From 5b1c5ca9f8035472c951bf8fb0322685a2be56f2 Mon Sep 17 00:00:00 2001 From: William Storey Date: Tue, 21 Jul 2026 18:49:39 +0000 Subject: [PATCH 1/2] Run Dependabot updates weekly We now review dependency updates weekly rather than daily, so daily update runs only generate churn. Check for updates once a week on Monday morning instead. Co-Authored-By: Claude Fable 5 --- .github/dependabot.yml | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 358edd89..aafe1384 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -3,7 +3,8 @@ updates: - package-ecosystem: maven directory: / schedule: - interval: daily + interval: weekly + day: monday time: '14:00' open-pull-requests-limit: 10 groups: @@ -15,7 +16,8 @@ updates: - package-ecosystem: github-actions directory: / schedule: - interval: daily + interval: weekly + day: monday time: '14:00' cooldown: default-days: 7 From 9f69e3f9dafc610c4af67aa12b54b7005bbadc86 Mon Sep 17 00:00:00 2001 From: William Storey Date: Tue, 21 Jul 2026 18:49:56 +0000 Subject: [PATCH 2/2] Group CodeQL action updates Dependabot treats the github/codeql-action subpath actions (init, analyze, autobuild) as separate dependencies and opens a separate PR for each. CI fails unless they are all updated together. Group them so that they arrive as a single PR. Co-Authored-By: Claude Fable 5 --- .github/dependabot.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index aafe1384..288eb81c 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -19,5 +19,9 @@ updates: interval: weekly day: monday time: '14:00' + groups: + codeql: + patterns: + - github/codeql-action* cooldown: default-days: 7