From c41bc75ea8d53ddf99d49df5609273b43bed59da Mon Sep 17 00:00:00 2001 From: Imran Siddique Date: Mon, 14 Sep 2026 11:21:36 -0700 Subject: [PATCH] chore(deps): group github/codeql-action updates into one PR github/codeql-action publishes one release under four action paths that all resolve to the same SHA. Dependabot opens a PR per path, each bumps one pin and strands the siblings, and CodeQL fails on the version mismatch. The three paths in codeql.yml also share adjacent lines, so the per-path PRs conflict with each other and cannot be merged back to back. Only codeql-action is grouped; other action updates keep their own PRs. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_015QRxFm1Z1kE9iraPspwr7j --- .github/dependabot.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index f5384c8..aa6389c 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -17,6 +17,10 @@ updates: interval: "weekly" day: "monday" open-pull-requests-limit: 5 + groups: + codeql-action: + patterns: + - "github/codeql-action*" - package-ecosystem: "pip" directories: