chore: simplify dependabot configuration for multi-ecosystem updates

Author: triceo

.github/dependabot.yml

@@ -1,86 +1,49 @@
 version: 2
-updates: # uses the default branch by default
-  - package-ecosystem: maven
-    directory: "/"
+
+multi-ecosystem-groups:
+  main:
     schedule:
-      interval: weekly
+      interval: "weekly"
       day: "monday"
       time: "01:00" # Otherwise it picks a random time.
-    open-pull-requests-limit: 99
     commit-message:
       prefix: "deps: "
-    labels: ["dependencies"] # Don't use any other labels.
-    groups:
-      # We want to control these upgrades separately.
-      # They've introduced changes in the past which required manual intervention.
-      quarkus:
-        patterns:
-          - "io.quarkus:*"
-      spring:
-        patterns:
-          - "org.springframework.boot:*"
-          - "org.springframework:*"
-          - "org.springdoc:*"
-      openrewrite:
-        patterns:
-          - "org.openrewrite.maven:*"
-          - "org.openrewrite.recipe:*"
-      # Everything else can be grouped together to minimize the number of PRs.
-      # If any dependency ever breaks our code, it will be ungrouped.
-      regular:
-        patterns:
-          - "*"
-  - package-ecosystem: "github-actions"
-    directory: "/"
+    labels: ["dependencies"]
+  1x:
     schedule:
-      interval: weekly
-      day: "monday"
-      time: "01:00" # Otherwise it picks a random time.
-    open-pull-requests-limit: 99
+      interval: "cron"
+      cronjob: "0 1 * * 1#1" # First Monday of the month
     commit-message:
       prefix: "deps: "
-    labels: ["dependencies"] # Don't use any other labels.
-    groups:
-      # Everything can be grouped together to minimize the number of PRs.
-      # If any dependency ever breaks our code, it will be ungrouped.
-      regular:
-        patterns:
-          - "*"
-  - package-ecosystem: maven
+    labels: ["dependencies"]
+
+updates:
+
+  # Do everything in one PR, on main.
+  - package-ecosystem: "maven"
+    directory: "/"
+    open-pull-requests-limit: 99
+    patterns: ["*"]
+    multi-ecosystem-group: "main"
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    open-pull-requests-limit: 99
+    patterns: ["*"]
+    multi-ecosystem-group: "main"
+
+  # Do everything in one PR, on 1.x.
+  - package-ecosystem: "maven"
     target-branch: "1.x"
     directory: "/"
-    schedule:
-      interval: "cron"
-      cronjob: "0 1 * * 1#1" # First Monday of the month
     open-pull-requests-limit: 99
-    commit-message:
-      prefix: "deps: "
-    labels: ["dependencies"] # Don't use any other labels.
     ignore:
       - dependency-name: "*"
-        update-types: ["version-update:semver-major", "version-update:semver-minor"]
-    groups:
-      # Everything else can be grouped together to minimize the number of PRs.
-      # If any dependency ever breaks our code, it will be ungrouped.
-      regular:
-        update-types:
-          - "patch"
-        patterns:
-          - "*"
-
+        update-types: [ "version-update:semver-major" ]
+    patterns: ["*"]
+    multi-ecosystem-group: "1x"
   - package-ecosystem: "github-actions"
     target-branch: "1.x"
     directory: "/"
-    schedule:
-      interval: "cron"
-      cronjob: "0 1 * * 1#1" # First Monday of the month
     open-pull-requests-limit: 99
-    commit-message:
-      prefix: "deps: "
-    labels: ["dependencies"] # Don't use any other labels.
-    groups:
-      # Everything can be grouped together to minimize the number of PRs.
-      # If any dependency ever breaks our code, it will be ungrouped.
-      regular:
-        patterns:
-          - "*"
+    patterns: ["*"]
+    multi-ecosystem-group: "1x"

.github/workflows/dependabot-validate.yml

@@ -0,0 +1,19 @@
+name: Dependabot Validation
+
+on:
+  pull_request:
+    paths:
+      - '.github/dependabot.yml'
+      - '.github/workflows/dependabot-validate.yml'
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: marocchino/validate-dependabot@d8ae5c0d03dd75fbd0ad5f8ab4ba8101ebbd4b37 # v3
+        id: validate
+      - uses: marocchino/sticky-pull-request-comment@0ea0beb66eb9baf113663a64ec522f60e49231c0 # v3.0.4
+        if: always()
+        with:
+          header: validate-dependabot
+          message: ${{ steps.validate.outputs.markdown }}