ci: group Dependabot updates into one PR per ecosystem - #72
Conversation
Each nuget/github-actions bump was opening its own PR, which meant a handful of separate one-line-diff PRs to review per repo every week. Groups everything under one wildcard group per ecosystem so routine bumps land as a single PR.
There was a problem hiding this comment.
🔵 Needs a closer look
The updated Dependabot YAML currently has invalid indentation under ignore:, which will likely prevent Dependabot from parsing the configuration.
Pull request overview
This PR updates the repository’s Dependabot configuration to reduce PR noise by grouping routine dependency updates so that github-actions and nuget bumps land as one PR per ecosystem.
Changes:
- Add a
github-actionswildcard group to bundle all GitHub Actions updates into a single PR. - Add a
nugetwildcard group to bundle all NuGet updates into a single PR.
File summaries
| File | Description |
|---|---|
| .github/dependabot.yml | Adds wildcard grouping for github-actions and nuget updates to reduce Dependabot PR volume. |
Review details
Suppressed comments (1)
.github/dependabot.yml:28
ignore:is followed by a list item at the same indentation level, which makes the YAML invalid (the list item is not nested underignore). Dependabot will likely fail to parse this config.
ignore:
- dependency-name: "FluentAssertions" # Ignore major-version updates FluentAssertions from version 8 and above
versions: [ ">= 8.0.0" ] # because FluentAssertions requires a paid license for corporate use
update-types: [ "version-update:semver-major" ]
- Files reviewed: 1/1 changed files
- Comments generated: 0
- Review effort level: Lite
💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Copilot review flagged the pre-existing same-level indentation as invalid (it isn't - block sequences may align with their parent key per the YAML spec, and Dependabot has parsed this file correctly in production for months). Reindenting anyway to the more conventional nested style to stop the false-positive flag on review.
There was a problem hiding this comment.
🟢 Approval recommended
The Dependabot groups configuration is valid and aligns with the PR’s stated goal without introducing code changes or breaking existing ignore rules.
Review details
- Files reviewed: 1/1 changed files
- Comments generated: 0 new
- Review effort level: Lite
Copilot correctly flagged that grouping everything under a bare "*" pattern would also bundle major-version bumps in with routine minor/patch ones, turning a safe grouping into a potentially breaking mega-PR. Restricting each group to minor/patch keeps majors opening their own individual PR (still worth reviewing on their own), while the actual routine noise (the common case) gets grouped.
There was a problem hiding this comment.
🟢 Approval recommended
The Dependabot grouping configuration is valid YAML, scoped to minor/patch updates as described, and preserves the existing FluentAssertions major-version ignore behavior.
Review details
- Files reviewed: 1/1 changed files
- Comments generated: 0 new
- Review effort level: Lite
Groups
github-actionsandnugetupdates each under a wildcard group so routine bumps land as one PR per ecosystem instead of one per package.