ci: sanitize Dependabot config

.github/dependabot.yml

@@ -1,16 +1,82 @@
+# Dependabot configuration — kept identical in shape across all four solver repos.
+# Only the schedule time, ecosystem list, and 1.x section differ per repo.
+#
+# WHY THIS LOOKS THE WAY IT DOES (read before editing):
+#
+# * Dependencies are split by SemVer level into separate PRs to match the merge
+#   workflow: patch = usually safe / merge on sight, minor = usually needs work,
+#   major = needs attention. Quarkus and Spring get their OWN PRs (their bumps
+#   are easier to review as a unit) and are themselves split patch-vs-rest, so a
+#   safe Quarkus/Spring patch stays merge-on-sight instead of being held hostage
+#   by a minor/major bump in the same PR.
+#
+# * Uses the regular `groups` feature so each dependency lands in exactly ONE PR
+#   (its highest bump, routed to the first matching group). PRs are per-ecosystem
+#   (maven PRs are separate from github-actions PRs).
+#
+# * GROUP ORDER MATTERS — Dependabot assigns a dep to the FIRST matching group, so
+#   quarkus/spring are listed before the major/minor/patch catch-alls.
+#
+# * Commit prefix is plain "deps" for ALL groups — Dependabot has no per-group
+#   commit-message. The level/identity shows in the PR title and branch name, e.g.
+#   "deps: bump the patch group ..." / branch dependabot/maven/patch-<hash>.
+#
+# * Schedule: Monday 01:45 Europe/Berlin (= 1:45am CEST in summer), staggered +15 min
+#   per repo (solver 01:00, enterprise 01:15, quickstarts 01:30, benchmarks 01:45).
+#
+# * Quarkus/Spring patterns drop the ":" so the wildcard spans sub-groupIds
+#   (io.quarkus*, io.quarkiverse*, ...). Re-scan pom.xml/*.gradle if new families appear.
 version: 2
 updates:
   - package-ecosystem: maven
     directory: "/"
     schedule:
       interval: weekly
-      time: '05:00' # Otherwise it picks a random time.
+      day: monday
+      time: "01:45"
+      timezone: "Europe/Berlin"
     open-pull-requests-limit: 10
-    target-branch: "main"
+    labels: ["dependencies"]
     commit-message:
-      prefix: "deps: "
-  - package-ecosystem: "github-actions"
+      prefix: "deps"
+    groups:
+      # Identity groups first — first-match-wins keeps these out of the semver buckets.
+      # Each family is split patch-vs-rest: the *-patch group (listed first) grabs
+      # patches for merge-on-sight; the rest-group (no update-types) catches that
+      # family's minor/major (and any non-semver bump).
+      quarkus-patch:
+        patterns: ["io.quarkus*", "io.quarkiverse*"]
+        update-types: ["patch"]
+      quarkus:
+        patterns: ["io.quarkus*", "io.quarkiverse*"]
+      spring-patch:
+        patterns: ["org.springframework*", "org.springdoc*", "io.spring*"]
+        update-types: ["patch"]
+      spring:
+        patterns: ["org.springframework*", "org.springdoc*", "io.spring*"]
+      # Everything else, split by SemVer level into its own PR.
+      major:
+        patterns: ["*"]
+        update-types: ["major"]
+      minor:
+        patterns: ["*"]
+        update-types: ["minor"]
+      patch:
+        patterns: ["*"]
+        update-types: ["patch"]
+
+  - package-ecosystem: github-actions
     directory: "/"
     schedule:
       interval: weekly
-      time: '05:00' # Otherwise it picks a random time.
+      day: monday
+      time: "01:45"
+      timezone: "Europe/Berlin"
+    open-pull-requests-limit: 10
+    labels: ["dependencies"]
+    commit-message:
+      prefix: "deps"
+    groups:
+      # Actions are NOT semver-split — one PR for all action updates (minimize PRs).
+      actions:
+        patterns: ["*"]

.github/workflows/performance_quickstarts.yml

@@ -83,7 +83,7 @@ jobs:
       - name: Quickly build timefold-solver
         working-directory: ./timefold-solver
         shell: bash
-        run: ./mvnw -B -Dquickly clean install
+        run: ./mvnw -B -Dquickly -Drevision=999-SNAPSHOT clean install
 
       - name: Checkout timefold-solver-enterprise
         uses: actions/checkout@v7
@@ -96,7 +96,7 @@ jobs:
       - name: Quickly build timefold-solver-enterprise
         working-directory: ./timefold-solver-enterprise
         shell: bash
-        run: ./mvnw -B -Dquickly clean install
+        run: ./mvnw -B -Dquickly -Drevision=999-SNAPSHOT clean install
 
       - name: Switch quickstarts to baseline branch if it exists
         working-directory: ./timefold-quickstarts
@@ -156,7 +156,7 @@ jobs:
       - name: Quickly build timefold-solver
         working-directory: ./timefold-solver
         shell: bash
-        run: ./mvnw -B -Dquickly clean install
+        run: ./mvnw -B -Dquickly -Drevision=999-SNAPSHOT clean install
 
       - name: Checkout timefold-solver-enterprise
         uses: actions/checkout@v7
@@ -181,7 +181,7 @@ jobs:
       - name: Quickly build timefold-solver-enterprise
         working-directory: ./timefold-solver-enterprise
         shell: bash
-        run: ./mvnw -B -Dquickly clean install
+        run: ./mvnw -B -Dquickly -Drevision=999-SNAPSHOT clean install
 
       - name: Switch quickstarts to branch under test if it exists
         working-directory: ./timefold-quickstarts