Infra: Switch Dependabot to a monthly cadence (#3914)

* Infra: Switch Dependabot to a monthly cadence

Weekly Dependabot runs produce roughly 11 PRs a week, close to half of
all PRs in the repository. Dependency bumps only need to land before a
release, so run monthly and document a manual Dependabot check in the
release guide.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* Docs: Note that triggering Dependabot requires committer access

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* Docs: Replace Dependabot Insights link that returns 404 without write access

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* Docs: Restore Dependabot Insights link and skip it in markdown-link-check

The page returns 404 without write access, so the link checker cannot
verify it.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>

Author: kevinjqliu

.github/dependabot.yml

@@ -22,7 +22,7 @@ updates:
   - package-ecosystem: "uv"
     directory: "/"
     schedule:
-      interval: "weekly"
+      interval: "monthly"
     open-pull-requests-limit: 50
     ignore:
       - dependency-name: "datafusion"
@@ -31,7 +31,7 @@ updates:
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
-      interval: "weekly"
+      interval: "monthly"
     cooldown:
       default-days: 7
     groups:

mkdocs/docs/how-to-release.md

@@ -34,6 +34,8 @@ This guide outlines the process for releasing PyIceberg in accordance with the [
 * SVN Access
     * Permission to upload artifacts to the [Apache development distribution](https://dist.apache.org/repos/dist/dev/iceberg/) (requires Apache Committer access).
     * Permission to upload artifacts to the [Apache release distribution](https://dist.apache.org/repos/dist/release/iceberg/) (requires Apache PMC access).
+* GitHub Access
+    * Write access to the [apache/iceberg-python](https://github.com/apache/iceberg-python) repository for triggering Dependabot (requires Apache Committer access).
 * PyPI Access
     * The `twine` package must be installed for uploading releases to PyPi.
     * A PyPI account with publishing permissions for the [pyiceberg project](https://pypi.org/project/pyiceberg/).
@@ -65,6 +67,18 @@ deprecation_message(
 )
 ```
 
+### Update Dependencies
+
+<!-- markdown-link-check-disable-next-line -->
+Dependabot runs monthly to keep the noise down, so the pinned dependencies in `uv.lock` may be stale by the time of a release. Before cutting the release candidate, go to the [Dependabot page](https://github.com/apache/iceberg-python/network/updates) in the repository's Insights tab and trigger a manual check for both the `uv` and `github-actions` ecosystems. Review and merge the resulting PRs so the release ships with up-to-date dependencies.
+
+<!-- prettier-ignore-start -->
+
+!!! note
+    Only a committer with write access to the repository can trigger Dependabot manually. Please work with a committer if you do not have write access.
+
+<!-- prettier-ignore-end -->
+
 ### Update Library Version
 
 Update the release version by running `uv version <release-version>`, which updates both `pyproject.toml` and `uv.lock`. Then update the version in `pyiceberg/__init__.py` to match.