From be48f490333d1b5c47eb2c81a56eb475b8f0758d Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 29 Jul 2026 12:39:19 +0000 Subject: [PATCH] ci: group Dependabot's codeql-action bumps into one PR MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Dependabot treats github/codeql-action/init and github/codeql-action/analyze as two dependencies, but CodeQL treats them as one action: a run whose steps disagree on version aborts with "Loaded a configuration file for version '4.37.3', but running version '4.37.2'". So every CodeQL release produced two PRs that each failed their Analyze jobs, and neither could merge on its own — 4.37.3 had to be landed by hand-combining #288 and #291 into #293. Group them so the two pins always move together in a single PR. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01B1NFi5pLqgCswDdaSdRfEr --- .github/dependabot.yml | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 3676b37..3e67302 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -17,6 +17,16 @@ updates: directory: "/" schedule: interval: "weekly" + groups: + # codeql-action/init and codeql-action/analyze are separate dependencies to + # Dependabot but one action to CodeQL: a run whose steps disagree on version + # aborts with "Loaded a configuration file for version 'X', but running + # version 'Y'". Ungrouped, each release lands as two PRs that both fail CI + # and can only be merged by hand-combining them (#293). Group them so the + # pins always move together. + codeql-action: + patterns: + - "github/codeql-action*" # Base images referenced by the Dockerfile - package-ecosystem: "docker"