[dborgards]

What does this change?

Closes #328. gitversion.tool and defaultdocumentation.console in .config/dotnet-tools.json were in no Dependabot group, so a bump (#283) carried the plain build(deps) subject that .releaserc.json maps to a patch release of nine unchanged packages. They are the repo-tooling group now (with the security-updates twin test-tooling has), the release rule's subject glob leaves that name out as it does test-tooling, and eng/verify-release-config.mjs checks both subjects publish nothing.

#330 (grouping the codeql-action bumps) turned out to be done on main already (3c59765); the commit this branch first carried for it duplicated that group's key and is dropped (Codex and Bugbot on the first head).

Type of change

• docs / test / refactor / chore / ci — no release

Checklist

• YAML parses with duplicate keys rejected; JSON parses; node eng/verify-release-config.mjs 9.9.9 passes with the new subjects (repo-tooling, repo-tooling-security → no release; EdsDcfNet bump → patch)
• build/test — not run: no project file or C# touched
• Related: build(deps): the dotnet-tools manifest entries gitversion.tool and defaultdocumentation.console are not in a Dependabot group, so a tool bump releases a patch #328, Release chain: npm ci runs scripts in the OIDC job, Dependabot test-tooling bumps release, no package validation baseline #257

🤖 Generated with Claude Code

[cursor]

PR Summary

Low Risk
Release and Dependabot configuration only; no application or package code changes.

Overview
Adds a repo-tooling Dependabot group (plus repo-tooling-security) for gitversion.tool and defaultdocumentation.console, so bumps to those dotnet tools get commit subjects that name the group instead of a generic build(deps) message.

.releaserc.json now treats build(deps) commits whose subject mentions repo-tooling like test-tooling: they do not trigger a NuGet patch release. eng/verify-release-config.mjs documents that behavior and asserts both repo-tooling and repo-tooling-security subjects publish nothing, while shipped dependency bumps still publish a patch.

Closes #328 by preventing accidental package releases when only repo build/doc tooling changes.

^{Reviewed by Cursor Bugbot for commit a4bc2ed. Bugbot is set up for automated code reviews on this repo. Configure here.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-20T14:33:02.227001Z	a4bc2ed	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 05aa6fb5c4

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[cursor]

Stale Bugbot comment from a previous run.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit cbc925b. Configure here.}