From 50773875d8133d5eb61620e2ecb9b70afb422417 Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Tue, 21 Jul 2026 07:39:30 +0100
Subject: [PATCH] fix(ci): group Dependabot updates into one PR per ecosystem

Without a groups: block Dependabot opens ONE PR PER DEPENDENCY. Every one of
those PRs re-fires every workflow in the repo, so a single estate-wide bump
(e.g. actions/checkout 7.0.0 -> 7.0.1) fans out into N PRs x M workflow runs
of notifications. This was a measurable amplifier of the notification storm.

Grouping with patterns: ["*"] makes the same bump a single PR, matching the
223 estate repos that already do this.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 .github/dependabot.yml | 42 ++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 42 insertions(+)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 8a7fd59..b498e3c 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -8,6 +8,13 @@ updates:
     open-pull-requests-limit: 5
 
   # npm (JavaScript/TypeScript)
+    # Batch this ecosystem into a single PR. Ungrouped, Dependabot
+    # opens one PR per dependency, and each PR re-fires every
+    # workflow in the repo.
+    groups:
+      github-actions:
+        patterns:
+          - "*"
   - package-ecosystem: "npm"
     directory: "/"
     schedule:
@@ -15,6 +22,13 @@ updates:
     open-pull-requests-limit: 10
 
   # pip (Python)
+    # Batch this ecosystem into a single PR. Ungrouped, Dependabot
+    # opens one PR per dependency, and each PR re-fires every
+    # workflow in the repo.
+    groups:
+      npm:
+        patterns:
+          - "*"
   - package-ecosystem: "pip"
     directory: "/"
     schedule:
@@ -22,6 +36,13 @@ updates:
     open-pull-requests-limit: 10
 
   # cargo (Rust)
+    # Batch this ecosystem into a single PR. Ungrouped, Dependabot
+    # opens one PR per dependency, and each PR re-fires every
+    # workflow in the repo.
+    groups:
+      pip:
+        patterns:
+          - "*"
   - package-ecosystem: "cargo"
     directory: "/"
     schedule:
@@ -29,6 +50,13 @@ updates:
     open-pull-requests-limit: 5
 
   # gomod (Go)
+    # Batch this ecosystem into a single PR. Ungrouped, Dependabot
+    # opens one PR per dependency, and each PR re-fires every
+    # workflow in the repo.
+    groups:
+      cargo:
+        patterns:
+          - "*"
   - package-ecosystem: "gomod"
     directory: "/"
     schedule:
@@ -36,8 +64,22 @@ updates:
     open-pull-requests-limit: 5
 
   # composer (PHP)
+    # Batch this ecosystem into a single PR. Ungrouped, Dependabot
+    # opens one PR per dependency, and each PR re-fires every
+    # workflow in the repo.
+    groups:
+      gomod:
+        patterns:
+          - "*"
   - package-ecosystem: "composer"
     directory: "/"
     schedule:
       interval: "weekly"
     open-pull-requests-limit: 5
+    # Batch this ecosystem into a single PR. Ungrouped, Dependabot
+    # opens one PR per dependency, and each PR re-fires every
+    # workflow in the repo.
+    groups:
+      composer:
+        patterns:
+          - "*"