From 6c1127b515d373509250e294334d759e7a63d4c5 Mon Sep 17 00:00:00 2001 From: Andrew Rose Date: Thu, 20 Aug 2026 13:04:22 -0700 Subject: [PATCH] ci: group codeql-action dependabot bumps init/analyze/upload-sarif are three separate actions under github/codeql-action, so dependabot bumped them independently across three PRs. init and analyze must match versions; two of those PRs (analyze-4.37.7, init-4.37.7) failed CI with a version mismatch since each only bumped one side. Grouping them ensures they move together. --- .github/dependabot.yml | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index b91140c..8e5e729 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -42,6 +42,14 @@ updates: open-pull-requests-limit: 5 # SHA pins update along with the `# vX.Y.Z` comment, so reviewers # see both the new pin and the human-readable version in the diff. + groups: + codeql-action: + applies-to: version-updates + # init/analyze/upload-sarif are separate actions in the same + # repo; CodeQL requires them to match versions, so they must + # bump together or analyze fails with a version mismatch. + patterns: + - "github/codeql-action/*" # Python deps of the manual harness-test rigs under testing/. These are # never built, never imported by the binary, and never distributed, so