From b7f1629e3dcf8af63035cf7f4246522801793011 Mon Sep 17 00:00:00 2001 From: Andres Saa Date: Sat, 8 Aug 2026 19:21:07 +0200 Subject: [PATCH] ci: group action updates so a split upgrade cannot break ci MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The github-actions ecosystem had no groups at all, so one codeql-action upgrade arrived as three pull requests, one per action path. Two of them were red by construction: `init` and `analyze` ship from the same commit and the action refuses to run when they disagree, so bumping either half alone fails, and merging them in sequence would have left main with a broken CodeQL job in between. This is the same fix already applied to npm, extended to the ecosystem that turned out to need it more — there, a split update is noise; here it is a failure. Both `applies-to` values again, since the default covers version updates only. Validated against the SchemaStore dependabot-2.0 schema. --- .github/dependabot.yml | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index f4e4269..cb9b8e5 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -39,5 +39,20 @@ updates: directory: "/" schedule: interval: "weekly" + groups: + # Ungrouped, an action that exposes several paths arrives as one pull + # request per path. codeql-action is the case that proves it matters: + # `init` and `analyze` ship from one commit and the action refuses to run + # when they disagree, so the split bumps were red by construction and no + # merge order left main intact. Split upgrades are the only way these + # break, so they move together — same reasoning as the npm side above. + actions: + applies-to: version-updates + patterns: + - "*" + actions-security: + applies-to: security-updates + patterns: + - "*" commit-message: prefix: "ci"