feat: Single workflow and actions optimizations

.github/dependabot.yml

@@ -8,6 +8,12 @@ updates:
     open-pull-requests-limit: 1
     labels:
       - dependencies
+    groups:
+      dev-deps:
+        dependency-type: "development"
+      prod-deps:
+        dependency-type: "production"
+
     ignore:
       - dependency-name: actix-rt
         versions:
@@ -69,6 +75,10 @@ updates:
     open-pull-requests-limit: 1
     labels:
       - dependencies
+    groups:
+      python-deps:
+        patterns:
+          - "*"
 
   - package-ecosystem: "github-actions"
     directory: "/"
@@ -78,3 +88,7 @@ updates:
     open-pull-requests-limit: 1
     labels:
       - dependencies
+    groups:
+      actions-deps:
+        patterns:
+          - "*"

.github/workflows/cleanup-branch-cache.yml

@@ -0,0 +1,34 @@
+name: Cleanup branch caches on merge
+
+on:
+  pull_request:
+    types: [closed]
+
+jobs:
+  cleanup-cache:
+    # Runs on both merged PRs and PRs closed without merging
+    runs-on: ubuntu-latest
+    permissions:
+      actions: write
+    steps:
+      - name: Delete caches for closed branch
+        run: |
+          CACHE_IDS=$(gh cache list \
+            --repo "${{ github.repository }}" \
+            --ref "refs/heads/${{ github.head_ref }}" \
+            --limit 100 \
+            --json id \
+            --jq '.[].id') || true
+
+          if [ -z "$CACHE_IDS" ]; then
+            echo "No caches found for branch ${{ github.head_ref }}"
+            exit 0
+          fi
+
+          echo "Deleting caches for closed branch: ${{ github.head_ref }}"
+          echo "$CACHE_IDS" | while IFS= read -r id; do
+            echo "  Deleting cache ID: $id"
+            gh cache delete "$id" --repo "${{ github.repository }}" || true
+          done
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/glean-probe-scraper.yml

@@ -5,6 +5,7 @@ on:
     branches: [master]
   pull_request:
     branches: [master]
+
 permissions: {} # workflow-level default — deny all
 
 concurrency: