chore: group dependabot pull requests

[Strum355]

Description

Based on https://github.blog/changelog/2023-06-29-grouped-version-updates-for-dependabot-public-beta/, to reduce the number of EA releases that are made to NPM registry and to avoid having to manually recreate dependency bumps locally.

Checklist

• I have followed this repository's contributing guidelines.
• I will adhere to the project's code of conduct.

Additional information

Anything else?

[qodo-code-review]

Review Summary by Qodo

Configure Dependabot grouped version updates

✨ Enhancement

Walkthroughs

Description

• Add YAML schema validation for dependabot configuration
• Group all dependency updates by ecosystem type
• Consolidate multiple PRs into single grouped releases
• Reduce number of automated dependency bump releases

Diagram

flowchart LR
  A["Dependabot Config"] --> B["Add Schema Validation"]
  A --> C["Group Dependencies"]
  C --> D["npm-dependencies"]
  C --> E["dockerfile"]
  C --> F["github-actions"]
  D --> G["Single Grouped PR"]
  E --> G
  F --> G

Loading

File Changes

1. .github/dependabot.yml ⚙️ Configuration changes +13/-0

Add schema validation and dependency grouping

• Added YAML schema validation reference for dependabot configuration
• Introduced dependency grouping for npm packages with wildcard pattern matching
• Added grouping for Docker image dependencies
• Added grouping for GitHub Actions dependencies
• Consolidated all ecosystem updates to use grouped version updates

.github/dependabot.yml

---

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (1) 📘 Rule violations (0) 📎 Requirement gaps (0)

1. Over-broad grouping '*' 🐞 Bug ⛯ Reliability

Description

Dependabot groups for npm/docker/github-actions use patterns: ['*'], which will combine all
updates for each ecosystem into a single PR. This increases failure blast radius and makes it harder
to isolate which update broke CI or introduced regressions, especially given the number of npm deps
and workflow actions in this repo.

Code

.github/dependabot.yml[R10-29]

+    groups:
+      npm-dependencies:
+        patterns:
+          - "*"
  - package-ecosystem: "docker"
    directory: "/docker-image/Dockerfiles"
    schedule:
      interval: "daily"
+    groups:
+      dockerfile:
+        patterns:
+          - "*"
  - package-ecosystem: "github-actions"
    directory: "/"
    schedule:
      interval: "weekly"
+    groups:
+      github-actions:
+        patterns:
+          - "*"

Evidence

The Dependabot config explicitly groups all dependencies (pattern *) for npm, docker, and GitHub
Actions. The repo has a non-trivial set of npm dependencies/devDependencies, and the workflows
reference many third-party actions; bundling updates together increases the likelihood that at least
one update in the bundle causes CI failures and complicates pinpointing the culprit.

.github/dependabot.yml[10-29]
package.json[46-75]
.github/workflows/test.yml[27-77]
.github/workflows/push-to-registry.yml[25-88]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
Dependabot is configured to group *all* updates for npm, docker, and GitHub Actions via `patterns: ['*']`. This will produce large, multi-change PRs that are harder to review and debug when CI fails.

### Issue Context
The repository uses multiple npm dependencies and a number of third-party GitHub Actions across workflows. Grouping everything together increases the chance that at least one update causes failures and makes it harder to identify the breaking change.

### Fix Focus Areas
- .github/dependabot.yml[10-29]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

ⓘ The new review experience is currently in Beta. Learn more