Group Dependabot minor/patch updates into weekly PRs

.github/dependabot.yml

@@ -1,16 +1,35 @@
 # Dependabot: keep Python dependencies and GitHub Actions up to date.
 # https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
+#
+# Weekly checks open grouped PRs for routine minor/patch bumps so review stays
+# focused. Major version bumps stay ungrouped for individual review.
 
 version: 2
 updates:
   - package-ecosystem: pip
     directory: /
     schedule:
       interval: weekly
+      day: monday
     open-pull-requests-limit: 5
+    groups:
+      python-minor-and-patch:
+        patterns:
+          - "*"
+        update-types:
+          - "minor"
+          - "patch"
 
   - package-ecosystem: github-actions
     directory: /
     schedule:
       interval: weekly
+      day: monday
     open-pull-requests-limit: 5
+    groups:
+      github-actions-minor-and-patch:
+        patterns:
+          - "*"
+        update-types:
+          - "minor"
+          - "patch"

.github/workflows/ci.yml

@@ -129,7 +129,8 @@ jobs:
       env:
         BASE_REF: ${{ github.base_ref }}
       run: |
-        git fetch --depth=1 origin "$BASE_REF"
+        # Full base history so range checks still work after main advances.
+        git fetch --no-tags origin "$BASE_REF"
         python scripts/check_changelog.py
     - name: Check documentation freshness
       run: python scripts/check_doc_freshness.py
@@ -295,9 +296,11 @@ jobs:
       with:
         fetch-depth: 0
     - name: Fetch base branch for diff-cover
+      # Full history (not --depth=1): a shallow tip of the base branch has no
+      # merge-base with the PR when main advances after the branch was cut.
       env:
         BASE_REF: ${{ github.base_ref }}
-      run: git fetch --no-tags --depth=1 origin "$BASE_REF"
+      run: git fetch --no-tags origin "$BASE_REF"
     - name: Install uv
       uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990  # v8.3.2
       with:

CHANGELOG.md

@@ -39,6 +39,18 @@ omit pure CI/refactor bullets and point readers here. See
   exams are preserved on the run warning list (they previously dropped because no
   `ExamResult` was created).
 
+### Changed
+
+- **Dependabot weekly grouped minor/patch bumps** (2026-08-03) — `.github/dependabot.yml`
+  still runs weekly (Monday) for `pip` and `github-actions`, but routine minor/patch
+  updates are grouped into one PR per ecosystem (`python-minor-and-patch`,
+  `github-actions-minor-and-patch`). Major version bumps stay ungrouped for individual
+  review.
+- **CI base-branch fetch for coverage/changelog** (2026-08-03) — `coverage-pr` and the
+  changelog check fetch the PR base with full history instead of `--depth=1`, so
+  `diff-cover` / range diffs keep a merge-base when `main` advances after the branch
+  was opened.
+
 ### Removed
 
 - **Codecov integration** (2026-07-26) — dropped the `main`-only Codecov upload step from the

dev-docs/HARNESS_ENGINEERING.md

@@ -66,7 +66,7 @@ Agents working in this repository should be able to answer three questions quick
 | Shell-script lint (ShellCheck) | `shellcheck-py` pre-commit hook + CI `static-analysis` job |
 | Type-check helpers | `scripts/type_baseline.sh`, `.basedpyright/README.md` |
 | Release build | `.github/workflows/release.yml` |
-| Dependency and Actions updates | `.github/dependabot.yml` |
+| Dependency and Actions updates | `.github/dependabot.yml` (weekly Monday; minor/patch grouped per ecosystem; majors ungrouped) |
 
 ## Documentation conventions
 
@@ -458,7 +458,7 @@ Other CI jobs (typecheck, bandit, pip-audit, GUI smoke, package build, doc-fresh
 | `python scripts/audit_dependencies.py` | Ubuntu `static-analysis` job (requires `.[dev,gui]`) |
 | SonarCloud CI scan | **Enabled**: `main` is protected by a ruleset and repository variable `SONAR_PROTECTED_MAIN_ENABLED=true`, so `sonar-scan` runs on protected `main` pushes only, after `privacy-gates` + `build`, with combined non-GUI+GUI `coverage.xml`. Automatic Analysis is disabled (CI-based analysis is authoritative). The scan requires the `SONAR_TOKEN` repository secret; no tokenized scanner runs on a PR head. |
 | `safety scan --detailed-output` | `main` pushes only, in `cloud-scans-main`, after `privacy-gates`, static-analysis, GUI smoke, and the test matrix succeed. Enforced PR coverage is the GHA `coverage-pr` job. |
-| PR coverage gate | Ubuntu `coverage-pr` on pull requests after `privacy-gates`: combined non-GUI+GUI `coverage` ≥80% of `src/mypyskindose/*`, plus `diff-cover` ≥80% of lines changed vs the PR base. This is the single coverage standard (80%); the matrix `build` job runs tests only (no coverage gate), and `sonar-scan` enforces ≥80% new-code coverage on `main`. |
+| PR coverage gate | Ubuntu `coverage-pr` on pull requests after `privacy-gates`: combined non-GUI+GUI `coverage` ≥80% of `src/mypyskindose/*`, plus `diff-cover` ≥80% of lines changed vs the PR base (base branch fetched with full history so merge-base stays valid when `main` moves). This is the single coverage standard (80%); the matrix `build` job runs tests only (no coverage gate), and `sonar-scan` enforces ≥80% new-code coverage on `main`. |
 | `python scripts/check_licenses.py` | Ubuntu `static-analysis` job (forbidden licenses; `--check-notices`) |
 | CodeRabbit | Auto-review off (`.coderabbit.yaml`); path filters exclude sensitive surfaces; `request-coderabbit` job posts `@coderabbitai review` after `privacy-gates` on same-repository PRs (including drafts; deduped per head SHA). The same-repository guard prevents CI from posting comments on fork PRs. Manual CodeRabbit requests bypass the CI ordering, so this is not a trusted privacy boundary. |
 | pre-commit (local) | `.pre-commit-config.yaml` — commit: ruff, gitleaks, shellcheck, bandit, doc/help checks, backup cleanup; pre-push: basedpyright, semgrep, check-changelog |