From 8e4ae437c128dbc98d5e4c327f57e1355aa5837e Mon Sep 17 00:00:00 2001
From: Alexander Pantiukhov <alex@apantiukhov.com>
Date: Thu, 16 Jul 2026 13:26:56 +0200
Subject: [PATCH] ci(dependabot): Group github/codeql-action/* bumps

The three CodeQL sub-actions (init, autobuild, analyze) share config and
the CodeQL bundle, so their pins must move together. Dependabot bumps
them independently by default, which leaves the workflow in a mismatched
state and has required manual "match" PRs (e.g. #6410).

Grouping them makes future bumps land as one PR.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
---
 .github/dependabot.yml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 2f4fea5b63..1f4c3ad7bb 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -27,3 +27,7 @@ updates:
     directory: '/'
     schedule:
       interval: weekly
+    groups:
+      codeql-action:
+        patterns:
+          - 'github/codeql-action/*'