From 8440cf33b979f7b621ee0d6a98f1704ab1c2c570 Mon Sep 17 00:00:00 2001
From: MarTrepodi <martrepodi@gmail.com>
Date: Tue, 13 Oct 2026 08:48:13 -0400
Subject: [PATCH] ci(ci): group Dependabot updates and stop linting its own
 commits

Switching the ecosystem to uv made Dependabot open one PR per locked
dependency, and every one failed Commit Lint: with no Dependabot commit
in main's recent history to copy, it guessed "build(deps-dev): Bump"
from human commits, and subject-case rejects the capital.

Group updates (all actions; ruff and ty; everything else in uv) and pin
the "chore(deps)" prefix the existing Dependabot commits already use.
Casing still comes from Dependabot's heuristic, so Commit Lint now skips
commits authored by Dependabot on PRs Dependabot opened; human commits
pushed onto those PRs are still linted.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .github/dependabot.yml           | 21 +++++++++++++++++++++
 .github/workflows/commitlint.yml | 11 +++++++++++
 2 files changed, 32 insertions(+)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 36d8ea4..8597d7d 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -1,4 +1,10 @@
 version: 2
+
+# Dependabot reads this file from the DEFAULT branch (main), not from target-branch, so
+# edits take effect only once they are released to main.
+#
+# Updates are grouped (one PR per group per week, not one per dependency), and the commit
+# prefix is pinned so Dependabot doesn't guess a type/scope from repo history.
 updates:
   - package-ecosystem: "github-actions"
     directory: "/"
@@ -8,6 +14,11 @@ updates:
     labels:
       - "dependencies"
       - "ci"
+    commit-message:
+      prefix: "chore(deps)"
+    groups:
+      github-actions:
+        patterns: ["*"]
 
   # "uv" (not "pip") so updates also refresh uv.lock
   - package-ecosystem: "uv"
@@ -18,3 +29,13 @@ updates:
     open-pull-requests-limit: 10
     labels:
       - "dependencies"
+    commit-message:
+      prefix: "chore(deps)"
+    groups:
+      # ruff and ty bumps routinely bring new lint/type diagnostics that need code fixes;
+      # keep them apart so they can't hold up the routine bumps. A dependency joins the
+      # FIRST group it matches, so this must stay above the catch-all.
+      astral-tools:
+        patterns: ["ruff", "ty"]
+      python:
+        patterns: ["*"]
diff --git a/.github/workflows/commitlint.yml b/.github/workflows/commitlint.yml
index 0c082e4..7311bcf 100644
--- a/.github/workflows/commitlint.yml
+++ b/.github/workflows/commitlint.yml
@@ -33,6 +33,17 @@ jobs:
           # non-conventional squash) commits — those are already on main and are
           # not this PR's responsibility to police.
           commits="$(git rev-list --no-merges --reverse "${base}..${head}" --not FETCH_HEAD)"
+          # Dependabot copies its subject casing from repo history rather than from
+          # dependabot.yml, so its "chore(deps): Bump ..." can fail subject-case. Its own
+          # commits are machine-generated and never reach the changelog, so skip them —
+          # but only on PRs Dependabot opened, so a forged author elsewhere is still
+          # linted, and any human commit pushed onto a Dependabot PR still is too.
+          if [ "${{ github.event.pull_request.user.login }}" = "dependabot[bot]" ]; then
+            bot="49699333+dependabot[bot]@users.noreply.github.com"
+            commits="$(git rev-list --no-merges --reverse --no-commit-header --format='%H %ae' \
+              "${base}..${head}" --not FETCH_HEAD | awk -v bot="${bot}" '$2 != bot { print $1 }')"
+            echo "Dependabot PR: skipping commits authored by ${bot}."
+          fi
           if [ -z "${commits}" ]; then
             echo "No PR-unique commits to lint (mergeback/back-merge or merge-only PR)."
             exit 0