chore: Group dependabot updates together + add cooldown (#345)

Group more dependabot updates together to avoid having an excessive number of PRs. Also add a cooldown so that updates aren't updated immediately. This only applies to version bumps and not security bumps

Co-authored-by: Mackenzie Zastrow <[email protected]>

Author: zastrowm

.github/dependabot.yml

@@ -1,21 +1,40 @@
+# To get started with Dependabot version updates, you'll need to specify which
+# package ecosystems to update and where the package manifests are located.
+# Please see the documentation for more information:
+# https://docs.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
+# https://containers.dev/guide/dependabot
+
 version: 2
 updates:
-  - package-ecosystem: "npm"
-    directory: "/"
+  - package-ecosystem: 'npm'
+    directory: '/'
     schedule:
-      interval: "daily"
+      interval: 'daily'
     open-pull-requests-limit: 100
     commit-message:
       prefix: ci
+    cooldown: # Set a cooldown so that we don't get updates immediately
+      default-days: 5
+      semver-major-days: 30
+      semver-minor-days: 7
+      semver-patch-days: 3
     groups:
+      # Group all development updates in a single PR
       development-dependencies:
-        dependency-type: "development"
-        patterns:
-          - "*"
-  - package-ecosystem: "github-actions"
-    directory: "/"
+        dependency-type: 'development'
+        applies-to: version-updates
+      # Group minor production updates in a single PR
+      production-minor:
+        dependency-type: 'production'
+        applies-to: version-updates
+        update-types:
+          - 'minor'
+          - 'patch'
+      # Because major production updates aren't matched by any group, they will have individual PRs
+  - package-ecosystem: 'github-actions'
+    directory: '/'
     schedule:
-      interval: "daily"
+      interval: 'daily'
     open-pull-requests-limit: 100
     commit-message:
-      prefix: ci
+      prefix: ci