Group otel dependencies in a single dependabot PR

[rdimitrov]

Motivation and Context

The following PR groups all otel deps in a single dependabot PR as usually they are spread across 4-5 separate ones whenever there's a new version.

How Has This Been Tested?

Breaking Changes

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update

Checklist

• I have read the MCP Documentation
• My code follows the repository's style guidelines
• New and existing tests pass locally
• I have added appropriate error handling
• I have added or updated documentation as needed

Additional context

[tadasant]

@claude review this PR

[claude]

Claude finished @tadasant's task in 53s —— View job

---

PR Review

Todo:

• Read the modified dependabot configuration file
• Analyze the changes for correctness and best practices
• Provide comprehensive review feedback

---

Review Summary

Overall: ✅ Approved with minor suggestions

This PR effectively achieves its goal of consolidating OpenTelemetry dependency updates. The configuration is correct and follows dependabot best practices.

Detailed Review

What Changed

The PR adds groups configuration to both Go module update entries in .github/dependabot.yml:

• Root directory (/) gomod updates
• Deploy directory (/deploy) gomod updates

Each now groups all go.opentelemetry.io/* packages together, which means dependabot will create a single PR when any otel dependency has an update, instead of creating 4-5 separate PRs.

Positive Aspects ✅

1. Correct Pattern Matching: The pattern "go.opentelemetry.io/*" correctly matches all otel packages currently in use:

   • go.opentelemetry.io/contrib/instrumentation/runtime
   • go.opentelemetry.io/otel
   • go.opentelemetry.io/otel/exporters/prometheus
   • go.opentelemetry.io/otel/metric
   • go.opentelemetry.io/otel/sdk
   • go.opentelemetry.io/otel/sdk/metric
   • And all indirect dependencies

2. Consistent Application: The grouping is applied to both directories (/ and /deploy), ensuring consistent behavior across the entire project.

3. Clean Configuration: The YAML formatting is consistent with the existing style in the file.

4. Solves Real Problem: This addresses a legitimate maintenance burden where otel packages typically release together, creating noise with multiple PRs.

Suggestions 💡

Optional Enhancement: Consider adding a descriptive update message for the group to make the generated PR more informative:

groups:
  opentelemetry:
    patterns:
      - "go.opentelemetry.io/*"
    update-types:
      - "minor"
      - "patch"

This would limit grouping to minor and patch updates only, keeping major version updates separate (which might have breaking changes that warrant individual attention). However, since otel is generally stable, the current approach is also fine.

Testing Recommendation

To verify this works as expected:

1. Wait for the next otel dependency update
2. Confirm dependabot creates a single PR instead of multiple PRs
3. If needed, you can also manually trigger dependabot to test: Go to the repository's "Insights" → "Dependency graph" → "Dependabot" and click "Check for updates"

Conclusion

The changes are well-implemented and will improve the maintenance experience. The configuration correctly targets all OpenTelemetry packages and follows dependabot's grouping best practices. This PR is ready to merge! 🚀

---