ci(dependabot): group updates and skip auto-merge for majors

.github/CODEOWNERS

@@ -0,0 +1 @@
+* @bentsku

.github/dependabot.yml

@@ -1,16 +1,38 @@
 version: 2
 updates:
+  # Library deps. `uuid` is the only runtime dependency and ships to consumers
+  # via the git-tag pin, so it is deliberately left out of the group and keeps
+  # its own PR. Majors also stay ungrouped so they can be reviewed individually.
   - package-ecosystem: "npm"
     directory: "/"
     schedule:
       interval: "weekly"
+    assignees:
+      - "bentsku"
+    groups:
+      dev-dependencies:
+        dependency-type: "development"
+        update-types: ["minor", "patch"]
 
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
       interval: "weekly"
+    assignees:
+      - "bentsku"
+    groups:
+      github-actions:
+        patterns: ["*"]
+        update-types: ["minor", "patch"]
 
+  # CDK test infrastructure: nothing here reaches consumers, so batch it all.
   - package-ecosystem: "npm"
     directory: "/cdk"
     schedule:
       interval: "weekly"
+    assignees:
+      - "bentsku"
+    groups:
+      cdk:
+        patterns: ["*"]
+        update-types: ["minor", "patch"]

.github/workflows/dependabot-automerge.yml

@@ -16,6 +16,7 @@ jobs:
         with:
           github-token: "${{ secrets.GITHUB_TOKEN }}"
       - name: Enable auto-merge for Dependabot PRs
+        if: steps.metadata.outputs.update-type != 'version-update:semver-major'
         run: gh pr merge --auto --squash "$PR_URL"
         env:
           PR_URL: ${{github.event.pull_request.html_url}}