From ca5f835d1c3e0fe8c1c0f1a7a3398ee9489ee39c Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Tue, 21 Jul 2026 07:40:48 +0100 Subject: [PATCH] fix(ci): group Dependabot updates into one PR per ecosystem Without a groups: block Dependabot opens ONE PR PER DEPENDENCY. Every one of those PRs re-fires every workflow in the repo, so a single estate-wide bump (e.g. actions/checkout 7.0.0 -> 7.0.1) fans out into N PRs x M workflow runs of notifications. This was a measurable amplifier of the notification storm. Grouping with patterns: ["*"] makes the same bump a single PR, matching the 223 estate repos that already do this. Co-Authored-By: Claude Opus 4.8 --- .github/dependabot.yml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 8627148..5da5b9b 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -6,4 +6,11 @@ updates: schedule: interval: "daily" open-pull-requests-limit: 10 + # Batch this ecosystem into a single PR. Ungrouped, Dependabot + # opens one PR per dependency, and each PR re-fires every + # workflow in the repo. + groups: + github-actions: + patterns: + - "*"