chore: monthly Dependabot updates, grouped per ecosystem (#29)

Minor and patch updates come as one PR per ecosystem a month, which
saves CI minutes. Major and security updates still get their own PRs.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

Author: mariushelf

.github/dependabot.yml

@@ -1,18 +1,28 @@
+# Monthly, with minor and patch updates grouped into one PR per ecosystem.
+# Major updates and security updates still come as their own PRs.
 version: 2
 updates:
   - package-ecosystem: uv
     directory: "/"
     schedule:
-      interval: weekly
+      interval: monthly
     # Wait a week before proposing a new release. Security updates ignore this.
     cooldown:
       default-days: 7
+    groups:
+      uv:
+        patterns: ["*"]
+        update-types: [minor, patch]
   - package-ecosystem: github-actions
     # "/template/.github/workflows" holds the workflows that generated projects receive.
     directories:
       - "/"
       - "/template/.github/workflows"
     schedule:
-      interval: weekly
+      interval: monthly
     cooldown:
       default-days: 7
+    groups:
+      github-actions:
+        patterns: ["*"]
+        update-types: [minor, patch]

template/.github/dependabot.yml

@@ -1,15 +1,25 @@
+# Monthly, with minor and patch updates grouped into one PR per ecosystem.
+# Major updates and security updates still come as their own PRs.
 version: 2
 updates:
   - package-ecosystem: uv
     directory: "/"
     schedule:
-      interval: weekly
+      interval: monthly
     # Wait a week before proposing a new release. Security updates ignore this.
     cooldown:
       default-days: 7
+    groups:
+      uv:
+        patterns: ["*"]
+        update-types: [minor, patch]
   - package-ecosystem: github-actions
     directory: "/"
     schedule:
-      interval: weekly
+      interval: monthly
     cooldown:
       default-days: 7
+    groups:
+      github-actions:
+        patterns: ["*"]
+        update-types: [minor, patch]

tests/test_template.py

@@ -437,8 +437,10 @@ def _assert_dependabot_config(path: Path, actions_dirs=("/",)) -> None:
         dirs = update.get("directories") or [update["directory"]]
         expected = actions_dirs if update["package-ecosystem"] == "github-actions" else ("/",)
         assert dirs == list(expected)
-        assert update["schedule"]["interval"] == "weekly"
+        assert update["schedule"]["interval"] == "monthly"
         assert update["cooldown"]["default-days"] == 7
+        group = update["groups"][update["package-ecosystem"]]
+        assert group == {"patterns": ["*"], "update-types": ["minor", "patch"]}
 
 
 def test_own_dependabot_config():