chore(deps): group ai-sdk + gcp-actions in dependabot

[julianken]

WHY

Drift audit 2026-05-04, nodes/09-github-state.json findings 3 (BLOCKER), 4 (IMPORTANT), 13 (IMPORTANT cross-reference):

• BLOCKER (finding 3): Standalone Dependabot PRs build(deps-dev): bump @ai-sdk/openai from 1.3.24 to 3.0.58 #221 (ai 4→6) and build(deps-dev): bump ai from 4.3.19 to 6.0.174 #223 (@ai-sdk/openai 1→3) both fail Lint & Typecheck because they introduce a v1↔v3 type clash that lint correctly catches. ai and @ai-sdk/* are companion packages from the same vendor; bumping separately is unsafe. Dependabot has no groups: block covering them.
• IMPORTANT (finding 4): Five github-actions Dependabot bumps (build(deps): bump actions/checkout from 4 to 6 #124-build(deps): bump actions/setup-node from 4 to 6 #128) opened 2026-04-27 are 7+ days old; all 5 fail E2E Shard 3/4 (and build(deps): bump actions/checkout from 4 to 6 #124 fails Vitest). Not grouped — each ships as own PR. Recurring shard-3/4 failure pattern is investigated separately in fix(ci): investigate recurring E2E Shard 3/4 failure on dep PRs #242.
• IMPORTANT (finding 13): Same root cause — no grouping for @types/* either.

WHAT

Edit .github/dependabot.yml only:

1. npm groups: add three groups:

ai-sdk:
  patterns:
    - "ai"
    - "@ai-sdk/*"
dom-testing:
  patterns:
    - "jsdom"
    - "happy-dom"
types:
  patterns:
    - "@types/*"

2. github-actions section: add two groups:

gcp-actions:
  patterns:
    - "google-github-actions/*"
actions-core:
  patterns:
    - "actions/*"

3. After merge: close stuck PRs to let Dependabot recreate as grouped:

gh pr close 221 --repo julianken/detached-node --comment "Will be regrouped by dependabot under ai-sdk group."
gh pr close 223 --repo julianken/detached-node --comment "Will be regrouped by dependabot under ai-sdk group."

(Stale GH-Actions PRs #124-#128 will close themselves on the next Dependabot cycle once they are superseded by the new grouped PR.)

DONE WHEN

• .github/dependabot.yml contains the 5 named groups (ai-sdk, dom-testing, types, gcp-actions, actions-core).
• PRs build(deps-dev): bump @ai-sdk/openai from 1.3.24 to 3.0.58 #221 and build(deps-dev): bump ai from 4.3.19 to 6.0.174 #223 are closed.
• Within one Monday cycle of the change merging, Dependabot opens at most 1 grouped PR per family (verify by gh pr list --label dependencies --state open --repo julianken/detached-node).

OUT OF SCOPE

• Investigating the recurring E2E Shard 3/4 failure (handled by fix(ci): investigate recurring E2E Shard 3/4 failure on dep PRs #242, which depends on this issue's regrouping).
• Backfilling labels (handled by chore(labels): backfill ADP labels + delete orphan queued/dequeued #243).

PRE-REQS

None.

[julianken-bot]

Verdict: APPROVED

Verification ledger

• Title length: 53 chars (≤70). PASS.
• .github/dependabot.yml baseline confirmed: none of ai-sdk, gcp-actions, actions-core, dom-testing, types exist today. The five proposed groups are net-new additions. PASS.
• PR build(deps-dev): bump @ai-sdk/openai from 1.3.24 to 3.0.58 #221 (@ai-sdk/openai 1.3.24 → 3.0.58) and PR build(deps-dev): bump ai from 4.3.19 to 6.0.174 #223 (ai 4.3.19 → 6.0.174) both confirmed OPEN. The close-and-let-Dependabot-recreate step in the WHAT section will fire on real PRs. PASS.
• Drift audit nodes/09-github-state.json findings 3 (BLOCKER, AI-SDK family), 4 (IMPORTANT, github-actions family), and 13 (IMPORTANT, label/group taxonomy cross-reference) read end-to-end and confirmed as the source of this issue's WHY. PASS.
• Cross-referenced issues fix(ci): investigate recurring E2E Shard 3/4 failure on dep PRs #242 (E2E Shard 3/4) and chore(labels): backfill ADP labels + delete orphan queued/dequeued #243 (label backfill) exist and are OPEN. The OUT OF SCOPE deferrals are legitimate. PASS.

Findings

1. SUGGESTION — dom-testing group looks redundant with existing testing group

jsdom and happy-dom are DOM emulators consumed by vitest (already in the testing group covering vitest, @vitest/*, @playwright/test, @testing-library/*). Bumping jsdom independently from vitest is the exact failure mode this issue is addressing for ai + @ai-sdk/*: companion packages in the same toolchain that drift apart create version mismatches.

Recommend folding jsdom and happy-dom into the existing testing group rather than creating a parallel dom-testing group:

testing:
  patterns:
    - "vitest"
    - "@vitest/*"
    - "@playwright/test"
    - "@testing-library/*"
    - "jsdom"
    - "happy-dom"

This reduces moving pieces and matches the stated goal (group co-evolving deps). If there's a reason to keep them separate (e.g., DOM emulator swaps independently of runner upgrades), the WHY should say so explicitly so the next reader understands the intent.

This is plan-level, not blocking. The current grouping does work — it just creates two PRs per Monday cycle for the same toolchain instead of one.

2. SUGGESTION — DONE WHEN should name the verification command

The DONE WHEN block says "verify by gh pr list --label dependencies --state open --repo julianken/detached-node" which is good. Consider adding the expected post-state explicitly: "≤6 open dependency PRs (one per group: payload, testing, next-react, tailwind, ai-sdk, gcp-actions/actions-core), down from 11 today." This turns the deferred verification into a check with a concrete pass/fail boundary instead of "at most 1 per family" which a future reader has to count groups to apply.

Bottom line

Scope is tight, WHY traces cleanly to specific drift-audit findings, the WHAT is a single-file YAML edit, and the deferred verification is named with a real cycle boundary (one Monday). The two suggestions are planning polish, not corrections.

Verdict: APPROVED.

— @julianken-bot (opus, fresh context, reviewing-as-julianken-bot skill)

[julianken]

Reviewed at PR #268 — bot APPROVED.

[julianken]

Completed: merged via PR #268 (admin-merge to bypass paths-ignore deadlock for .github/dependabot.yml-only change) at .

[julianken]

Completed: merged via PR #268 (admin-merge after workflow_dispatch ran E2E to satisfy branch protection) at .