From 00db897c24402e2575dbf4da7b9f4d01f9447f2d Mon Sep 17 00:00:00 2001 From: Tobias Gesellchen Date: Thu, 9 Jul 2026 21:17:50 +0200 Subject: [PATCH] ci: group codeql-action sub-actions in Dependabot github/codeql-action/init, /analyze and /upload-sarif are separate Dependabot dependencies but must run on the same version. Without a group they update in independent PRs that merge at different times, producing a version mismatch that fails CodeQL. Group them so all sub-actions bump together in one PR. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/dependabot.yml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index ba3b7ac..51bec79 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -125,6 +125,13 @@ updates: allow: - dependency-type: "all" groups: + # Group all codeql-action sub-actions (init/analyze/upload-sarif) + # so they bump together. They are separate dependencies to + # Dependabot but must stay on the same version, or CodeQL fails + # with "Loaded a configuration file for version X, but running Y". + codeql-action: + patterns: + - "github/codeql-action*" # Group actions from the same organization actions-core: patterns: