Fix: contain Dependabot PR fan-out (#427)

## What changed

- Consolidates eleven Cargo update blocks into one `directories:` block.
- Groups the same dependency across fleet crates with `group-by:
dependency-name`.
- Reduces the Cargo version-PR ceiling from 55 to 3.
- Makes both Dependabot fixer scripts generate bounded, grouped
configurations.
- Makes the coverage fixer consolidate directories and refuse
already-duplicated ecosystems instead of appending more blocks.

## Root cause

Dependabot applies its open-PR limit per update block. Eleven Cargo
blocks using the default limit of five admitted 55 simultaneous PRs. The
coverage fixer could reproduce the same N×5 shape.

## Validation

- Fixture tests for creation, consolidation, idempotency, and duplicate
refusal
- `bash -n`
- `yq eval`
- `git diff --check`
- ShellCheck (only two pre-existing warnings: dynamic source and
required-but-unused finding JSON)

Author: hyperpolymath

.github/dependabot.yml

@@ -10,58 +10,26 @@ updates:
         patterns:
           - "*"
 
-  # Rust dependencies
-  - package-ecosystem: "cargo"
-    directory: "/robot-repo-automaton"
-    schedule:
-      interval: "weekly"
-
-  - package-ecosystem: "cargo"
-    directory: "/shared-context"
-    schedule:
-      interval: "weekly"
-  
-  - package-ecosystem: "cargo"
-    directory: "/bots/echidnabot"
-    schedule:
-      interval: "weekly"
-
-  - package-ecosystem: "cargo"
-    directory: "/bots/glambot"
-    schedule:
-      interval: "weekly"
-
-  - package-ecosystem: "cargo"
-    directory: "/bots/rhodibot"
-    schedule:
-      interval: "weekly"
-
-  - package-ecosystem: "cargo"
-    directory: "/bots/seambot"
-    schedule:
-      interval: "weekly"
-
-  - package-ecosystem: "cargo"
-    directory: "/bots/sustainabot"
-    schedule:
-      interval: "weekly"
-
-  - package-ecosystem: "cargo"
-    directory: "/bots/finishingbot"
-    schedule:
-      interval: "weekly"
-
-  - package-ecosystem: "cargo"
-    directory: "/bots/accessibilitybot"
-    schedule:
-      interval: "weekly"
-
-  - package-ecosystem: "cargo"
-    directory: "/bots/cipherbot"
-    schedule:
-      interval: "weekly"
-
-  - package-ecosystem: "cargo"
-    directory: "/bots/panicbot"
-    schedule:
-      interval: "weekly"
+  # Rust dependencies. Keep every Cargo project in one update entry so the
+  # open-PR limit applies to the fleet as a whole, rather than once per bot.
+  # Grouping by dependency name updates a shared crate across every affected
+  # project in one PR instead of opening one PR per Cargo.lock.
+  - package-ecosystem: "cargo"
+    directories:
+      - "/robot-repo-automaton"
+      - "/shared-context"
+      - "/bots/echidnabot"
+      - "/bots/glambot"
+      - "/bots/rhodibot"
+      - "/bots/seambot"
+      - "/bots/sustainabot"
+      - "/bots/finishingbot"
+      - "/bots/accessibilitybot"
+      - "/bots/cipherbot"
+      - "/bots/panicbot"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 3
+    groups:
+      fleet-dependencies:
+        group-by: dependency-name

scripts/fix-dependabot-coverage.sh

@@ -51,48 +51,68 @@ if [[ ! -f "${DEPENDABOT_FILE}" ]]; then
   exit 1
 fi
 
+if ! command -v yq >/dev/null 2>&1; then
+  echo "ERROR: yq v4 is required to update Dependabot coverage safely." >&2
+  exit 1
+fi
+
 # --- Functions ---
 
 # Check whether a given ecosystem+directory pair already exists in dependabot.yml.
-# Uses a simple text-based check: looks for the ecosystem line followed by
-# the directory line within a few lines of each other.
 entry_exists() {
   local ecosystem="$1"
   local directory="$2"
 
-  # Normalise directory for matching: dependabot uses "/" for root,
-  # "/subdir" for subdirectories.
-  local dir_pattern
-  if [[ "${directory}" == "/" ]]; then
-    dir_pattern='directory: "/"'
-  else
-    dir_pattern="directory: \"${directory}\""
-  fi
-
-  # Search for the ecosystem+directory pair within the file.
-  # We look for both on adjacent lines (within 5 lines of each other).
-  if awk -v eco="\"${ecosystem}\"" -v dir="${dir_pattern}" '
-    /package-ecosystem:/ && $0 ~ eco { found_eco=NR }
-    found_eco && NR <= found_eco+5 && $0 ~ dir { exit 0 }
-    END { exit 1 }
-  ' "${DEPENDABOT_FILE}"; then
-    return 0
-  else
-    return 1
-  fi
+  ECOSYSTEM="${ecosystem}" DIRECTORY="${directory}" yq -e '
+    .updates[]
+    | select(."package-ecosystem" == strenv(ECOSYSTEM))
+    | select(
+        .directory == strenv(DIRECTORY) or
+        (.directories[]? == strenv(DIRECTORY))
+      )
+  ' "${DEPENDABOT_FILE}" >/dev/null 2>&1
 }
 
 # Append a new ecosystem+directory entry to dependabot.yml.
 append_entry() {
   local ecosystem="$1"
   local directory="$2"
+  local entry_count
+
+  entry_count="$(ECOSYSTEM="${ecosystem}" yq '
+    [.updates[] | select(."package-ecosystem" == strenv(ECOSYSTEM))] | length
+  ' "${DEPENDABOT_FILE}")"
+
+  if [[ "${entry_count}" -gt 1 ]]; then
+    echo "ERROR: ${ecosystem} already has ${entry_count} update blocks." >&2
+    echo "Consolidate them into one directories: block before adding coverage." >&2
+    return 1
+  fi
+
+  if [[ "${entry_count}" -eq 1 ]]; then
+    ECOSYSTEM="${ecosystem}" DIRECTORY="${directory}" yq -i '
+      (.updates[] | select(."package-ecosystem" == strenv(ECOSYSTEM))) |= (
+        .directories = (((.directories // [.directory]) + [strenv(DIRECTORY)]) | unique)
+        | del(.directory)
+        | ."open-pull-requests-limit" =
+            ([(."open-pull-requests-limit" // 3), 3] | min)
+        | .groups."coverage-shared"."group-by" = "dependency-name"
+      )
+    ' "${DEPENDABOT_FILE}"
+    echo "  CONSOLIDATED: ${ecosystem} @ ${directory}"
+    return 0
+  fi
 
   cat >> "${DEPENDABOT_FILE}" <<EOF
 
   - package-ecosystem: "${ecosystem}"
     directory: "${directory}"
     schedule:
-      interval: "daily"
+      interval: "weekly"
+    open-pull-requests-limit: 3
+    groups:
+      dependency-updates:
+        patterns: ["*"]
 EOF
   echo "  ADDED: ${ecosystem} @ ${directory}"
 }

scripts/fix-dependabot.sh

@@ -74,13 +74,24 @@ HEADER
       directory="/"
     fi
 
+    if [[ "${eco}" == "github-actions" ]]; then
+      limit=2
+      group=actions
+    else
+      limit=3
+      group=dependency-updates
+    fi
+
     cat <<EOF
   - package-ecosystem: "${eco}"
     directory: "${directory}"
     schedule:
       interval: "weekly"
     target-branch: "main"
-    open-pull-requests-limit: 5
+    open-pull-requests-limit: ${limit}
+    groups:
+      ${group}:
+        patterns: ["*"]
 EOF
   done
 } > "${REPO_PATH}/.github/dependabot.yml"