ci: document monthly Dependabot updates without bot assignments

Author: rwgk

.github/dependabot.yml

@@ -21,11 +21,13 @@ updates:
         patterns: ["*"]
         update-types: ["major", "minor", "patch"]
 
-  # Group quarterly hook revision updates, preserving SHA pins and frozen comments.
+    labels: [CI/CD, dependencies]
+
+  # Group monthly hook revision updates, preserving SHA pins and frozen comments.
   - package-ecosystem: pre-commit
     directory: /
     schedule:
-      interval: "quarterly"
+      interval: "monthly"
       time: "09:00"
       timezone: "America/Los_Angeles"
 
@@ -40,13 +42,11 @@ updates:
       - dependency-name: "https://github.com/lycheeverse/lychee"
 
     groups:
-      pre-commit-quarterly:
+      pre-commit-monthly:
         applies-to: version-updates
         patterns: ["*"]
 
-    assignees: [rwgk]
     labels: [CI/CD, dependencies]
-    milestone: 54
 
   # GitHub Actions updates targeting the 12.9.x branch
   - package-ecosystem: github-actions
@@ -65,3 +65,5 @@ updates:
         applies-to: version-updates
         patterns: ["*"]
         update-types: ["major", "minor", "patch"]
+
+    labels: [CI/CD, dependencies]

CONTRIBUTING.md

@@ -221,7 +221,7 @@ and freshly rendered HTML, including link fragments. It runs on PR updates and
 from nightly CI; copied `pull-request/*` branches do not repeat these checks.
 
 Nightly link checks start with a fresh cache and publish successful checks for
-PRs to reuse for up to one day. Dependabot groups quarterly pre-commit hook
+PRs to reuse for up to one day. Dependabot groups monthly pre-commit hook
 revision updates into one PR for review. Lychee version updates are maintained
 separately so its local hook and CI binary stay aligned. The local lychee hook keeps its current
 behavior until a stable release supports an explicit cache location.

ci/README-pre-commit-migration.md

@@ -50,9 +50,10 @@ latest documentation trees under `artifacts/docs`.
 
 ## Hook updates
 
-Dependabot groups pre-commit hook revision updates into one quarterly PR,
-preserving SHA pins and their `# frozen:` version comments. Updates retain the
-assignee, labels, and milestone. Only hook repository URLs are allowed;
+Dependabot groups pre-commit hook revision updates into one monthly PR,
+preserving SHA pins and their `# frozen:` version comments. All hook and GitHub
+Actions update PRs use the `CI/CD` and `dependencies` labels, without an automatic
+assignee or milestone. Only hook repository URLs are allowed;
 `additional_dependencies` pins stay unchanged. Lychee is excluded because its
 hook revision, `LYCHEE_VERSION` argument, and CI binary pin must be updated
 together.