From 7acb97f6e56dd17d70303f5d7b09ec4e47cab978 Mon Sep 17 00:00:00 2001
From: Renn F <rennf93@users.noreply.github.com>
Date: Sun, 25 Oct 2026 18:24:12 +0100
Subject: [PATCH] ci(dependabot): group action updates into one weekly PR

Multi-step actions such as github/codeql-action appear in several workflows,
and one Dependabot PR per step leaves the steps of a single workflow on
different versions, which fails the CodeQL version-mismatch check and keeps
the whole weekly wave red. With the group, all action bumps arrive as one PR
per week with every reference updated together, the same way the pip, npm,
go-modules and gradle ecosystems are already grouped here.
---
 .github/dependabot.yml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index cce7ce0..dbbc323 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -7,6 +7,10 @@ updates:
       day: "monday"
       time: "02:00"
       timezone: "UTC"
+    groups:
+      actions:
+        patterns:
+          - "*"
 
   - package-ecosystem: "pip"
     directory: "/"