From 376a9658fd4dfd9044dcd7471e6e8b7740e0683e Mon Sep 17 00:00:00 2001
From: Renn F <rennf93@users.noreply.github.com>
Date: Sun, 25 Oct 2026 18:24:37 +0100
Subject: [PATCH] ci(dependabot): group action updates into one weekly PR

Multi-step actions such as github/codeql-action appear in several workflows,
and one Dependabot PR per step leaves the steps of a single workflow on
different versions, which fails the CodeQL version-mismatch check and keeps
the whole weekly wave red. With the group, all action bumps arrive as one PR
per week with every reference updated together, the same way the pip, npm,
go-modules and gradle ecosystems are already grouped here.
---
 .github/dependabot.yml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 62e0403..636cef1 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -7,6 +7,10 @@ updates:
       day: "monday"
       time: "02:00"
       timezone: "UTC"
+    groups:
+      actions:
+        patterns:
+          - "*"
 
   - package-ecosystem: "pip"
     directory: "/"