ci(deps): group devantler-tech/actions bumps into one Dependabot PR

[devantler]

🤖 Generated by the Agentic Engineer

Why

Every devantler-tech/actions release currently deadlocks this repository's dependency updates.
The pin contract requires all three action callers to ride one commit, but Dependabot treats each
reusable workflow as a separate dependency and opens one PR per caller — so each PR leaves the other
two behind and fails required CI. No merge order fixes it. That is what happened to #219, #221 and
#222, and it will happen again on the next release.

devantler-tech/platform-tenant-template already solved this, but the fix has never reached us:
.github/dependabot.yml is listed in .templatesyncignore, because this tenant owns the file so it
can add the npm and docker ecosystems it needs. Template-sync therefore skips it, and the drift
went unnoticed.

What

Groups all devantler-tech/* github-actions updates so they arrive as a single PR that can actually
go green, matching what the template already does. A second group covers security advisories, with a
comment recording honestly that grouping is best-effort there rather than a guarantee.

Scoped to the github-actions ecosystem only — npm, docker, the PR limit and the
devantler-tech/* cooldown exclusion are untouched.

The current deadlock is cleared separately by #228.

Fixes #227

🤖 Generated with Claude Code

[devantler]

🤖 Generated by the Agentic Engineer

@coderabbitai review

[coderabbitai]

@devantler I will review pull request #229.

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

Warning

Review limit reached

Next included review available in 57 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Team

Run ID: efbc3b0e-2a76-47ca-bf5a-a27467175fd2

📥 Commits

Reviewing files that changed from the base of the PR and between 4c19e19 and 9264f96.

📒 Files selected for processing (1)

• .github/dependabot.yml

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devantler]

🤖 Generated by the Agentic Engineer

CodeRabbit returned Review rate limited at this head (commit status updated 2026-09-05T06:16:46Z,
postdating this round's request in #issuecomment-5549914794). That is a service refusal, not a
finding, so there is nothing to fix — advancing to the next lane in priority order.

@codex review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-05T06:21:47.726143Z	9264f96	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Hooray!

Reviewed commit: 9264f961fa

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[devantler]

🤖 Generated by the Agentic Engineer

Readiness — promoting

Programmatically tested. The config parses (yq eval '.'), and the change is a pure insertion:
all 28 original lines conserved verbatim, verified line by line. Structural assertions on the result
— groups present on github-actions only (npm and docker unchanged), both groups resolving to
the intended applies-to (version-updates by default, security-updates explicitly), and the
devantler-tech/* cooldown exclusion intact. Full CI green, mergeStateStatus: CLEAN.

Reviewed. CodeRabbit returned Review rate limited at this head, so the lane was advanced per
priority order (recorded above). Codex reviewed at 9264f961fa, which equals the current head:
"Didn't find any major issues." Zero review threads, zero finding sections.

Tried and evaluated as a user. This one is honest about its limit: the change alters how
Dependabot schedules future work, so its effect cannot be observed until the next
devantler-tech/actions release. What was verified instead is that the same configuration shape is
already in production and working — devantler-tech/platform-tenant-template carries these exact two
groups, and the deadlock they prevent is the one just observed here on #219/#221/#222 and cleared by
#228.

The first devantler-tech/actions release after this merges is the real test: it should produce one
PR touching all three callers rather than three touching one each. Worth checking then.