From ceda30a01515b31b16d2fe0a0c075c69cbd2495b Mon Sep 17 00:00:00 2001
From: Stephen Crowe <6042774+crowecawcaw@users.noreply.github.com>
Date: Wed, 14 Oct 2026 08:28:45 -0700
Subject: [PATCH] ci: group Dependabot updates into one PR per ecosystem

Dependabot opened a separate PR for every action pinned across the
reusable workflows (five open at once this week). Each ecosystem's
bumps now arrive as a single weekly PR, so they are reviewed and merged
together.

Signed-off-by: Stephen Crowe <6042774+crowecawcaw@users.noreply.github.com>
---
 .github/dependabot.yml | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 19e80abf..d30209f2 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -3,15 +3,27 @@
 # reusable_claude_pr_review.yml. A human reviews the bump here once and every
 # consuming repo picks it up via its @mainline reference, so no per-consumer
 # Dependabot config is needed.
+#
+# Each ecosystem's bumps are grouped into a single weekly PR, so the actions
+# pinned across these workflows are reviewed and merged together rather than
+# as a separate PR per action.
 version: 2
 updates:
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
       interval: "weekly"
+    groups:
+      github-actions:
+        patterns:
+          - "*"
   # Watches claude-review-requirements.txt so the version-pinned
   # aws-bedrock-token-generator gets reviewed bump PRs instead of going stale.
   - package-ecosystem: "pip"
     directory: "/.github/workflows"
     schedule:
       interval: "weekly"
+    groups:
+      pip:
+        patterns:
+          - "*"