From 68232cc9bcd5ed7c2ff961fa5e6cf44724374586 Mon Sep 17 00:00:00 2001 From: "Gavin Barron (from Dev Box)" Date: Wed, 21 Oct 2026 19:03:25 -0700 Subject: [PATCH] ci: group codeql-action dependabot updates Dependabot opens separate PRs for github/codeql-action/init and github/codeql-action/analyze. Each fails CI on its own because init and analyze must run the same CodeQL version. Grouping them produces a single PR that bumps both together. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 4b937acb-2750-48a9-a62e-43e2b8073d0e --- .github/dependabot.yml | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 31f9831f8..6b49e555a 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -26,4 +26,9 @@ updates: interval: daily open-pull-requests-limit: 10 cooldown: - default-days: 7 \ No newline at end of file + default-days: 7 + groups: + # init and analyze must be on the same version or the CodeQL job fails + codeql-action: + patterns: + - "github/codeql-action*" \ No newline at end of file