Dependabot batching: weekly schedules + grouped updates to reduce lockfile conflict churn

.github/dependabot.yml

@@ -9,7 +9,12 @@ updates:
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
-      interval: "daily"
+      interval: "weekly"
+      day: "monday"
+    groups:
+      all-dependencies:
+        patterns:
+          - "*"
 
   - package-ecosystem: "gradle"
     directory: "/"
@@ -36,53 +41,67 @@ updates:
         # junit 6 requires Java 17
         versions: [ "[6,)" ]
     schedule:
-      interval: "daily"
+      interval: "weekly"
+      day: "monday"
     open-pull-requests-limit: 10
+    # a dependency lands in the first group it matches, and whatever is left over gets its own PR,
+    # so major updates are intentionally left ungrouped
     groups:
-      testcontainers:
+      # semconv bumps rename attributes and require test changes, so they are kept out of the
+      # opentelemetry group to avoid mixing a version bump with semantic code churn
+      opentelemetry-semconv:
         patterns:
-          - "org.testcontainers:*"
+          - "io.opentelemetry.semconv:*"
 
+      # the otel sdk/instrumentation/contrib/javaagent artifacts are interdependent and need to be
+      # reviewed, tested and merged together
       opentelemetry:
         patterns:
-          - "otelSdkVersion"
-          - "otelSdkAlphaVersion"
-          - "otelInstrumentationVersion"
-          - "otelInstrumentationAlphaVersion"
-          - "otelContribVersion"
-          - "otelContribAlphaVersion"
-          - "io.opentelemetry:opentelemetry-bom"
-          - "io.opentelemetry:opentelemetry-bom-alpha"
-          - "io.opentelemetry.instrumentation:opentelemetry-instrumentation-bom"
-          - "io.opentelemetry.instrumentation:opentelemetry-instrumentation-bom-alpha"
-          - "io.opentelemetry.instrumentation:opentelemetry-instrumentation-api-incubator"
-          - "io.opentelemetry.instrumentation:gradle-plugins"
-          - "io.opentelemetry.contrib:opentelemetry-jfr-connection"
-          - "io.opentelemetry.contrib:opentelemetry-runtime-attach-core"
-
-      opentelemetry-semconv:
-        patterns:
-          - "io.opentelemetry.semconv:opentelemetry-semconv"
-          - "io.opentelemetry.semconv:opentelemetry-semconv-incubating"
+          - "otel*Version" # version properties in dependencyManagement/build.gradle.kts
+          - "io.opentelemetry*"
+        exclude-patterns:
+          - "io.opentelemetry.semconv:*"
+          # released independently of the otel sdk, and only used by the smoke test framework
+          - "io.opentelemetry.proto:*"
 
-      # Spotless repeatedly appears as two separate dependency names for the same version bump
-      spotless:
+      all-dependencies:
         patterns:
-          - "com.diffplug.spotless"
-          - "com.diffplug.spotless:*"
+          - "*"
+        exclude-patterns:
+          # every release adds checks that fire on existing code
+          - "errorProneVersion"
+        update-types:
+          - "minor"
+          - "patch"
 
   - package-ecosystem: "gradle"
     directory: "/perf-tests"
     registries:
       - gradle-plugin-portal
     schedule:
-      interval: "daily"
-    open-pull-requests-limit: 10
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 5
+    groups:
+      all-dependencies:
+        patterns:
+          - "*"
+        update-types:
+          - "minor"
+          - "patch"
 
   - package-ecosystem: "gradle"
     directory: "/etw/etw-testapp"
     registries:
       - gradle-plugin-portal
     schedule:
-      interval: "daily"
-    open-pull-requests-limit: 10
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 5
+    groups:
+      all-dependencies:
+        patterns:
+          - "*"
+        update-types:
+          - "minor"
+          - "patch"