chore(deps): cut Dependabot and lint runs

.github/dependabot.yml

@@ -3,8 +3,11 @@ updates:
   # >>> template:base
   - package-ecosystem: github-actions
     directory: /
+    # Monthly: every update run, and every rebase of an open PR, is a billed Actions run
+    # on a private repository. Security updates ignore the schedule.
     schedule:
-      interval: weekly
+      interval: monthly
+    open-pull-requests-limit: 3
     cooldown:
       default-days: 7
     commit-message:

.github/workflows/lint.yml

@@ -1,10 +1,9 @@
 name: Lint
 
+# No `push` or `merge_group` trigger: every change reaches main through a pull request that
+# already ran these hooks, and the repository has no merge queue.
 on:
-  push:
-    branches: [main]
   pull_request:
-  merge_group:
 
 permissions: {}
 

.template-version

@@ -1 +1 @@
-v0.3.1
+v0.3.2

CONTRIBUTING.md

@@ -90,6 +90,10 @@ markers, are kept in step with `studiobimo/project-template`. Change them there,
 `make -C .devtools sync` brings the change in. `make -C .devtools drift` shows what differs, and a
 weekly workflow opens an issue when something does. A deliberate difference goes in
 `.template-ignore`, with a comment saying why.
+
+Projects only receive a change at a release, and release-please releases only `fix`, `feat` and
+breaking commits. A change to a managed file titled `chore`, `docs` or `ci` merges but never reaches
+`sync`, so title it `fix` or `feat`.
 <!-- <<< template:workflow -->
 
 ### One pack per pull request