From 6346ef2320088038f70303f270426b89397f36de Mon Sep 17 00:00:00 2001 From: Renn F Date: Sun, 25 Oct 2026 18:11:21 +0100 Subject: [PATCH] chore(deps): bump workflow actions together Workflow refs: init v4.39.0->v4.39.1,analyze v4.39.0->v4.39.1. All references of each multi-step action move in one commit so workflows such as CodeQL run against a single action version; single-step Dependabot PRs leave the steps of one workflow on different versions and fail their own CI. I also grouped github-actions updates in .github/dependabot.yml so future action bumps arrive as one weekly PR instead of one PR per workflow step. --- .github/dependabot.yml | 4 ++++ .github/workflows/code-ql.yml | 4 ++-- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 90edbbd..10edddb 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -7,6 +7,10 @@ updates: day: "monday" time: "02:00" timezone: "UTC" + groups: + actions: + patterns: + - "*" - package-ecosystem: "composer" directory: "/" diff --git a/.github/workflows/code-ql.yml b/.github/workflows/code-ql.yml index 603ca96..2dc9bf6 100644 --- a/.github/workflows/code-ql.yml +++ b/.github/workflows/code-ql.yml @@ -29,10 +29,10 @@ jobs: persist-credentials: false - name: Initialize CodeQL - uses: github/codeql-action/init@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0 + uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1 with: languages: actions build-mode: none - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0 + uses: github/codeql-action/analyze@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1