Skip to content

Run Dependabot updates weekly and group CodeQL updates#415

Merged
oschwald merged 2 commits into
mainfrom
wstorey/stf-983-run-github-actions-dependabot-updates-weekly-and-group
Jul 21, 2026
Merged

Run Dependabot updates weekly and group CodeQL updates#415
oschwald merged 2 commits into
mainfrom
wstorey/stf-983-run-github-actions-dependabot-updates-weekly-and-group

Conversation

@horgh

@horgh horgh commented Jul 21, 2026 •
edited by coderabbitai Bot
Loading

Copy link
Copy Markdown
Contributor

We now review dependency updates weekly rather than daily, so switch every Dependabot update schedule to weekly on Monday mornings.

Also group the github/codeql-action subpath actions (init, analyze, autobuild): Dependabot treats them as separate dependencies and opens a separate PR for each, but CI fails unless they are all updated together. Grouping them makes the updates arrive as a single PR.

🤖 Generated with Claude Code

Summary by CodeRabbit

  • Chores
    • Updated automated dependency checks to run weekly on Mondays.
    • Grouped CodeQL-related GitHub Actions updates into a single pull request.

horgh and others added 2 commits July 21, 2026 18:48
@horgh @claude
Run Dependabot updates weekly
54a71aa 
We now review dependency updates weekly rather than daily, so daily
update runs only generate churn. Check for updates once a week on
Monday morning instead.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@horgh @claude
Group CodeQL action updates
e35e45d 
Dependabot treats the github/codeql-action subpath actions (init,
analyze, autobuild) as separate dependencies and opens a separate PR
for each. CI fails unless they are all updated together. Group them so
that they arrive as a single PR.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Copilot AI review requested due to automatic review settings July 21, 2026 18:49
@coderabbitai

coderabbitai Bot commented Jul 21, 2026 •
edited
Loading

Copy link
Copy Markdown

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 03bae2a1-c5b6-4cd3-8446-d2a4f8a0574f

📥 Commits

Reviewing files that changed from the base of the PR and between 0c2571b and e35e45d.

📒 Files selected for processing (1)
  • .github/dependabot.yml
📝 Walkthrough

Walkthrough

Dependabot Maven and GitHub Actions checks now run weekly on Mondays at 14:00. GitHub Actions updates matching github/codeql-action* are grouped under codeql.

Changes

Dependabot updates

Layer / File(s) Summary
Update schedules and group CodeQL dependencies
.github/dependabot.yml		 Maven and GitHub Actions schedules changed from daily to weekly Monday runs at 14:00, with CodeQL action updates grouped together.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Suggested reviewers: copilot

Poem

A rabbit checks the weekly queue,
CodeQL hops in one neat crew.
Mondays ring at two o’clock,
Fewer carrots round the clock.
Dependabot thumps, “All set!”

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title accurately summarizes the main changes: weekly Dependabot scheduling and grouped CodeQL updates.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch wstorey/stf-983-run-github-actions-dependabot-updates-weekly-and-group

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

Copilot AI reviewed Jul 21, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Updates Dependabot configuration to align dependency update cadence with a weekly review process and reduce CI breakage caused by partial CodeQL action updates.

Changes:

  • Switch Maven and GitHub Actions Dependabot schedules from daily to weekly on Mondays.
  • Group github/codeql-action* GitHub Actions updates so related CodeQL action subpaths are updated together.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread .github/dependabot.yml
Comment on lines 5 to 8
schedule:
interval: daily
interval: weekly
day: monday
time: '14:00'
Comment thread .github/dependabot.yml
Comment on lines 14 to 17
schedule:
interval: daily
interval: weekly
day: monday
time: '14:00'
@oschwald
oschwald merged commit 8ee4d63 into main Jul 21, 2026
32 checks passed
@oschwald
oschwald deleted the wstorey/stf-983-run-github-actions-dependabot-updates-weekly-and-group branch July 21, 2026 20:11
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot Copilot left review comments
@oschwald oschwald oschwald approved these changes

Assignees

No one assigned

Labels

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@horgh @oschwald