Run Dependabot updates weekly and group CodeQL updates

[horgh]

We now review dependency updates weekly rather than daily, so switch every Dependabot update schedule to weekly on Monday mornings.

Also group the github/codeql-action subpath actions (init, analyze, autobuild): Dependabot treats them as separate dependencies and opens a separate PR for each, but CI fails unless they are all updated together. Grouping them makes the updates arrive as a single PR.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Updated automated dependency checks to run weekly on Mondays.
  • Grouped CodeQL-related GitHub Actions updates into a single pull request.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 03bae2a1-c5b6-4cd3-8446-d2a4f8a0574f

📥 Commits

Reviewing files that changed from the base of the PR and between 0c2571b and e35e45d.

📒 Files selected for processing (1)

• .github/dependabot.yml

---

📝 Walkthrough

Walkthrough

Dependabot Maven and GitHub Actions checks now run weekly on Mondays at 14:00. GitHub Actions updates matching github/codeql-action* are grouped under codeql.

Changes

Dependabot updates

Layer / File(s)	Summary
Update schedules and group CodeQL dependencies .github/dependabot.yml	Maven and GitHub Actions schedules changed from daily to weekly Monday runs at 14:00, with CodeQL action updates grouped together.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Suggested reviewers: copilot

Poem

A rabbit checks the weekly queue,
CodeQL hops in one neat crew.
Mondays ring at two o’clock,
Fewer carrots round the clock.
Dependabot thumps, “All set!”

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main changes: weekly Dependabot scheduling and grouped CodeQL updates.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch wstorey/stf-983-run-github-actions-dependabot-updates-weekly-and-group

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

Pull request overview

Updates Dependabot configuration to align dependency update cadence with a weekly review process and reduce CI breakage caused by partial CodeQL action updates.

Changes:

• Switch Maven and GitHub Actions Dependabot schedules from daily to weekly on Mondays.
• Group github/codeql-action* GitHub Actions updates so related CodeQL action subpaths are updated together.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.