From 70e7b85aea2bc22ccfee50aec2bc7db515071524 Mon Sep 17 00:00:00 2001
From: Derek Tamsen <828329+derektamsen@users.noreply.github.com>
Date: Tue, 28 Jul 2026 00:29:06 -0700
Subject: [PATCH] chore(ci): group codeql updates into a single PR

Dependabot has been opening single prs for codeql action updates.
However, there are 3 components that need to be updated together.
When they are not upgraded together, codeql will fail CI. This
groups them into a single PR so that they can be upgraded by
dependabot.
---
 .github/dependabot.yml | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index f73c7aa..82c2a71 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -18,9 +18,16 @@ updates:
       interval: "weekly"
     cooldown:
       default-days: 7
+    groups:
+      # Codeql typically has three actions that need to run. These actions all need to be the same version.
+      # If each version is updated independantly codeql will fail CI. The below config will group all of the
+      # codeql updates into a single pr making it possible for CI to pass.
+      codeql-action:
+        patterns:
+          - "github/codeql-action/*"
 
-  - package-ecosystem: "gomod" # See documentation for possible values
-    directory: "/" # Location of package manifests
+  - package-ecosystem: "gomod"
+    directory: "/"
     schedule:
       interval: "weekly"
     cooldown: