Tracking: weekly, grouped Dependabot updates and release-time license version checks #20732

Motivation

Dependabot opens one PR per artifact every day. Over the 13 weeks to 2026-10-22 that was 381 of 696 commits on master and about 18% of PR runs of the unit-test workflow, and 166 of those PRs needed a manual licenses.yaml edit before they could pass. The dev@ discussion is here: https://lists.apache.org/thread/7y1bkvbb6og394mph4lx2x35dktv38nk

This issue tracks the individual PRs. Each item can be picked up on its own unless it says otherwise.

Dependabot configuration

• ci: use build(deps) prefix for Maven and npm Dependabot PRs #20691 Explicit build(deps) / build(deps-dev) PR title prefix for Maven and npm
• ci: run Maven Dependabot updates weekly and group them #20733 Weekly Maven updates: one group for all minor and patch updates, one PR per major update, and grouped security updates for every ecosystem

licenses.yaml: check versions at release time instead of on every PR

• build: add script to refresh licenses.yaml versions #20736 Script that refreshes the versions in licenses.yaml from the Maven license reports. Run locally on a Dependabot branch, it also fixes the license check there.
• No PR yet: check-licenses.py only warns about a version difference in PR CI, but still fails on an added or removed dependency or a changed license. The release build (-Papache-release) stays strict. Needs build: add script to refresh licenses.yaml versions #20736.
• No PR yet: a release guide step to run the refresh script before cutting the release branch. Can share a PR with the item above.

Related: #20707 (merged) makes the license check cover the modules the release LICENSE includes, and #20737 corrects per-module versions that had drifted from what the release ships.

Related CI cleanups

Not part of the proposal, but they also reduce CI load or are needed for the ASF GitHub Actions policy.

• ci: cancel superseded Cron Job ITs runs on pull requests #20692 Cancel superseded Cron Job ITs runs on pull requests
• ci: replace pull_request_target in labeler and milestone workflows #20693 Replace pull_request_target in the labeler and milestone workflows before the ASF turns it off in November 2026
• ci: keep the milestone creation message out of the milestone number #20694 Keep the milestone creation message out of the milestone number