ci: consolidate Dependabot into one weekly update batch - #141

中文审阅

将普通依赖更新从三个分组及零散大版本／敏感包提案，收敛为一个 weekly-dependencies 跨生态批次。

• 每周日北京时间 09:00 统一请求检查：根 npm、独立构建工具 npm、GitHub Actions；不再错峰为三次。
• 三个范围均为 patterns: ["*"]，包括可解析的大／小／补丁及敏感工具升级。合并提案不等于批准升级：Node／类型、VS Code API、Playwright 包／镜像、Action SHA 与现有测试守卫仍须人工审阅。
• 不加忽略／允许筛选，不关闭安全更新，不启用自动合并，不发布新版。安全更新仍独立，不为周日批次延后修复。
• 一个普通分组不等于“全仓库永远最多一个 PR”的服务端保证。旧 build(deps): bump release-drafter/release-drafter from 6.4.0 to 7.10.0 #137–build(deps-dev): bump @types/node from 24.19.2 to 26.6.5 #140 不会因配置被自动合并或关闭，本 PR 不处理其代码；合入后须核验真实分组提案的实际覆盖，再决定旧提案的替代清理。
• 补充公开 PR 文案规范及模板提示：直接说明改动、理由、测试和限制，不叙述私人对话中的要求或授权，保留 AI 归因和贡献署名。
• 只改配置、策略测试和双语协作文档／模板；不改包版本、锁文件、运行时代码、现有工作流或产品版本。

验证

• 红→绿：旧分组配置下新策略测试 3 失败／1 通过；新配置 4/4 通过。
• 聚焦 Dependabot／依赖安全／自动化／公开文案规范 31/31 通过；公开文案规范先复现缺失，再补齐后通过。
• 完整本地 npm test：2,680 通过、2 跳过、0 失败；跳过为既有环境／性能夹具。
• Ruby 标准 YAML 实际解析通过；15 类排期、覆盖、拆分、标签与过滤变异被拒绝，保留 CRLF 等价校验。
• 独立只读核验 GitHub 官方跨生态配置与参数合并语义；不使用缺乏服务端验证的分组限额声明，不将第三方 schema 视为服务端验收。
• 配置须进入默认分支后才生效；本地测试不证明真实 Dependabot 作业已运行。远端 CI 结果另以本 PR 检查为准。

Summary

Consolidate ordinary Dependabot proposals for root npm, separately locked build tooling and GitHub Actions into one Sunday 09:00 Asia/Shanghai multi-ecosystem group. Include all eligible version levels and sensitive tools in the same proposal, while preserving manual compatibility review, existing pin/security guards and independent security remediation.

Add public PR-copy guidance and template checks: describe changes, rationale, tests and limitations directly, without private request/approval narratives; retain attribution and contributor credit.

No package/lock/runtime/workflow/product-version change, auto-merge, old-PR closure or new release. The group is not a verified repository-wide maximum-one-open-PR guarantee. Activate only after integration into the default branch, then verify real resolver coverage and generated-PR behavior before retiring redundant proposals.

Official references: multi-ecosystem configuration, parameter merging behavior.

Linked issues

None. Follow-up to #136; does not implement the upgrades in #137–#140 or change #128.

Type of change

• Documentation / CI / maintenance
• Bug fix / performance improvement
• New feature
• Breaking change

Visual design

N/A — no production UI changes.

User-facing release note

N/A — internal dependency-maintenance configuration and collaboration guidance; skip-changelog.

How was this tested?

Red/green policy tests; 31 focused checks; full Node suite (2,680 passed, 2 existing skips, 0 failures); actual Ruby YAML parsing; 15 negative configuration mutations; CRLF equivalence. Independent official-source assessment supports the minimal configuration. Hosted CI and actual Dependabot service execution are separate gates, not claimed by local checks.

Checklist

• Existing required checks, protected compatibility pins and manual merge/release boundaries remain unchanged.
• No package upgrades, lockfile/runtime/product-version changes or private data.
• Chinese review companions are included above and in the collaboration documents.
• No automatic merge or new-release workflow changes.

🤖 Generated by OpenAI Codex as an automated first pass — not a maintainer decision.