chore: consolidate dependabot updates

Author: fey

.github/dependabot.yml

@@ -1,75 +1,16 @@
----
-# Dependabot configuration
-#
-# This file configures automated dependency updates for a small Python project
-# managed via pyproject.toml (PEP 621) and Hatch.
-#
-# Goals:
-#  - keep Python dependencies (dev + runtime) up to date with minimal noise
-#  - keep GitHub Actions workflow updates separate from Python dependencies
-#  - batch minor and patch updates into a few focused PRs
-#  - keep potentially breaking (major) updates visible as separate PRs
-#
-# Grouping strategy:
-#  - GitHub Actions:
-#      - one grouped PR for minor/patch updates
-#      - one grouped PR for major updates
-#  - Python (pip ecosystem, pyproject.toml):
-#      - one group for development/test tooling (ruff, pytest, pytest-cov)
-#      - one catch-all group for all other Python packages (runtime deps, etc.)
-#      - major updates are not grouped and will be opened as separate PRs by default
-#
-# Recommended documentation:
-#
-# 1) Dependabot Options Reference — full list of available keys,
-#    including "groups", "update-types", etc.
-#    https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
-#
-# 2) Optimizing pull request creation — best practices for grouping updates,
-#    controlling frequency, and limiting noise in development teams.
-#    https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/optimizing-pr-creation-version-updates
-#
 version: 2
+multi-ecosystem-groups:
+  all-dependencies:
+    schedule:
+      interval: weekly
 updates:
-  # 1) Keep GitHub Actions workflows up to date
   - package-ecosystem: github-actions
-    directory: /  # Look for workflow files in the repo root
-    schedule:
-      interval: weekly  # Check for updates once a week
-    labels: [dependencies, automated, actions]
-    groups:
-      actions-minor-patch:
-        # Group all non-breaking (minor + patch) updates into a single PR
-        update-types: [minor, patch]
-      actions-major:
-        # Group all major updates for Actions into a separate PR
-        update-types: [major]
-  # 2) Python dependencies (pyproject.toml, pip ecosystem)
-  #
-  # Dependabot will read dependency definitions from pyproject.toml
-  # (and lock files if present). Here we group dev tooling separately
-  # from all other Python packages.
+    directory: /
+    patterns:
+      - "*"
+    multi-ecosystem-group: all-dependencies
   - package-ecosystem: pip
-    directory: /  # pyproject.toml is in the repo root
-    schedule:
-      interval: weekly
-    labels: [dependencies, automated, python]
-    groups:
-      python-dev-minor-patch:
-        # Development / testing tooling (from [dependency-groups].dev):
-        #  - ruff
-        #  - pytest
-        #  - pytest-cov
-        #
-        # Minor and patch updates for these tools will be grouped into a single PR.
-        patterns: [ruff, pytest, pytest-cov]
-        update-types: [minor, patch]
-      python-deps-minor-patch:
-        # Catch-all group for all other Python dependencies:
-        #  - any future runtime dependencies added under [project] dependencies
-        #  - any package not matched by python-dev-minor-patch
-        #
-        # Minor and patch updates for these packages will be grouped together.
-        # Major updates for any Python package will be opened as separate PRs
-        # by default, which makes potentially breaking changes easier to review.
-        update-types: [minor, patch]
+    directory: /
+    patterns:
+      - "*"
+    multi-ecosystem-group: all-dependencies