Group CodeQL action updates in Dependabot

[muir]

This PR groups CodeQL action updates in Dependabot to ensure that init/autobuild/analyze steps stay on the same version.

The init, autobuild, and analyze steps must stay on the same version, so they have to be bumped in a single pull request.

This change adds a groups configuration to .github/dependabot.yml that groups all github/codeql-action* updates together.

Related to: singlestore-labs/events#192

---

Note

Low Risk
Only changes Dependabot grouping; no runtime or CI workflow logic is modified.

Overview
Adds a Dependabot group for the github-actions ecosystem so all github/codeql-action* bumps land in one PR.

That keeps init, autobuild, and analyze in .github/workflows/codeql.yml on the same version instead of split across separate Dependabot updates.

^{Reviewed by Cursor Bugbot for commit 88c3ede. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

Bugbot Autofix prepared a fix for the issue found in the latest run.

• ✅ Fixed: Duplicate groups key ignores CodeQL grouping
  • Merged the duplicate groups keys under github-actions into one mapping so both codeql-action and all-dependencies are applied.

Or push these changes by commenting:

@cursor push 4b6745b106

Preview (4b6745b106)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -24,7 +24,6 @@ updates:
       codeql-action:
         patterns:
           - "github/codeql-action*"
-    groups:
       all-dependencies:
         patterns:
           - "*"

@@ -24,7 +24,6 @@ updates:
       codeql-action:
         patterns:
           - "github/codeql-action*"
-    groups:
       all-dependencies:
         patterns:
           - "*"

_{You can send follow-ups to the cloud agent here.}

^{Reviewed by Cursor Bugbot for commit 88c3ede. Configure here.}

[cursor]

Duplicate groups key ignores CodeQL grouping

Medium Severity

The github-actions update defines two sibling groups keys. YAML last-wins parsing discards the first mapping, so the codeql-action group is ignored and Dependabot never applies the intended CodeQL grouping.

 

^{Reviewed by Cursor Bugbot for commit 88c3ede. Configure here.}