ci: monthly grouped dependabot; actions/checkout 7

Dependabot runs monthly with grouped version updates.
actions/checkout 5 -> 7 in ci, qa and release (#13).

.github/dependabot.yml

@@ -1,52 +1,33 @@
+# Version updates are monthly and grouped into one PR per ecosystem.
+# Security updates are separate and run whenever an advisory is published.
 version: 2
-
-# Dependency updates land on `dev`, never on `main`.
-#
-# `main` here is a RELEASE POINTER that freemkv's release-orchestrate.yml
-# moves to each tag. A bot commit on it would put work there that no tag
-# contains, which is exactly the state that aborted the 1.6.2 cascade at the
-# last step -- so pointing Dependabot at main would recreate that failure on a
-# schedule.
 updates:
 - package-ecosystem: cargo
   directory: /
   target-branch: dev
   schedule:
-      interval: weekly
+    interval: monthly
   open-pull-requests-limit: 5
-    # One PR per week for the routine bumps instead of one per crate.
   groups:
-      minor-and-patch:
-        update-types:
-          - minor
-          - patch
+    all:
+      patterns:
+      - '*'
   ignore:
-      # The freemkv crates depend on each other by GIT TAG, re-pinned by
-      # release-orchestrate.yml in the release commit. A bot bump would fight
-      # the release cascade and could pin a tag that does not exist yet.
   - dependency-name: freemkv-unlock
   - dependency-name: libfreemkv
   - dependency-name: freemkv-keysources
   - dependency-name: freemkv-i18n
   - dependency-name: freemkv-engine
-
 - package-ecosystem: github-actions
   directory: /
   target-branch: dev
   schedule:
-      interval: weekly
+    interval: monthly
   open-pull-requests-limit: 5
   groups:
-      actions:
-        update-types:
-          - minor
-          - patch
+    all:
+      patterns:
+      - '*'
   ignore:
-      # Versioned by the Rust release it installs; CI picks the toolchain via
-      # `toolchain:` on @master/@stable. Dependabot proposes Rust versions that
-      # do not exist. Toolchain bumps are a deliberate all-repo change.
   - dependency-name: dtolnay/rust-toolchain
-      # The org's own reusable workflows/actions. @v1 and @v2 are independent
-      # moving tags (v2 is only the comment guard), not semver releases: a
-      # "bump" from v1 to v2 would move a caller onto an OLDER guard.
-      - dependency-name: "freemkv/.github*"
+  - dependency-name: freemkv/.github*

.github/workflows/ci.yml

@@ -53,7 +53,7 @@ jobs:
     outputs:
       v: ${{ steps.msrv.outputs.v }}
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - id: msrv
         shell: bash
         run: echo "v=$(grep -m1 '^rust-version' Cargo.toml | sed -E 's/.*\"([^\"]+)\".*/\1/')" >> "$GITHUB_OUTPUT"
@@ -67,7 +67,7 @@ jobs:
   changelog:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - name: Require a CHANGELOG entry for the crate version on main
         shell: bash
         run: |
@@ -88,7 +88,7 @@ jobs:
     needs: resolve-msrv
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
         with:
           path: freemkv-keysources
       - uses: freemkv/.github/.github/actions/checkout-siblings@v1
@@ -119,7 +119,7 @@ jobs:
     needs: resolve-msrv
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
         with:
           path: freemkv-keysources
       - uses: freemkv/.github/.github/actions/checkout-siblings@v1
@@ -143,7 +143,7 @@ jobs:
   deny:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
         with:
           path: freemkv-keysources
       - uses: freemkv/.github/.github/actions/checkout-siblings@v1
@@ -176,7 +176,7 @@ jobs:
     if: github.ref_name == 'qa' || github.ref_name == 'main'
     runs-on: macos-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
         with:
           path: freemkv-keysources
       - uses: freemkv/.github/.github/actions/checkout-siblings@v1
@@ -203,7 +203,7 @@ jobs:
     needs: resolve-msrv
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
         with:
           path: freemkv-keysources
       - uses: freemkv/.github/.github/actions/checkout-siblings@v1
@@ -244,7 +244,7 @@ jobs:
     if: github.ref_name == 'qa' || github.ref_name == 'main'
     runs-on: windows-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
         with:
           path: freemkv-keysources
       - uses: freemkv/.github/.github/actions/checkout-siblings@v1

.github/workflows/qa.yml

@@ -37,7 +37,7 @@ jobs:
     outputs:
       v: ${{ steps.msrv.outputs.v }}
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - id: msrv
         shell: bash
         run: echo "v=$(grep -m1 '^rust-version' Cargo.toml | sed -E 's/.*\"([^\"]+)\".*/\1/')" >> "$GITHUB_OUTPUT"
@@ -61,7 +61,7 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
       - name: Stamp the next rc
@@ -90,7 +90,7 @@ jobs:
         os: ['ubuntu-latest', 'macos-latest']
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
         with:
           path: freemkv-keysources
       - uses: freemkv/.github/.github/actions/checkout-siblings@v1
@@ -113,7 +113,7 @@ jobs:
   cross-lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
         with:
           path: freemkv-keysources
       - uses: freemkv/.github/.github/actions/checkout-siblings@v1
@@ -139,7 +139,7 @@ jobs:
     needs: resolve-msrv
     runs-on: windows-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
         with:
           path: freemkv-keysources
       - uses: freemkv/.github/.github/actions/checkout-siblings@v1

.github/workflows/release.yml

@@ -17,7 +17,7 @@ jobs:
   verify:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - name: Verify Cargo.toml version matches tag
         run: |
           CARGO_VER="v$(grep '^version' Cargo.toml | head -1 | sed 's/.*"\(.*\)"/\1/')"
@@ -41,7 +41,7 @@ jobs:
     needs: verify
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - id: msrv
         shell: bash
         run: echo "v=$(grep -m1 '^rust-version' Cargo.toml | sed -E 's/.*\"([^\"]+)\".*/\1/')" >> "$GITHUB_OUTPUT"
@@ -62,7 +62,7 @@ jobs:
     needs: verify
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - name: Create GitHub Release
         uses: softprops/action-gh-release@v3
         with: