chore(dependabot): group minor+patch, lower PR cap, monthly Maven/NuGet (#135)

* chore(dependabot): group minor+patch, lower PR cap, monthly Maven/NuGet

Tweaks to reduce open-PR noise (was sitting at ~57 across all ecosystems):

- Add `groups: minor-and-patch` per directory so a single weekly Angular
  monorepo release (or RN peer-package set) collapses into one PR instead
  of fanning out into 5+. Major bumps still get individual PRs.
- Lower `open-pull-requests-limit` from 5 to 3 — grouping makes the higher
  cap unnecessary.
- Move Maven (Java/Spring Boot) and NuGet (Microsoft.*) to a monthly
  schedule. Both ecosystems release on slower cadences than npm; weekly
  was paying for noise that wasn't there.
- DRY the file with YAML anchors + merge keys: 196 → 113 lines, one block
  per ecosystem instead of nineteen.

Expected steady-state open dependabot PRs: ~57 → ~10–15.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* chore(dependabot): collapse same-framework directories into one entry

Use `directories:` (plural) so login-pkce + token-refresh in the same
framework share a single dependabot entry, producing one grouped PR per
framework per cycle instead of one per directory. login-pkce and
token-refresh have effectively identical package.json dependencies, so
the bumps were always traveling together anyway.

19 update entries → 9 (one per framework + scripts + github-actions).
Steady-state open dependabot PRs: ~10–15 → ~5–7.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(dependabot): inline-expand YAML anchors

Dependabot's YAML parser doesn't support aliases / merge keys ("YAML
aliases are not supported"), so the common per-entry settings now have
to be duplicated explicitly. File grows from 97 → 151 lines but stays
well below the original 196 because we still collapsed from 19 entries
to 9 via `directories:` (plural).

No behavioral change.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: ksroda-sa

.github/dependabot.yml

@@ -1,195 +1,151 @@
 version: 2
-updates:
-  - package-ecosystem: "npm"
-    directory: "/samples/react/login-pkce"
-    schedule:
-      interval: "weekly"
-    open-pull-requests-limit: 5
-    labels:
-      - "dependencies"
-    commit-message:
-      prefix: "deps"
-
-  - package-ecosystem: "npm"
-    directory: "/samples/react/token-refresh"
-    schedule:
-      interval: "weekly"
-    open-pull-requests-limit: 5
-    labels:
-      - "dependencies"
-    commit-message:
-      prefix: "deps"
-
-  - package-ecosystem: "npm"
-    directory: "/samples/angular/login-pkce"
-    schedule:
-      interval: "weekly"
-    open-pull-requests-limit: 5
-    labels:
-      - "dependencies"
-    commit-message:
-      prefix: "deps"
 
-  - package-ecosystem: "npm"
-    directory: "/samples/angular/token-refresh"
-    schedule:
-      interval: "weekly"
-    open-pull-requests-limit: 5
-    labels:
-      - "dependencies"
-    commit-message:
-      prefix: "deps"
-
-  - package-ecosystem: "npm"
-    directory: "/samples/vue/login-pkce"
-    schedule:
-      interval: "weekly"
-    open-pull-requests-limit: 5
-    labels:
-      - "dependencies"
-    commit-message:
-      prefix: "deps"
-
-  - package-ecosystem: "npm"
-    directory: "/samples/vue/token-refresh"
-    schedule:
-      interval: "weekly"
-    open-pull-requests-limit: 5
-    labels:
-      - "dependencies"
-    commit-message:
-      prefix: "deps"
+# Each framework groups its login-pkce + token-refresh directories into a
+# single entry via `directories:` (plural) — those samples share package.json
+# contents, so the bumps always travel together. Combined with
+# `groups: minor-and-patch`, this collapses what used to be ~57 open PRs into
+# ~5–7 steady-state.
+#
+# Major bumps still get individual PRs (groups only covers minor/patch) so a
+# human reads the changelog before merging.
+#
+# NOTE: Dependabot's YAML parser does NOT support aliases / merge keys, so the
+# common settings are duplicated explicitly below.
 
+updates:
+  # ── npm samples ─────────────────────────────────────────────────────────
   - package-ecosystem: "npm"
-    directory: "/samples/node/login-auth-code"
+    directories:
+      - "/samples/react/login-pkce"
+      - "/samples/react/token-refresh"
     schedule:
       interval: "weekly"
-    open-pull-requests-limit: 5
-    labels:
-      - "dependencies"
+    open-pull-requests-limit: 3
+    labels: ["dependencies"]
     commit-message:
       prefix: "deps"
+    groups:
+      minor-and-patch:
+        patterns: ["*"]
+        update-types: ["minor", "patch"]
 
   - package-ecosystem: "npm"
-    directory: "/samples/node/saml-sp-login"
+    directories:
+      - "/samples/angular/login-pkce"
+      - "/samples/angular/token-refresh"
     schedule:
       interval: "weekly"
-    open-pull-requests-limit: 5
-    labels:
-      - "dependencies"
+    open-pull-requests-limit: 3
+    labels: ["dependencies"]
     commit-message:
       prefix: "deps"
+    groups:
+      minor-and-patch:
+        patterns: ["*"]
+        update-types: ["minor", "patch"]
 
   - package-ecosystem: "npm"
-    directory: "/samples/node/token-refresh"
+    directories:
+      - "/samples/vue/login-pkce"
+      - "/samples/vue/token-refresh"
     schedule:
       interval: "weekly"
-    open-pull-requests-limit: 5
-    labels:
-      - "dependencies"
+    open-pull-requests-limit: 3
+    labels: ["dependencies"]
     commit-message:
       prefix: "deps"
+    groups:
+      minor-and-patch:
+        patterns: ["*"]
+        update-types: ["minor", "patch"]
 
-  # React Native samples — the auto-merge workflow excludes
-  # /samples/react-native/* by directory match, so bumps here always require
-  # human review. Dep bumps can break native autolinking / API shapes that
-  # `tsc --noEmit` doesn't catch. The "manual-review" label is informational
-  # only (the workflow filter is directory-based, not label-based).
   - package-ecosystem: "npm"
-    directory: "/samples/react-native/login-pkce"
+    directories:
+      - "/samples/node/login-auth-code"
+      - "/samples/node/saml-sp-login"
+      - "/samples/node/token-refresh"
     schedule:
       interval: "weekly"
-    open-pull-requests-limit: 5
-    labels:
-      - "dependencies"
-      - "manual-review"
+    open-pull-requests-limit: 3
+    labels: ["dependencies"]
     commit-message:
       prefix: "deps"
+    groups:
+      minor-and-patch:
+        patterns: ["*"]
+        update-types: ["minor", "patch"]
 
+  # React Native — auto-merge workflow excludes /samples/react-native/* by
+  # directory match, so bumps always require human review. Dep bumps can break
+  # native autolinking / API shapes that `tsc --noEmit` doesn't catch. The
+  # "manual-review" label is informational (the workflow filter is dir-based).
   - package-ecosystem: "npm"
-    directory: "/samples/react-native/token-refresh"
+    directories:
+      - "/samples/react-native/login-pkce"
+      - "/samples/react-native/token-refresh"
     schedule:
       interval: "weekly"
-    open-pull-requests-limit: 5
-    labels:
-      - "dependencies"
-      - "manual-review"
+    open-pull-requests-limit: 3
+    labels: ["dependencies", "manual-review"]
     commit-message:
       prefix: "deps"
+    groups:
+      minor-and-patch:
+        patterns: ["*"]
+        update-types: ["minor", "patch"]
 
   - package-ecosystem: "npm"
     directory: "/scripts"
     schedule:
       interval: "weekly"
     open-pull-requests-limit: 3
-    labels:
-      - "dependencies"
-    commit-message:
-      prefix: "deps"
-
-  - package-ecosystem: "maven"
-    directory: "/samples/java/login-auth-code"
-    schedule:
-      interval: "weekly"
-    open-pull-requests-limit: 5
-    labels:
-      - "dependencies"
-    commit-message:
-      prefix: "deps"
-
-  - package-ecosystem: "maven"
-    directory: "/samples/java/saml-sp-login"
-    schedule:
-      interval: "weekly"
-    open-pull-requests-limit: 5
-    labels:
-      - "dependencies"
+    labels: ["dependencies"]
     commit-message:
       prefix: "deps"
+    groups:
+      minor-and-patch:
+        patterns: ["*"]
+        update-types: ["minor", "patch"]
 
+  # ── Maven (Java) ────────────────────────────────────────────────────────
+  # Monthly cadence: Spring Boot + plugin updates move slower than npm.
   - package-ecosystem: "maven"
-    directory: "/samples/java/token-refresh"
+    directories:
+      - "/samples/java/login-auth-code"
+      - "/samples/java/saml-sp-login"
+      - "/samples/java/token-refresh"
     schedule:
-      interval: "weekly"
-    open-pull-requests-limit: 5
-    labels:
-      - "dependencies"
-    commit-message:
-      prefix: "deps"
-
-  - package-ecosystem: "nuget"
-    directory: "/samples/dotnet/login-auth-code"
-    schedule:
-      interval: "weekly"
-    open-pull-requests-limit: 5
-    labels:
-      - "dependencies"
-    commit-message:
-      prefix: "deps"
-
-  - package-ecosystem: "nuget"
-    directory: "/samples/dotnet/saml-sp-login"
-    schedule:
-      interval: "weekly"
-    open-pull-requests-limit: 5
-    labels:
-      - "dependencies"
+      interval: "monthly"
+    open-pull-requests-limit: 3
+    labels: ["dependencies"]
     commit-message:
       prefix: "deps"
+    groups:
+      minor-and-patch:
+        patterns: ["*"]
+        update-types: ["minor", "patch"]
 
+  # ── NuGet (.NET) ────────────────────────────────────────────────────────
+  # Monthly cadence: Microsoft.* packages bunch around SDK release cycles.
   - package-ecosystem: "nuget"
-    directory: "/samples/dotnet/token-refresh"
+    directories:
+      - "/samples/dotnet/login-auth-code"
+      - "/samples/dotnet/saml-sp-login"
+      - "/samples/dotnet/token-refresh"
     schedule:
-      interval: "weekly"
-    open-pull-requests-limit: 5
-    labels:
-      - "dependencies"
+      interval: "monthly"
+    open-pull-requests-limit: 3
+    labels: ["dependencies"]
     commit-message:
       prefix: "deps"
+    groups:
+      minor-and-patch:
+        patterns: ["*"]
+        update-types: ["minor", "patch"]
 
+  # ── GitHub Actions ──────────────────────────────────────────────────────
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
       interval: "weekly"
-    labels:
-      - "dependencies"
+    labels: ["dependencies"]