From 28bc471f97b0d52de12108b86bd1010d3e2bc9bb Mon Sep 17 00:00:00 2001 From: Renn F Date: Sun, 25 Oct 2026 20:39:39 +0100 Subject: [PATCH] chore(deps): bump workflow actions together Workflow refs: init v4.39.0->v4.39.1,analyze v4.39.0->v4.39.1. All references of each multi-step action move in one commit so workflows such as CodeQL run against a single action version; single-step Dependabot PRs leave the steps of one workflow on different versions and fail their own CI. I also grouped github-actions updates in .github/dependabot.yml so future action bumps arrive as one weekly PR instead of one PR per workflow step. --- .github/dependabot.yml | 4 ++++ .github/workflows/code-ql.yml | 4 ++-- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 38cda2c..9479561 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -7,6 +7,10 @@ updates: day: "monday" time: "02:00" timezone: "UTC" + groups: + actions: + patterns: + - "*" - package-ecosystem: "composer" directory: "/" schedule: diff --git a/.github/workflows/code-ql.yml b/.github/workflows/code-ql.yml index 0dc4f03..d16543a 100644 --- a/.github/workflows/code-ql.yml +++ b/.github/workflows/code-ql.yml @@ -33,11 +33,11 @@ jobs: persist-credentials: false - name: Initialize CodeQL - uses: github/codeql-action/init@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0 + uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1 with: languages: actions,javascript-typescript build-mode: none config-file: ./.github/codeql/codeql-config.yml - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0 + uses: github/codeql-action/analyze@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1