feat: group Dependabot updates and add a repeatable rollup task

[PaulGMardling]

Previous Behavior

Dependabot updates were opened as multiple separate PRs, which increased review overhead and PR noise.

New Behavior

Dependabot is now configured to group patch/minor updates into consolidated PRs per ecosystem, while still requiring human review:

• GitHub Actions patch/minor updates are grouped.
• npm development dependency patch/minor updates are grouped.
• npm production dependency patch/minor updates are grouped.
• Semver-major updates remain excluded from these grouped update streams.
• No auto-merge flow is used; normal branch protection and CI checks still apply.

Related Issue(s)

#36394

• Fixes [Feature]: Adopt Fluent System Icons dependency rollup flow in FluentUI #36394

[github-actions]

📊 Bundle size report

✅ No changes found

[github-actions]

Pull request demo site: URL

[Hotell]

the dependabot grouping config tweaks should be all we need correct ?

the additional workflows are nice but any new workflow we add = additional attack vector/maintenance burden. I suggest to start first with the dependabot tweaks and if situation wont improve we can re-evaluate adding custom solution.

For testing purposes we could move the script logic to a repo SKILL which can be invoked locally/cloud to test things out while mitigating attack vector/maintenance of official pipeline.

thoughts?

[PaulGMardling]

the dependabot grouping config tweaks should be all we need correct ?

the additional workflows are nice but any new workflow we add = additional attack vector/maintenance burden. I suggest to start first with the dependabot tweaks and if situation wont improve we can re-evaluate adding custom solution.

For testing purposes we could move the script logic to a repo SKILL which can be invoked locally/cloud to test things out while mitigating attack vector/maintenance of official pipeline.

thoughts?

I think that is a solid idea and I will implement this suggestion and move it back to a draft, as I'll need to test and verify it.

A nice solid lesson, thanks!

[Hotell]

LGTM