chore(dependabot): update config

[erisu]

Motivation and Context

Update dependabot configs

Description

• GH Action Interval changes from daily to weekly
• NPM Interval remains as weekly
• NPM PRs
  • Group patch releases
    • Increase cooldown from 4 to 5 days
  • Group minor releases
    • Increase cooldown from 4 to 5 days
  • Major releases will remain as single PR for each package
    • Increase cooldown from 4 to 14 days
• GH Actions PR
  • Group patch and minors
    • Increase cooldown from 4 to 5 days
  • Major releases will remain as single PR for each package
    • Increase cooldown from 4 to 14 days

Overall, the cooldown was increased to allow more time for packages to be vetted before PRs are being opened. By default, Dependabot has an open PR limit of five that would avoid spamming. Instead of increasing this limit, I believe grouping some updates is the better approach.

Major updates would still be opened as individual PRs so they can be reviewed more carefully. They also have a significantly longer cooldown (two weeks), since patch and minor updates are more likely to be our next targeted release.

One drawback of the 5 PR limit is that major update PRs could consume all available slots and prevent patch and minor update PRs from being opened. In this situation, I recommend closing major update PRs if a major release is not being targeted. We can manually revist and apply major updates when ready.

Testing

n/a

Checklist

• I've run the tests to see all new and existing tests pass
• I added automated test coverage as appropriate for this change
• Commit is prefixed with (platform) if this change only applies to one platform (e.g. (android))
• If this Pull Request resolves an issue, I linked to the issue in the text above (and used the correct keyword to close issues using keywords)
• I've updated the documentation if necessary

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 63.20%. Comparing base (9532a54) to head (65f521c).
⚠️ Report is 3 commits behind head on master.

Additional details and impacted files

@@           Coverage Diff           @@
##           master    #1990   +/-   ##
=======================================
  Coverage   63.20%   63.20%           
=======================================
  Files          24       24           
  Lines        4922     4922           
=======================================
  Hits         3111     3111           
  Misses       1811     1811           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[GitToTheHub]

Is it possible to merge patches automatically? I mean this should bring no problems if doing so.

[erisu]

Is it possible to merge patches automatically? I mean this should bring no problems if doing so.

I don't think there's a policy that prevents it. But, IMO, it would still be valuable to have human involvement in the process. We might be able to use the merge queue feature to automatically merge a PR after it has been reviewed and approved. But as I never used this feature before, I would need to look into it more. I don't know if it has granular configuration options to define which PRs it applies to.