From 3460cb9a1a22e7ed2658b2c7120342a03edc4efa Mon Sep 17 00:00:00 2001
From: EquityBot <333319867+EquityBot@users.noreply.github.com>
Date: Sun, 1 Nov 2026 18:05:01 +1100
Subject: [PATCH] ci(dependabot): group github/codeql-action updates

Dependabot opened init, analyze and upload-sarif as separate PRs, and CodeQL fails a workflow whose steps use different versions. One group puts them in one PR.
---
 .github/dependabot.yml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 1941657..60d10a7 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -4,6 +4,11 @@ updates:
     directory: /
     schedule:
       interval: weekly
+    groups:
+      # CodeQL refuses a workflow whose init, analyze and upload-sarif steps differ in version.
+      codeql-action:
+        patterns:
+          - "github/codeql-action*"
   # The pinned CLIs behind the load checks; see .github/ci/README.md.
   - package-ecosystem: npm
     directories: