From c4d30a048c42d1780d3eb221f9950dff3ba5c451 Mon Sep 17 00:00:00 2001 From: James Crosswell Date: Mon, 3 Aug 2026 13:00:22 +1200 Subject: [PATCH 1/3] ci: group dependabot updates for multi-subpath actions Dependabot treats each subpath of an action repo as a separate dependency, so it opens a PR for github/codeql-action/init without a matching bump for github/codeql-action/analyze. The mismatched versions fail CodeQL with 'Loaded a configuration file for version X, but running version Y' (#5461). Group each action repo that is used via more than one subpath so all of its subpaths move in a single PR. Fixes #5466 Co-Authored-By: Claude Opus 5 --- .github/dependabot.yml | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 78bb66561c..c54d5254c4 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -53,3 +53,19 @@ updates: - "/.github/actions/*" schedule: interval: weekly + # Dependabot treats each subpath of an action repo as a separate dependency, so + # without these groups it bumps e.g. codeql-action/init without codeql-action/analyze + # and the mismatched versions break CI. Group each repo so subpaths move in lockstep. + groups: + codeql-action: + patterns: + - "github/codeql-action*" + github-workflows: + patterns: + - "getsentry/github-workflows*" + craft: + patterns: + - "getsentry/craft*" + actions-cache: + patterns: + - "actions/cache*" From 1d03b407303fa5428791b0eed0bd9d24e2cd8c0e Mon Sep 17 00:00:00 2001 From: James Crosswell Date: Mon, 3 Aug 2026 13:11:56 +1200 Subject: [PATCH 2/3] Tweak comments --- .github/dependabot.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index c54d5254c4..fbf308e46c 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -55,7 +55,7 @@ updates: interval: weekly # Dependabot treats each subpath of an action repo as a separate dependency, so # without these groups it bumps e.g. codeql-action/init without codeql-action/analyze - # and the mismatched versions break CI. Group each repo so subpaths move in lockstep. + # Grouping ensures dependencies from the same subpath are upgraded together groups: codeql-action: patterns: From ca1390045898a1a0197a111d2ad1e68647cd225f Mon Sep 17 00:00:00 2001 From: James Crosswell Date: Mon, 3 Aug 2026 16:49:36 +1200 Subject: [PATCH 3/3] ci: use a single wildcard group for all GitHub Actions Replaces the four per-repo groups with one "*" group, matching getsentry/sentry-java. Still guarantees that codeql-action/init and codeql-action/analyze move together, covers action repos added later without further config, and collapses weekly version bumps into a single PR instead of one per action. Co-Authored-By: Claude Opus 5 --- .github/dependabot.yml | 18 +++++------------- 1 file changed, 5 insertions(+), 13 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index c54d5254c4..2609c7231a 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -54,18 +54,10 @@ updates: schedule: interval: weekly # Dependabot treats each subpath of an action repo as a separate dependency, so - # without these groups it bumps e.g. codeql-action/init without codeql-action/analyze - # and the mismatched versions break CI. Group each repo so subpaths move in lockstep. + # ungrouped it bumps e.g. codeql-action/init without codeql-action/analyze and the + # mismatched versions break CI. One group keeps every action in a single PR, which + # also cuts down on version-bump noise. Matches getsentry/sentry-java. groups: - codeql-action: + github-actions: patterns: - - "github/codeql-action*" - github-workflows: - patterns: - - "getsentry/github-workflows*" - craft: - patterns: - - "getsentry/craft*" - actions-cache: - patterns: - - "actions/cache*" + - "*"