From cf3c590c1ac484207c9d7f30ac4940d47374ae46 Mon Sep 17 00:00:00 2001
From: Arezki CI maintenance <193283917+GodsQuantum@users.noreply.github.com>
Date: Fri, 25 Sep 2026 17:28:40 +0200
Subject: [PATCH] ci: make Dependabot CodeQL updates atomic

---
 .github/dependabot.yml       | 12 ++++++++++++
 .github/workflows/codeql.yml |  4 ++--
 2 files changed, 14 insertions(+), 2 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 33a2ed5..ded5c31 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -27,3 +27,15 @@ updates:
       interval: weekly
     labels: [dependencies, github-actions]
     open-pull-requests-limit: 10
+    groups:
+      codeql-suite:
+        patterns:
+          - "github/codeql-action/*"
+      actions-minor-patch:
+        patterns:
+          - "*"
+        exclude-patterns:
+          - "github/codeql-action/*"
+        update-types:
+          - minor
+          - patch
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 313826e..47caadd 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -27,8 +27,8 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4
+      - uses: github/codeql-action/init@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
         with:
           languages: ${{ matrix.language }}
           build-mode: none
-      - uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4
+      - uses: github/codeql-action/analyze@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1