dependabot: Group dependabot PRs

[ldoktor]

this should group all dependabot PRs, which should decrease the amount of CI and acks for GH action version changes.

[stevenhorsman]

LGTM. Thanks!

[bpradipt]

/lgtm

[fitzthum]

cc @mythi we should dos this for all our repos probably

[stevenhorsman]

cc @mythi we should dos this for all our repos probably

I approved this, but I guess the counter argument to this out is that if there is a case of a breaking change in one of the GHA the dependabot bumps to, then having them all grouped might make unpicking that more tricky (I'm not sure if there is a single PR with a commit per bump, or another way), so my suggestion would be to see how it goes in this repo for a bit and then review before rolling out?

[fitzthum]

so my suggestion would be to see how it goes in this repo for a bit and then review before rolling out?

Hm that is a good point.

One sort-of related thing we might want to change in the other repos is the frequency of the updates. We are doing them daily in most places, which might be overkill.

[ldoktor]

cc @mythi we should dos this for all our repos probably

I approved this, but I guess the counter argument to this out is that if there is a case of a breaking change in one of the GHA the dependabot bumps to, then having them all grouped might make unpicking that more tricky (I'm not sure if there is a single PR with a commit per bump, or another way), so my suggestion would be to see how it goes in this repo for a bit and then review before rolling out?

This is exactly why I started here, to test things out and eventually do the same everywhere. TBH I don't even know whether this works. I just searched for it and found docs mentioning it should be possible with different examples. All in all, lets evaluate this next month.

[wainersm]

Thanks @ldoktor , that's a great idea. Let's see how it goes.