From ad4c8b01e660c4cf109c4150cb68419503adb1c1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Gr=C3=A9goire=20Pineau?= <lyrixx@lyrixx.info>
Date: Wed, 14 Oct 2026 16:12:38 +0200
Subject: [PATCH] Group the Dependabot updates by language, once a month

Dependabot opened a pull request per dependency and per directory: three
for the PHP tools this month. Each language now gets one pull request a
month at most, for releases a week old at least:

- the PHP tools, whose Composer projects live in two directories, share
  a multi-ecosystem group, which updates both in one pull request;
- the GitHub Actions and the Python packages of the site each have a
  group.

Security updates still come as soon as they are published, grouped for
GitHub Actions and Python, like in jolicode/docker-starter.
---
 .github/dependabot.yml | 43 +++++++++++++++++++++++++++++++++++-------
 1 file changed, 36 insertions(+), 7 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index ca8ca8b..29129b8 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -1,21 +1,50 @@
 version: 2
-updates:
-  - package-ecosystem: github-actions
-    directory: /
+
+# At most one pull request per language and per month, for releases a week old at least. Security
+# updates come as soon as they are published.
+multi-ecosystem-groups:
+  # The PHP tools, one Composer project per directory: one pull request for all of them.
+  php:
     schedule:
       interval: monthly
 
+updates:
+  - package-ecosystem: composer
+    directory: /tools/php-cs-fixer
+    multi-ecosystem-group: php
+    patterns: ['*']
+    cooldown:
+      default-days: 7
+
   - package-ecosystem: composer
-    directories:
-      - /tools/php-cs-fixer
-      - /tools/phpstan
+    directory: /tools/phpstan
+    multi-ecosystem-group: php
+    patterns: ['*']
+    cooldown:
+      default-days: 7
+
+  - package-ecosystem: github-actions
+    directory: /
     schedule:
       interval: monthly
+    cooldown:
+      default-days: 7
+    groups:
+      github-actions:
+        patterns: ['*']
+      github-actions-security:
+        applies-to: security-updates
+        patterns: ['*']
 
   - package-ecosystem: pip
     directory: /tools/zensical
     schedule:
       interval: monthly
+    cooldown:
+      default-days: 7
     groups:
-      zensical:
+      pip:
+        patterns: ['*']
+      pip-security:
+        applies-to: security-updates
         patterns: ['*']