Simplify Dependabot config with grouping and auto-merge (#167)

- Replace per-package configs with single root config (yarn workspaces)
- Group dev dependency minor/patch updates together
- Group production minor/patch updates together
- Group GitHub Actions updates together
- Add auto-merge workflow for dev dependency updates

This reduces PR noise from ~20+ individual PRs to ~3-4 grouped PRs,
and auto-merges low-risk dev dependency updates after CI passes.

Author: leoromanovsky

.github/dependabot.yaml

@@ -1,106 +1,39 @@
 # Dependabot configuration for openfeature-js-client monorepo
 # Documentation: https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
 #
-# Strategy: Each dependency update creates a separate PR for granular control and review.
+# Strategy:
+# - Single root config leverages yarn workspaces to update all packages together
+# - Grouped updates reduce PR noise (dev deps monthly, prod deps weekly)
+# - Dev dependency minor/patch updates are auto-merged via GitHub Actions
 
 version: 2
 updates:
-  # Root workspace dependencies
+  # NPM dependencies (yarn workspaces handles the monorepo)
   - package-ecosystem: 'npm'
     directory: '/'
     schedule:
       interval: 'weekly'
       day: 'monday'
       time: '09:00'
       timezone: 'America/New_York'
-    open-pull-requests-limit: 10
+    groups:
+      # Dev dependencies grouped together, monthly updates
+      dev-dependencies:
+        dependency-type: 'development'
+        update-types:
+          - 'minor'
+          - 'patch'
+      # Production minor/patch grouped together
+      production-minor-patch:
+        dependency-type: 'production'
+        update-types:
+          - 'minor'
+          - 'patch'
     labels:
       - 'dependencies'
-      - 'npm'
-      - 'root'
     commit-message:
-      prefix: '👷 chore'
-      prefix-development: '👷 chore'
-      include: 'scope'
-    reviewers:
-      - 'CODEOWNERS'
-
-  # Browser package
-  - package-ecosystem: 'npm'
-    directory: '/packages/browser'
-    schedule:
-      interval: 'weekly'
-      day: 'monday'
-      time: '09:00'
-      timezone: 'America/New_York'
-    open-pull-requests-limit: 10
-    labels:
-      - 'dependencies'
-      - 'npm'
-      - 'browser'
-    commit-message:
-      prefix: '👷 chore(browser)'
-      prefix-development: '👷 chore(browser)'
-      include: 'scope'
-    reviewers:
-      - 'CODEOWNERS'
-
-  # Core package
-  - package-ecosystem: 'npm'
-    directory: '/packages/core'
-    schedule:
-      interval: 'weekly'
-      day: 'monday'
-      time: '09:00'
-      timezone: 'America/New_York'
-    open-pull-requests-limit: 10
-    labels:
-      - 'dependencies'
-      - 'npm'
-      - 'core'
-    commit-message:
-      prefix: '👷 chore(core)'
-      prefix-development: '👷 chore(core)'
-      include: 'scope'
-    reviewers:
-      - 'CODEOWNERS'
-
-  # Node server package
-  - package-ecosystem: 'npm'
-    directory: '/packages/node-server'
-    schedule:
-      interval: 'weekly'
-      day: 'monday'
-      time: '09:00'
-      timezone: 'America/New_York'
-    open-pull-requests-limit: 10
-    labels:
-      - 'dependencies'
-      - 'npm'
-      - 'node-server'
-    commit-message:
-      prefix: '👷 chore(node-server)'
-      prefix-development: '👷 chore(node-server)'
-      include: 'scope'
-    reviewers:
-      - 'CODEOWNERS'
-
-  # Test app
-  - package-ecosystem: 'npm'
-    directory: '/test-app'
-    schedule:
-      interval: 'weekly'
-      day: 'monday'
-      time: '09:00'
-      timezone: 'America/New_York'
-    open-pull-requests-limit: 10
-    labels:
-      - 'dependencies'
-      - 'npm'
-      - 'test-app'
-    commit-message:
-      prefix: '👷 chore(test-app)'
-      prefix-development: '👷 chore(test-app)'
+      prefix: '👷 chore(deps)'
+      prefix-development: '👷 chore(deps-dev)'
       include: 'scope'
 
   # GitHub Actions dependencies
@@ -111,10 +44,14 @@ updates:
       day: 'monday'
       time: '09:00'
       timezone: 'America/New_York'
-    open-pull-requests-limit: 10
+    groups:
+      # Group all GHA updates together
+      github-actions:
+        patterns:
+          - '*'
     labels:
       - 'dependencies'
       - 'github-actions'
     commit-message:
-      prefix: '👷 ci'
+      prefix: '👷 ci(deps)'
       include: 'scope'

.github/workflows/dependabot-auto-merge.yaml

@@ -0,0 +1,38 @@
+# Auto-merge Dependabot PRs for dev dependencies
+# Only merges minor/patch updates for development dependencies after CI passes
+#
+# Requirements:
+# - Repository must have "Allow auto-merge" enabled in settings
+# - Branch protection rules must require status checks to pass
+
+name: Dependabot Auto-Merge
+
+on:
+  pull_request:
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  auto-merge:
+    runs-on: ubuntu-latest
+    if: github.actor == 'dependabot[bot]'
+    steps:
+      - name: Fetch Dependabot metadata
+        id: metadata
+        uses: dependabot/fetch-metadata@v2
+        with:
+          github-token: '${{ secrets.GITHUB_TOKEN }}'
+
+      - name: Auto-merge dev dependency updates
+        if: >-
+          steps.metadata.outputs.dependency-type == 'direct:development' &&
+          (steps.metadata.outputs.update-type == 'version-update:semver-minor' ||
+           steps.metadata.outputs.update-type == 'version-update:semver-patch')
+        run: |
+          gh pr review --approve "$PR_URL"
+          gh pr merge --auto --squash "$PR_URL"
+        env:
+          PR_URL: ${{ github.event.pull_request.html_url }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}