Group Dependabot updates and run them monthly

[kieran-osgood-shopify]

Part of a stack that cuts unused dependencies and Dependabot noise, following #871 (already merged). Review bottom-up, starting from #872.

What changes are you making?

Dependabot opened 67 version-update PRs in the last 90 days, mostly one PR per dependency per directory. This groups updates by family and moves version updates to a monthly schedule.

Security updates are unaffected.

• Dependabot security updates are enabled for this repository and not paused.
• They open as soon as an advisory is published, independent of schedule and cooldown.
• The groups here apply to version updates only, so security fixes still arrive as individual PRs.

Android (32 of the 67 PRs)

• Groups AGP, Kotlin + KSP, Apollo, AndroidX, and test libraries. This follows the grouping used by Android projects such as element-x-android, bitwarden/android and tivi, which all keep Kotlin and KSP together. Google's shared Android Renovate preset (android/.github) goes further and puts everything in one group.
• Fixes the existing apollo group pattern. It only matched com.apollographql.apollo*, so normalized-cache updates arrived separately (chore(deps): bump apollo from 5.1.0 to 5.2.0 in /platforms/android #849/chore(deps): bump com.apollographql.cache:normalized-cache from 1.0.7 to 1.0.8 in /platforms/android #850).
• com.android.application and com.android.library now share one androidGradlePlugin version ref. AGP needs one version per build, and two refs meant two PRs per AGP release.
• Limits the sample entry to the sample build's own Gradle wrapper and settings plugin. The version catalog is shared, so the sample scan duplicated the library entry's PRs (for example chore(deps): bump org.jetbrains.kotlin.android from 2.3.21 to 2.4.0 in /platforms/android/samples/CheckoutKitAndroidDemo #279–chore(deps): bump org.jetbrains.kotlin.plugin.compose from 2.3.21 to 2.4.0 in /platforms/android/samples/CheckoutKitAndroidDemo #281 alongside chore(deps): bump androidx.core:core-ktx from 1.18.0 to 1.19.0 in /platforms/android #366).

GitHub Actions (17 of the 67)

• Groups all actions into one PR.
• Also scans .github/actions/*, so the composite actions' own uses: get updates. This follows thunderbird-android.

npm and Bundler

• Each entry is grouped into one PR.
• For the React Native sample, grouping means one Podfile.lock refresh per cycle when native modules update.

Replaying the last 90 days against these groups gives about 26 PRs instead of 67. That's an estimate: it assumes one PR per group per month.

How to test

GIVEN this branch is merged to main

WHEN the next monthly Dependabot run happens

THEN Android updates should arrive as at most one PR per family (AGP, Kotlin, Apollo, AndroidX, Android test) plus individual PRs for other libraries

AND GitHub Actions updates should arrive as a single PR

AND each npm and Bundler directory should open at most one grouped PR

---

GIVEN a checkout of this branch

WHEN the reviewer runs dev android test and builds the Android sample

THEN both builds should configure with the shared androidGradlePlugin version

---

Before you merge

Important

• I've added tests to support my implementation
• I have read and agree with the Contribution Guidelines
• I have read and agree with the Code of Conduct
• I've updated the relevant platform README (platforms/swift/README.md and/or platforms/android/README.md)

[github-actions]

Bundle Size Budgets

Budget	Size	Limits	Result
—	—	—	➖ No configured budgets affected

Bundle and package size

Web bundle sizes cover shipped runtime JavaScript. Package sizes cover the full published archive, including any source maps, declarations, and documentation it contains.

Platform	Measurement	Compression	Base	Head	Delta
Android	Library package (.aar)	ZIP	407.6 KiB	407.6 KiB	0 B

Android package files (uncompressed)

These are uncompressed file sizes; they do not sum to the compressed package size above.

File	Base	Head	Delta
classes.jar	434.3 KiB	434.3 KiB	0 B
res/layout/checkout_view_content.xml	2.6 KiB	2.6 KiB	0 B
res/layout/checkout_sheet_content.xml	2.0 KiB	2.0 KiB	0 B
res/values/values.xml	1.3 KiB	1.3 KiB	0 B
R.txt	1.2 KiB	1.2 KiB	0 B
AndroidManifest.xml	922 B	922 B	0 B
proguard.txt	798 B	798 B	0 B
res/drawable/close.xml	431 B	431 B	0 B
res/menu/checkout_menu.xml	354 B	354 B	0 B
META-INF/com/android/build/gradle/aar-metadata.properties	157 B	157 B	0 B

How sizes are measured

Measured from the PR base SHA and PR head SHA. Web bundle rows sum shipped .js, .mjs, and .cjs files under dist/, excluding source maps and declarations. The gzip bundle size sums files compressed individually with gzip -n -9. npm package sizes are gzip-compressed .tgz archives; Android AAR sizes are ZIP archives. Package sizes are not final app binary sizes.

[bitrise]

Install this build

Open Tophat, select your target device, then click Install. Links open on the Mac running Tophat.

SDK	Install
Kotlin	Install with Tophat

Checkout Kit E2E results

Status	Tags	Target	Platform	OS version tag	Device
✅	launch, checkout-presentation, checkout-completion, buyer-identity, preload	kotlin	android	latest	Google Pixel 9 Android 17.0