ci(dependabot): group minor and patch updates into a single PR (#69)

Bundle GitHub Actions and Go module minor/patch bumps into one weekly PR
per ecosystem. Major versions still open individual PRs so breaking
changes get isolated review.

Also extend the auto-merge gate to allow grouped PRs (which have an
empty `update-type` and a populated `dependency-group`).

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: adrianbrad

.github/dependabot.yaml

@@ -10,6 +10,13 @@ updates:
       prefix: "build(deps)"
     reviewers:
       - "adrianbrad"
+    groups:
+      go-modules:
+        patterns:
+          - "*"
+        update-types:
+          - "minor"
+          - "patch"
 
   - package-ecosystem: github-actions
     directory: "/"
@@ -20,4 +27,11 @@ updates:
     commit-message:
       prefix: "build(deps)"
     reviewers:
-      - "adrianbrad"
+      - "adrianbrad"
+    groups:
+      github-actions:
+        patterns:
+          - "*"
+        update-types:
+          - "minor"
+          - "patch"

.github/workflows/dependabot-auto-merge.yaml

@@ -21,14 +21,14 @@ jobs:
           github-token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Approve PR
-        if: steps.metadata.outputs.update-type == 'version-update:semver-patch' || steps.metadata.outputs.update-type == 'version-update:semver-minor'
+        if: steps.metadata.outputs.update-type == 'version-update:semver-patch' || steps.metadata.outputs.update-type == 'version-update:semver-minor' || steps.metadata.outputs.dependency-group != ''
         run: gh pr review --approve "$PR_URL"
         env:
           PR_URL: ${{ github.event.pull_request.html_url }}
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Enable auto-merge
-        if: steps.metadata.outputs.update-type == 'version-update:semver-patch' || steps.metadata.outputs.update-type == 'version-update:semver-minor'
+        if: steps.metadata.outputs.update-type == 'version-update:semver-patch' || steps.metadata.outputs.update-type == 'version-update:semver-minor' || steps.metadata.outputs.dependency-group != ''
         run: gh pr merge --auto --squash "$PR_URL"
         env:
           PR_URL: ${{ github.event.pull_request.html_url }}