From 22fb6a5de9c414b91a699c65ab3e5383f9b6fe0d Mon Sep 17 00:00:00 2001 From: Francois Raminosona Date: Tue, 8 Sep 2026 17:32:57 +0200 Subject: [PATCH 1/3] ci: group Dependabot updates into one PR per ecosystem Each nuget/github-actions bump was opening its own PR, which meant a handful of separate one-line-diff PRs to review per repo every week. Groups everything under one wildcard group per ecosystem so routine bumps land as a single PR. --- .github/dependabot.yml | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 6071136..6aae0bf 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -9,11 +9,19 @@ updates: directory: "/" # Location of package manifests schedule: interval: "weekly" + groups: + github-actions: + patterns: + - "*" - package-ecosystem: "nuget" # See documentation for possible values directory: "/" # Location of package manifests schedule: interval: "weekly" + groups: + nuget: + patterns: + - "*" ignore: - dependency-name: "FluentAssertions" # Ignore major-version updates FluentAssertions from version 8 and above versions: [ ">= 8.0.0" ] # because FluentAssertions requires a paid license for corporate use From 6314a7be9579ad02dcccb1ebe2a0a1128fa2f9f1 Mon Sep 17 00:00:00 2001 From: Francois Raminosona Date: Tue, 8 Sep 2026 17:43:03 +0200 Subject: [PATCH 2/3] style(dependabot): indent ignore list items under their key Copilot review flagged the pre-existing same-level indentation as invalid (it isn't - block sequences may align with their parent key per the YAML spec, and Dependabot has parsed this file correctly in production for months). Reindenting anyway to the more conventional nested style to stop the false-positive flag on review. --- .github/dependabot.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 6aae0bf..c835e1c 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -23,6 +23,6 @@ updates: patterns: - "*" ignore: - - dependency-name: "FluentAssertions" # Ignore major-version updates FluentAssertions from version 8 and above - versions: [ ">= 8.0.0" ] # because FluentAssertions requires a paid license for corporate use - update-types: [ "version-update:semver-major" ] + - dependency-name: "FluentAssertions" # Ignore major-version updates FluentAssertions from version 8 and above + versions: [ ">= 8.0.0" ] # because FluentAssertions requires a paid license for corporate use + update-types: [ "version-update:semver-major" ] From d9836f5aa55d440af69277da69c1f181a592e360 Mon Sep 17 00:00:00 2001 From: Francois Raminosona Date: Tue, 8 Sep 2026 17:49:38 +0200 Subject: [PATCH 3/3] fix(dependabot): exclude major-version bumps from wildcard groups Copilot correctly flagged that grouping everything under a bare "*" pattern would also bundle major-version bumps in with routine minor/patch ones, turning a safe grouping into a potentially breaking mega-PR. Restricting each group to minor/patch keeps majors opening their own individual PR (still worth reviewing on their own), while the actual routine noise (the common case) gets grouped. --- .github/dependabot.yml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index c835e1c..fd5979c 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -13,6 +13,9 @@ updates: github-actions: patterns: - "*" + update-types: + - "minor" + - "patch" - package-ecosystem: "nuget" # See documentation for possible values directory: "/" # Location of package manifests @@ -22,6 +25,9 @@ updates: nuget: patterns: - "*" + update-types: + - "minor" + - "patch" ignore: - dependency-name: "FluentAssertions" # Ignore major-version updates FluentAssertions from version 8 and above versions: [ ">= 8.0.0" ] # because FluentAssertions requires a paid license for corporate use