chore(deps): reduce uv dev dependency update cadence - #1423

Two uv blocks share the same directory: "/", which I don't think Dependabot accepts.
This exact pattern is still open (dependabot/dependabot-core#4672), though I haven't checked whether it was implemented via another issue in the meantime.
Docs also state that multiple blocks for one ecosystem must not have overlapping directories: https://docs.github.com/en/code-security/reference/supply-chain-security/dependabot-options-reference#directories-or-directory

Maybe we can use cooldown? With cooldown, I think you get what you want. Within a single uv block, without the overlapping-directories problem. Then keep the interval weekly and the existing groups, and add:

    cooldown:
      default-days: 30
      include:
        - "pytest*"
        - "mypy*"
        - "types-*"
        - "ruff"
        - "prek"
        - "commitizen"
        - "mkdocs*"

Then the dev tool releases get batched into one PR per group per month, while the other keep the default cooldown and weekly cadence.

Thank you for that suggestion. Pushed an update using cooldown config. I think that should work. Just noticed this update triggered a dependabot config validation that passed. This didn't run for the previous commit - not sure why.

Only thing I don't like here is that we have duplicate list of package names. I considered using yaml anchor and alias, but wasn't sure if dependabot allows adding keys at the top level for defining anchor-alias.

Aside from that, do you think it's worth keeping docs and release tools as separate group? Should we merge those into the single dev-tooling group?

Only thing I don't like here is that we have duplicate list of package names. I considered using yaml anchor and alias, but wasn't sure if dependabot allows adding keys at the top level for defining anchor-alias.

Dependabot don't support aliases.
For the duplication, you can flip include into exclude listing the runtime deps instead. Then the cooldown list no longer overlaps the group patterns. Isn't it?

Aside from that, do you think it's worth keeping docs and release tools as separate group? Should we merge those into the single dev-tooling group?

I'd keep documentation and release-tools separate.

I think let's go with your original suggestion. Using include with cooldown feels more natural or intuitive when reading the config.

Should we merge this?

Going ahead with merging this change before tomorrow's dependabot run, since you've reviewed the latest update already and approved. Thank you for the suggestions/hints.