From f6202162e3dad20e98e3c127e4033b71065fd619 Mon Sep 17 00:00:00 2001 From: Manush Murali Date: Tue, 27 Oct 2026 15:38:11 -0700 Subject: [PATCH] Move both CodeQL steps to 4.39.1 together CodeQL refuses to run when its init and analyze steps are on different versions, so dependabot's separate pull requests for each always fail. Grouping the action makes dependabot move them in one pull request. Co-Authored-By: Claude Opus 5.5 Signed-off-by: Manush Murali --- .github/dependabot.yml | 4 ++++ .github/workflows/codeql.yml | 4 ++-- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index bf925d9eb..1c47970b4 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -14,6 +14,10 @@ updates: directory: / schedule: interval: weekly + groups: + codeql-action: + patterns: + - "github/codeql-action*" - package-ecosystem: pip directory: /packages/structured-data-models-client schedule: diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index ec6c29d9f..9ed942fa4 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -65,7 +65,7 @@ jobs: python-version: '3.12' - name: Initialize CodeQL - uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3 + uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1 with: languages: ${{ matrix.language }} build-mode: ${{ matrix.build-mode }} @@ -96,6 +96,6 @@ jobs: python -m pip install --no-deps ./packages/structured-data-models-relational-engine - name: Perform CodeQL analysis - uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3 + uses: github/codeql-action/analyze@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1 with: category: /language:${{ matrix.language }}