From c4df7ca19fe9cf71d79d31245e95c0af9c45b9b3 Mon Sep 17 00:00:00 2001 From: William Storey Date: Tue, 21 Jul 2026 18:48:32 +0000 Subject: [PATCH 1/2] Run Dependabot updates weekly We now review dependency updates weekly rather than daily, so daily update runs only generate churn. Check for updates once a week on Monday morning instead. Co-Authored-By: Claude Fable 5 --- .github/dependabot.yml | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 482b211..61343a3 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -3,7 +3,8 @@ updates: - package-ecosystem: gradle directory: / schedule: - interval: daily + interval: weekly + day: monday time: '14:00' cooldown: default-days: 7 @@ -11,7 +12,8 @@ updates: - package-ecosystem: github-actions directory: / schedule: - interval: daily + interval: weekly + day: monday time: '14:00' cooldown: default-days: 7 From 186401111561cea3504350fc66a9aaf09d352b7d Mon Sep 17 00:00:00 2001 From: William Storey Date: Tue, 21 Jul 2026 18:48:50 +0000 Subject: [PATCH 2/2] Group CodeQL action updates Dependabot treats the github/codeql-action subpath actions (init, analyze, autobuild) as separate dependencies and opens a separate PR for each. CI fails unless they are all updated together. Group them so that they arrive as a single PR. Co-Authored-By: Claude Fable 5 --- .github/dependabot.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 61343a3..3731c8f 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -15,5 +15,9 @@ updates: interval: weekly day: monday time: '14:00' + groups: + codeql: + patterns: + - github/codeql-action* cooldown: default-days: 7