group github/codeql-action/* dependabot updates into one PR - #2914
Merged
Conversation
The CodeQL action requires every step in a run to be on the same version: `init` stamps its version into the config that `analyze` later loads, so a mismatch fails the job with "Loaded a configuration file for version X, but running version Y". codeql.yml pins `init`, `analyze`, and `upload-sarif` separately, and Dependabot treats each sub-action as its own dependency, so ungrouped it opens one PR per sub-action (e.g. #2910, #2911, #2912) and each one breaks CodeQL until the last lands. Group them so they are bumped together. Co-authored-by: rawahars <65640262+rawahars@users.noreply.github.com>
Harsh Rawat (rawahars)
approved these changes
Sep 2, 2026
Harsh Rawat (rawahars)
approved these changes
Sep 2, 2026
Maksim An (anmaxvl)
approved these changes
Sep 3, 2026
AdityaMittal1306
approved these changes
Sep 3, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
CodeQL requires every step in a run to be on the same version —
initstamps its version into the config file thatanalyzelater loads, and a mismatch fails the job in ~1s before any query runs. Becausecodeql.ymlpinsinit,analyze, andupload-sarifseparately, Dependabot bumps them in three independent PRs (#2910, #2911, #2912), each of which breaks CodeQL on its own until the last one merges.The three pins are full 40-char SHAs, and Dependabot's
github_actionsparser names SHA-pinned actions by their full sub-path (github/codeql-action/init) rather than the shared repo name — so they are three distinct dependencies. Tag-pinned repos never hit this.Changes
.github/dependabot.yml— added agroups:entry to the existinggithub-actionsecosystem block so allcodeql-actionsub-actions are bumped together:Pattern choice
Dependabot matches group patterns with its own
WildcardMatcher, which compiles*to regex.*, sogithub/codeql-action*would also match today. The slash form is preferred as it holds under both glob semantics and cannot match an unrelatedgithub/codeql-action-fork. It matches exactly the three sub-actions and none of the other actions referenced in.github/. Same pattern used bycontainerd/containerd,etcd-io/etcd, andcli/cli.Note for reviewers
Grouping applies only to newly created PRs; it will not retroactively combine ones already open. Clearing the current breakage requires closing #2910, #2911, and #2912 unmerged and letting Dependabot recreate them as a single grouped PR on its next run.
This does not change the
codeql-actionpins themselves — CodeQL onmainis unaffected.