(lucene) branch main updated: ci: group codeql dependabot updates together

[rm...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

rmuir pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/lucene.git


The following commit(s) were added to refs/heads/main by this push:
     new 4703baa7b28 ci: group codeql dependabot updates together
4703baa7b28 is described below

commit 4703baa7b28c93c51cfc527054a2d1b2e4dca573
Author: Robert Muir <rm...@apache.org>
AuthorDate: Fri Sep 4 18:10:56 2026 -0400

    ci: group codeql dependabot updates together
    
    Currently we get individual PR for each dependency from the bot... for
    better or for worse. But the codeql actions have recently started
    version-checking each other. Individual PRs to /init, /analyze, etc will
    always fail due to this. The only workaround is to cross-fingers, hope
    for the best, and merge them all quickly and hope master goes green.
    This defeats the purpose of having PR to validate the update.
    
    Group these together into single PR so the updates can be validated
    before pressing merge.
---
 .github/dependabot.yml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index a79acdbc26e..1710cd74790 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -11,6 +11,11 @@ updates:
     commit-message:
       prefix: ci
     labels: [dependencies, skip-changelog]
+    groups:
+      # codeql init/analyze must match exactly: validate each others versions
+      codeql:
+        patterns:
+          - github/codeql-action/*
     cooldown:
       default-days: 7