chore(deps): group github/codeql-action updates into one PR - #192
Merged
Conversation
github/codeql-action publishes one release under four action paths that all resolve to the same SHA. Dependabot opens a PR per path, each bumps one pin and strands the siblings, and CodeQL fails on the version mismatch. The three paths in codeql.yml also share adjacent lines, so the per-path PRs conflict with each other and cannot be merged back to back. Only codeql-action is grouped; other action updates keep their own PRs. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015QRxFm1Z1kE9iraPspwr7j
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Groups
github/codeql-actionupdates so dependabot opens one PR per release instead of four.Why
github/codeql-actionpublishes a single release under four action paths,init,autobuild,analyzeandupload-sarif, and all four resolve to the same SHA. Dependabot treats each path as its own dependency and opens a PR per path. Each of those bumps one pin and leaves the siblings behind, and CodeQL refuses a version mismatch, soAnalyzefails on three of the four every time.They cannot be merged back to back either:
init,autobuildandanalyzelive on adjacent lines of the samecodeql.yml, so the first merge conflicts the rest.That happened on 2026-09-14 across demos, examples and integrations, and was resolved by hand with one consolidated bump per repo. This stops it recurring on the next release.
Scope
Deliberately narrow. Only
github/codeql-action*is grouped, not every action. Grouping allgithub-actionsupdates would also fold unrelated bumps into one PR, which is a separate decision about how coarse a review should be. This one is about a dependency that is broken by being split.Insertions only, four lines, no existing entry changed.