From 1af1a087ef656e0b4ad1009994c877d581f9a999 Mon Sep 17 00:00:00 2001
From: Guglielmo Colombo <guglielmoc@google.com>
Date: Thu, 9 Jul 2026 10:46:31 +0200
Subject: [PATCH] ci: update dependabot rules (#1059)

---
 .github/dependabot.yml | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 262a757..f9fbfe1 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -5,3 +5,11 @@ updates:
   directory: "/"
   schedule:
     interval: "monthly"
+  # Group all github/codeql-action/* sub-paths (init, analyze, ...) into a
+  # single PR so they are always bumped together. Bumping them independently
+  # leaves the workflow with mismatched versions across steps, which
+  # github/codeql-action rejects at runtime.
+  groups:
+    codeql-action:
+      patterns:
+        - "github/codeql-action/*"