright/test"
+          - "@vitest/*"
+          - "babel-jest"
+          - "cypress"
+          - "cypress-fail-fast"
+          - "electron"
+          - "esbuild"
+          - "jest"
+          - "jest-*"
+          - "mocha"
+          - "mocha-each"
+          - "next"
+          - "nock"
+          - "nyc"
+          - "office-addin-mock"
+          - "playwright"
+          - "playwright-core"
+          - "react"
+          - "react-dom"
+          - "selenium-webdriver"
+          - "sinon"
+          - "tinypool"
+          - "typescript"
+          - "vitest"
+          - "workerpool"
       test-versions:
         patterns:
           - "*"
+      security-non-production:
+        applies-to: security-updates
+        patterns:
+          - "*"
 
   # Esbuild integration test dependencies
   - package-ecosystem: "npm"
@@ -274,3 +392,7 @@ updates:
       test-versions:
         patterns:
           - "*"
+      security-non-production:
+        applies-to: security-updates
+        patterns:
+          - "*"

.github/workflows/dependabot-automation.yml

@@ -8,8 +8,11 @@ on:
       - synchronize
 
 env:
-  # Add Groups here to enable auto-merge for Dependabot PRs
-  GROUPS: '["dev-minor-and-patch-dependencies", "gh-actions-packages", "test-versions"]'
+  # Add Groups here to enable auto-merge for Dependabot PRs. Production npm *version* updates
+  # (`runtime-minor-and-patch-dependencies`, `vendor-minor-and-patch-dependencies`) are
+  # intentionally absent: they ship to customers and stay on manual review. Production
+  # *security* fixes still auto-merge (see `security-production`), but only below a major.
+  GROUPS: '["dev-minor-and-patch-dependencies", "gh-actions-packages", "docker-images", "ai-and-llm", "cloud-and-messaging", "databases", "web-frameworks", "testing-and-build", "test-versions", "security-production", "security-non-production"]'
 
 jobs:
   dependabot-automation:
@@ -31,14 +34,23 @@ jobs:
         uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # 3.1.0
         with:
           github-token: "${{ steps.octo-sts.outputs.token }}"
+      # A major bump in `security-production` ships a breaking change to customers, so a human
+      # reviews it. Every other allowed group auto-merges regardless of semver level: test-only
+      # matrix bumps, non-production security fixes, and majors already gated by dependabot.yml.
       - name: Approve a PR
-        if: contains(fromJSON(env.GROUPS), steps.metadata.outputs.dependency-group)
+        if: >-
+          contains(fromJSON(env.GROUPS), steps.metadata.outputs.dependency-group) &&
+          (steps.metadata.outputs.dependency-group != 'security-production' ||
+          steps.metadata.outputs.update-type != 'version-update:semver-major')
         run: gh pr review --approve "$PR_URL"
         env:
           PR_URL: ${{ github.event.pull_request.html_url }}
           GH_TOKEN: ${{ steps.octo-sts.outputs.token }}
       - name: Enable auto-merge for Dependabot PRs
-        if: contains(fromJSON(env.GROUPS), steps.metadata.outputs.dependency-group)
+        if: >-
+          contains(fromJSON(env.GROUPS), steps.metadata.outputs.dependency-group) &&
+          (steps.metadata.outputs.dependency-group != 'security-production' ||
+          steps.metadata.outputs.update-type != 'version-update:semver-major')
         run: gh pr merge --auto --squash "$PR_URL"
         env:
           PR_URL: ${{ github.event.pull_request.html_url }}