From 94c8af432cea2ead49ff88f712c46b9500373b17 Mon Sep 17 00:00:00 2001
From: Richard Levasseur <richardlev@gmail.com>
Date: Sun, 25 Oct 2026 15:11:02 -0700
Subject: [PATCH] build: group dependabot updates into user-facing and dev-only
 PRs

Dependabot previously opened individual PRs per package and only tracked
a subset of lockfiles. Individual PRs create review noise, while
user-facing and dev-only dependencies have different upgrade policies.

Configure `user-facing` and `dev-only` multi-ecosystem groups in
`.github/dependabot.yml` with distinct commit prefixes, and expand
directory globs to cover all `uv`, `cargo`, and GitHub Actions
dependencies.
---
 .github/dependabot.yml | 56 ++++++++++++++++++++++++++++++++++--------
 1 file changed, 46 insertions(+), 10 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 19877dbbeb..8ee450be51 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -1,26 +1,62 @@
 ---
 version: 2
+
+multi-ecosystem-groups:
+  # Dependencies shipped to downstream rules_python users. We prefer the oldest
+  # compatible version for deployment compatibility, and security fixes here
+  # warrant a rules_python release.
+  user-facing:
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 3
+    commit-message:
+      prefix: "build(deps-user)"
+    labels:
+      - "dependencies"
+  # Dependencies used only for rules_python development, tests, CI, and examples.
+  dev-only:
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 3
+    commit-message:
+      prefix: "build(deps-dev)"
+    labels:
+      - "dependencies"
+
 updates:
   # Maintain dependencies for GitHub Actions
   - package-ecosystem: "github-actions"
+    multi-ecosystem-group: "dev-only"
     directories:
       - "/"
       - "/.github/actions/setup-bazel"
-    schedule:
-      interval: "weekly"
+    patterns:
+      - "*"
 
-  - package-ecosystem: "pip"
+  - package-ecosystem: "uv"
+    multi-ecosystem-group: "user-facing"
     directories:
       # Maintain dependencies for our tools
-      - "/tools/publish"
-    schedule:
-      interval: "weekly"
-    open-pull-requests-limit: 3
+      - "/tools/**/*"
+    patterns:
+      - "*"
+
+  - package-ecosystem: "cargo"
+    multi-ecosystem-group: "dev-only"
+    directories:
+      - "/crates"
+      - "/crates/**/*"
+    patterns:
+      - "*"
 
   - package-ecosystem: "uv"
+    multi-ecosystem-group: "dev-only"
     directories:
       - "/dev"
+      - "/dev/**/*"
+      - "/examples/**/*"
+      - "/gazelle/examples/**/*"
       - "/sphinxdocs/dev"
-    schedule:
-      interval: "weekly"
-    open-pull-requests-limit: 3
+      - "/tests/**/*"
+    patterns:
+      - "*"