From 5c203572d89b251e1e5cad7bb0fab89fb149fbad Mon Sep 17 00:00:00 2001
From: Marius Helf <marius@happyyeti.tech>
Date: Tue, 20 Oct 2026 13:43:52 +0200
Subject: [PATCH] chore: monthly Dependabot updates, grouped per ecosystem

Minor and patch updates come as one PR per ecosystem a month, which
saves CI minutes. Major and security updates still get their own PRs.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .github/dependabot.yml          | 14 ++++++++++++--
 template/.github/dependabot.yml | 14 ++++++++++++--
 tests/test_template.py          |  4 +++-
 3 files changed, 27 insertions(+), 5 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 663d7e3..1dbeb24 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -1,18 +1,28 @@
+# Monthly, with minor and patch updates grouped into one PR per ecosystem.
+# Major updates and security updates still come as their own PRs.
 version: 2
 updates:
   - package-ecosystem: uv
     directory: "/"
     schedule:
-      interval: weekly
+      interval: monthly
     # Wait a week before proposing a new release. Security updates ignore this.
     cooldown:
       default-days: 7
+    groups:
+      uv:
+        patterns: ["*"]
+        update-types: [minor, patch]
   - package-ecosystem: github-actions
     # "/template/.github/workflows" holds the workflows that generated projects receive.
     directories:
       - "/"
       - "/template/.github/workflows"
     schedule:
-      interval: weekly
+      interval: monthly
     cooldown:
       default-days: 7
+    groups:
+      github-actions:
+        patterns: ["*"]
+        update-types: [minor, patch]
diff --git a/template/.github/dependabot.yml b/template/.github/dependabot.yml
index 33b5b50..e32962c 100644
--- a/template/.github/dependabot.yml
+++ b/template/.github/dependabot.yml
@@ -1,15 +1,25 @@
+# Monthly, with minor and patch updates grouped into one PR per ecosystem.
+# Major updates and security updates still come as their own PRs.
 version: 2
 updates:
   - package-ecosystem: uv
     directory: "/"
     schedule:
-      interval: weekly
+      interval: monthly
     # Wait a week before proposing a new release. Security updates ignore this.
     cooldown:
       default-days: 7
+    groups:
+      uv:
+        patterns: ["*"]
+        update-types: [minor, patch]
   - package-ecosystem: github-actions
     directory: "/"
     schedule:
-      interval: weekly
+      interval: monthly
     cooldown:
       default-days: 7
+    groups:
+      github-actions:
+        patterns: ["*"]
+        update-types: [minor, patch]
diff --git a/tests/test_template.py b/tests/test_template.py
index 8eb97ac..cdf56e5 100644
--- a/tests/test_template.py
+++ b/tests/test_template.py
@@ -437,8 +437,10 @@ def _assert_dependabot_config(path: Path, actions_dirs=("/",)) -> None:
         dirs = update.get("directories") or [update["directory"]]
         expected = actions_dirs if update["package-ecosystem"] == "github-actions" else ("/",)
         assert dirs == list(expected)
-        assert update["schedule"]["interval"] == "weekly"
+        assert update["schedule"]["interval"] == "monthly"
         assert update["cooldown"]["default-days"] == 7
+        group = update["groups"][update["package-ecosystem"]]
+        assert group == {"patterns": ["*"], "update-types": ["minor", "patch"]}
 
 
 def test_own_dependabot_config():