Fix Dependabot auto-approve when update-type is empty

[proxymeshai]

Summary

Stopped after Dependabot #41 (scrapy): CI was green and auto-merge was already enabled, but the approve step never ran because dependabot/fetch-metadata v2.5.0 left update-type empty for pip requirement-range bumps.

Fix

No custom title parsing and no PR code checkout.

1. Bump dependabot/fetch-metadata to v3.1.0 — upstream restores update-type for pip/composer requirement bumps (in /dir regex + title fallback inside the action).
2. Split Dependabot groups — replace dev-all with:
   • dev-minor-patch (auto-merge eligible)
   • dev-major (manual review)
3. Eligibility (metadata / group only):
   • Block explicit semver-major
   • Allow explicit minor/patch
   • If update-type is empty: allow only prod-minor-patch / dev-minor-patch
   • Otherwise fail closed

Keeps skip-commit-verification so branch updates still work.

After merge

Resume updating open Dependabot PR branches one at a time.

Slack Thread

  

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 01b464e. Configure here.}

[proxymeshai]

@cursoragent bugbot review

[cursor]

Bugbot finding is already fixed on head 886bdcf; CI is green and the review thread is resolved/outdated. No further code changes needed.

Finding: empty update-type used to auto-approve every dev-all PR, but that group includes majors.

Fix in place: only prod-minor-patch is trusted as a group shortcut. dev-all and everything else fall through to same-major title parsing (or fail closed).

Re-review of current head: no new blockers. Still fail-closed for:

• explicit majors
• dev-all group bumps with empty metadata and no parseable from/to title
• unclassified titles (e.g. single-component versions like from 4 to 5)

Scrapy-style titles (Update scrapy from >=2.14.2 to >=2.18.0) still allow correctly. Ready for human review.

  

[proxymeshai]

@cursoragent bugbot review

[cursor]

Bugbot re-review (head 5d2ff00): no new blockers.

The earlier finding (“dev-all allows majors on empty update-type”) is obsolete — that group is gone.

Current head is sound:

• fetch-metadata v3.1.0 should restore update-type for pip/composer bumps
• Empty update-type only trusts prod-minor-patch / dev-minor-patch (both exclude majors)
• dev-major and actions fail closed unless update-type is explicitly minor/patch
• Explicit majors always blocked
• No title parsing, no PR code checkout

CI is green. Ready for human review.