[codex] Group dependency updates

.github/dependabot.yml

@@ -1,29 +1,29 @@
 version: 2
+multi-ecosystem-groups:
+  dependency-updates:
+    schedule:
+      interval: daily
+    commit-message:
+      prefix: ⬆
 updates:
   # GitHub Actions
   - package-ecosystem: github-actions
     directory: /
-    schedule:
-      interval: daily
+    patterns: ["*"]
+    multi-ecosystem-group: dependency-updates
     cooldown:
       default-days: 7
-    commit-message:
-      prefix: ⬆
   # Python
   - package-ecosystem: uv
     directory: /
-    schedule:
-      interval: daily
+    patterns: ["*"]
+    multi-ecosystem-group: dependency-updates
     cooldown:
       default-days: 7
-    commit-message:
-      prefix: ⬆
   # Admin dashboard
   - package-ecosystem: bun
     directory: /apps/admin_dashboard
-    schedule:
-      interval: daily
+    patterns: ["*"]
+    multi-ecosystem-group: dependency-updates
     cooldown:
       default-days: 7
-    commit-message:
-      prefix: ⬆

.github/workflows/docker-smoke.yml

@@ -14,7 +14,9 @@ jobs:
     if: github.event_name != 'pull_request' || contains(github.event.pull_request.labels.*.name, 'docker-smoke')
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
 
       - name: Run Docker smoke check
         run: ./scripts/docker-smoke.sh

.github/workflows/test.yml

@@ -12,10 +12,12 @@ jobs:
     environment: test
 
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v7
+      with:
+        persist-credentials: false
 
     - name: Install uv
-      uses: astral-sh/setup-uv@v7
+      uses: astral-sh/setup-uv@v8.1.0
       with:
         version: "0.9.17"
 
@@ -50,7 +52,7 @@ jobs:
         uv run coverage xml
 
     - name: Upload coverage reports to Codecov
-      uses: codecov/codecov-action@v6
+      uses: codecov/codecov-action@v7
       with:
         files: ./coverage.xml
         fail_ci_if_error: false
@@ -60,10 +62,12 @@ jobs:
     environment: test
 
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v7
+      with:
+        persist-credentials: false
 
     - name: Install uv
-      uses: astral-sh/setup-uv@v7
+      uses: astral-sh/setup-uv@v8.1.0
       with:
         version: "0.9.17"
 
@@ -96,10 +100,12 @@ jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v7
+      with:
+        persist-credentials: false
 
     - name: Install uv
-      uses: astral-sh/setup-uv@v7
+      uses: astral-sh/setup-uv@v8.1.0
       with:
         version: "0.9.17"
 
@@ -126,9 +132,10 @@ jobs:
     runs-on: ubuntu-latest
     environment: test
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v7
       with:
         fetch-depth: 0
+        persist-credentials: false
 
     - name: Detect agent eval relevant changes
       id: agent-eval-changes
@@ -160,7 +167,7 @@ jobs:
 
     - name: Install uv
       if: steps.agent-eval-changes.outputs.run == 'true'
-      uses: astral-sh/setup-uv@v7
+      uses: astral-sh/setup-uv@v8.1.0
       with:
         version: "0.9.17"
 
@@ -227,10 +234,12 @@ jobs:
   security:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v7
+      with:
+        persist-credentials: false
 
     - name: Install uv
-      uses: astral-sh/setup-uv@v7
+      uses: astral-sh/setup-uv@v8.1.0
       with:
         version: "0.9.17"
 

apps/admin_dashboard/biome.json

@@ -1,5 +1,5 @@
 {
-  "$schema": "https://biomejs.dev/schemas/2.4.15/schema.json",
+  "$schema": "https://biomejs.dev/schemas/2.5.0/schema.json",
   "files": {
     "includes": ["**", "!node_modules", "!dist", "!../api/src/five08/backend/static/dashboard"]
   },
@@ -22,7 +22,7 @@
   "linter": {
     "enabled": true,
     "rules": {
-      "recommended": true,
+      "preset": "recommended",
       "a11y": {
         "noLabelWithoutControl": "off"
       },