Use grouped dependabot version updates

[j178]

Use grouped dependabot version updates to reduce dependabot PR noise.

See

• https://github.blog/changelog/2023-08-24-grouped-version-updates-for-dependabot-are-generally-available/
• https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#groups

Here is a grouped PR from my repo as an example: https://github.com/j178/leetgo/pull/269

[FZambia]

Hello, @j178 - interesting, thx! Let's try it.

Could you please add github.com/gorilla/websocket to exclude-patterns? The reason - new maintainers of Gorilla WebSocket released new version 1.5.1 which breaks package behaviour in some ways regarding logging upon internal errors - there are some open bugs. So not upgrading to it looking to the situation and it's better to exclude it from group for now. Also, exclude github.com/centrifugal/centrifuge – since it's always manually updated to the required version.

[j178]

We can add the two to ignore , like this:

version: 2
updates:
  - package-ecosystem: gomod
    directory: "/"
    schedule:
      interval: monthly
    ignore:
      - dependency-name: github.com/gorilla/websocket      # v1.5.1 breaks
      - dependency-name: github.com/centrifugal/centrifuge # updates manually
    groups:
      go-packages:
        patterns: '*'

If add them to exclude-patterns, dependabot will still create seperate PRs for them. What do you think?

[FZambia]

Yep, think it's even better 👍

[FZambia]

Thanks! Noticed a failed dependabot job during CI checks - that patterns should be array, but for some reason can't find it now (Github only shows two successful CI checks, but the job from dependabot gone 🤔 ). Could you please change it to the format like in your repo: https://github.com/j178/leetgo/blob/master/.github/dependabot.yml#L14C18-L14C18

[FZambia]

Many thanks!