From b31ec352a7fbdc30ea00d2166e5852cfdb2c5713 Mon Sep 17 00:00:00 2001
From: Arif Burak Demiray <burakdemiray09@hotmail.com>
Date: Thu, 22 Oct 2026 09:11:13 +0300
Subject: [PATCH] Update CodeQL's init and analyze actions in one Dependabot PR

Dependabot opened separate PRs for github/codeql-action/init and
github/codeql-action/analyze (#313, #314). The analyze step fails when the
two run different versions, so each PR failed CodeQL on its own. A group
makes them one PR.

Dependabot reads this file from master; staging carries the same file so
the next release merge does not conflict.
---
 .github/dependabot.yml | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index edf452cf..3de5b3dc 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -26,6 +26,12 @@ updates:
     target-branch: staging
     schedule:
       interval: monthly
+    # CodeQL's init and analyze steps must run the same version or the analyze
+    # step fails, so their updates come in one PR.
+    groups:
+      codeql:
+        patterns:
+          - "github/codeql-action*"
     labels:
       - dependencies
       - ci