ci: group Dependabot updates into one PR per ecosystem - #56
Conversation
Each nuget/github-actions bump was opening its own PR, which meant a handful of separate one-line-diff PRs to review per repo every week. Groups everything under one wildcard group per ecosystem so routine bumps land as a single PR.
There was a problem hiding this comment.
🔵 Needs a closer look
The ignore section’s YAML indentation is invalid as written, which can prevent Dependabot from applying the FluentAssertions major-version ignore rule (or from parsing the config correctly).
Pull request overview
This PR updates the repository’s Dependabot configuration to reduce routine dependency noise by grouping updates into one PR per ecosystem (GitHub Actions and NuGet), aligning with the motivation described from #52.
Changes:
- Adds a wildcard Dependabot update group for the
github-actionsecosystem. - Adds a wildcard Dependabot update group for the
nugetecosystem.
File summaries
| File | Description |
|---|---|
| .github/dependabot.yml | Adds wildcard update grouping for GitHub Actions and NuGet to consolidate Dependabot PRs. |
Review details
Suppressed comments (1)
.github/dependabot.yml:28
ignoreis currently not a valid YAML sequence value because the list item (- dependency-name) is aligned withignore:instead of being indented under it. This likely causes Dependabot to ignore the ignore-rule (and potentially fail parsing), which is especially important here because the comment indicates major FluentAssertions bumps must be blocked.
- "*"
ignore:
- dependency-name: "FluentAssertions" # Ignore major-version updates FluentAssertions from version 8 and above
versions: [ ">= 8.0.0" ] # because FluentAssertions requires a paid license for corporate use
update-types: [ "version-update:semver-major" ]
- Files reviewed: 1/1 changed files
- Comments generated: 0
- Review effort level: Lite
💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Copilot review flagged the pre-existing same-level indentation as invalid (it isn't - block sequences may align with their parent key per the YAML spec, and Dependabot has parsed this file correctly in production for months). Reindenting anyway to the more conventional nested style to stop the false-positive flag on review.
There was a problem hiding this comment.
🟢 Approval recommended
The Dependabot grouping configuration is valid and aligns with the stated goal of reducing one-PR-per-package churn without altering existing ignore behavior.
Review details
- Files reviewed: 1/1 changed files
- Comments generated: 0 new
- Review effort level: Lite
Copilot correctly flagged that grouping everything under a bare "*" pattern would also bundle major-version bumps in with routine minor/patch ones, turning a safe grouping into a potentially breaking mega-PR. Restricting each group to minor/patch keeps majors opening their own individual PR (still worth reviewing on their own), while the actual routine noise (the common case) gets grouped.
There was a problem hiding this comment.
🟢 Approval recommended
The Dependabot YAML is valid and the grouping behavior matches the stated goal while preserving the existing FluentAssertions major-version ignore rule.
Review details
- Files reviewed: 1/1 changed files
- Comments generated: 0 new
- Review effort level: Lite
Groups
github-actionsandnugetupdates each under a wildcard group so routine bumps land as one PR per ecosystem instead of one per package. Directly motivated by #52 today — a single dependency bump opening its own PR.