From 51887f9e5b591694739f6a0ffa73a390d95acdf2 Mon Sep 17 00:00:00 2001 From: William Storey Date: Tue, 21 Jul 2026 18:51:57 +0000 Subject: [PATCH 1/2] Run Dependabot updates weekly We now review dependency updates weekly rather than daily, so daily update runs only generate churn. Check for updates once a week on Monday morning instead. Co-Authored-By: Claude Fable 5 --- .github/dependabot.yml | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index b0d3d88..b4f6164 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -3,7 +3,8 @@ updates: - package-ecosystem: gomod directory: / schedule: - interval: daily + interval: weekly + day: monday time: '14:00' open-pull-requests-limit: 10 cooldown: @@ -11,7 +12,8 @@ updates: - package-ecosystem: github-actions directory: / schedule: - interval: daily + interval: weekly + day: monday time: '14:00' cooldown: default-days: 7 From 69c8a25f529d52434b188dcf5c47e05e09b5a121 Mon Sep 17 00:00:00 2001 From: William Storey Date: Tue, 21 Jul 2026 18:52:18 +0000 Subject: [PATCH 2/2] Group CodeQL action updates Dependabot treats the github/codeql-action subpath actions (init, analyze, autobuild) as separate dependencies and opens a separate PR for each. CI fails unless they are all updated together. Group them so that they arrive as a single PR. Co-Authored-By: Claude Fable 5 --- .github/dependabot.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index b4f6164..11e7f8c 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -15,5 +15,9 @@ updates: interval: weekly day: monday time: '14:00' + groups: + codeql: + patterns: + - github/codeql-action* cooldown: default-days: 7