ci: adds a codeql actions group to the dependabot configuration - #8070
Conversation
GitHub Actions
Active
GitHub Actions
Active
GitHub Actions
Active
There was a problem hiding this comment.
🟢 Approval recommended
The configuration change is focused, fully reviewed, and has no unresolved issues.
Pull request overview
Adds a Dependabot group to consolidate CodeQL action updates.
Changes:
- Groups all
github/codeql-action/*updates undercodeql-actions. - Covers CodeQL init, autobuild, and analyze actions.
File summaries
| File | Description |
|---|---|
.github/dependabot.yml |
Adds the CodeQL GitHub Actions dependency group. |
Review details
- Files reviewed: 1/1 changed files
- Comments generated: 0
- Review effort level: Balanced
💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
MAF Automated Review — Iteration 1
Result: No findings
Scope: full PR (1 commit(s)): 7f2baa71333f
Model: gpt-5.6-sol-fast
Overview
The PR adds a narrowly scoped Dependabot group for the three SHA-pinned CodeQL action entrypoints, bringing their updates into one PR while retaining the existing GitHub Actions directories, weekly schedule, and cooldown. Repository-wide usage confirms that the pattern covers all and only the current CodeQL action consumers, and no publishable runtime, compatibility, or security concern was established.
Reviewed the supplied pull-request change set across correctness, security/reliability, architecture, and failure behavior.
No publishable findings remained after source verification for this scope.
follow up to #8065, #8059. Unblock #8066 #8067