Run Dependabot updates weekly and group CodeQL updates

[horgh]

We now review dependency updates weekly rather than daily, so switch every Dependabot update schedule to weekly on Monday mornings.

Also group the github/codeql-action subpath actions (init, analyze, autobuild): Dependabot treats them as separate dependencies and opens a separate PR for each, but CI fails unless they are all updated together. Grouping them makes the updates arrive as a single PR.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Improved the scheduling and grouping of automated maintenance updates.
  • Security-related tooling updates are now consolidated and applied weekly on Mondays.

[Copilot]

Pull request overview

Updates the repository’s Dependabot configuration to align with a weekly dependency review cadence and reduce CI breakage from split CodeQL action updates.

Changes:

• Changed the GitHub Actions Dependabot schedule from daily to weekly on Mondays.
• Added a Dependabot group to bundle github/codeql-action* updates into a single PR.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[coderabbitai]

📝 Walkthrough

Walkthrough

Dependabot’s GitHub Actions updates now run weekly on Mondays at 14:00, with CodeQL action dependencies grouped together.

Changes

Dependabot configuration

Layer / File(s)	Summary
Schedule and CodeQL grouping .github/dependabot.yml	Changes the GitHub Actions update schedule from daily to weekly on Monday at 14:00 and groups matching CodeQL action updates.

Estimated code review effort: 1 (Trivial) | ~3 minutes

Suggested reviewers: copilot

Poem

A rabbit checks the clock at two,
“Weekly hops will surely do!”
CodeQL friends now share one burrow,
Fewer update crumbs to scurry.
Thump, thump—configuration’s through!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main changes: weekly Dependabot runs and grouped CodeQL updates.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch wstorey/stf-983-run-github-actions-dependabot-updates-weekly-and-group

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/dependabot.yml:
- Around line 6-8: Update the Dependabot schedule configuration by adding an
explicit IANA timezone alongside the existing Monday 14:00 time, using the
intended local timezone; if the schedule is meant to remain at 14:00 UTC,
document that explicitly through the timezone setting.
- Around line 9-12: Add a second uniquely named Dependabot group alongside
codeql with applies-to set to security-updates and the same
github/codeql-action* pattern, preserving the existing version-update group so
CodeQL actions are grouped for both update types.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 9a10fbb4-d11e-4098-a9d9-686a2af96018

📥 Commits

Reviewing files that changed from the base of the PR and between ecc8795 and 498bfdb.

📒 Files selected for processing (1)

• .github/dependabot.yml

[coderabbitai]

🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick win

Make the schedule timezone explicit.

Dependabot interprets time as UTC unless timezone is set. If 14:00 is intended as a specific local Monday-morning time, add the intended IANA timezone; otherwise confirm that 14:00 UTC is deliberate. (docs.github.com)

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/dependabot.yml around lines 6 - 8, Update the Dependabot schedule
configuration by adding an explicit IANA timezone alongside the existing Monday
14:00 time, using the intended local timezone; if the schedule is meant to
remain at 14:00 UTC, document that explicitly through the timezone setting.

[coderabbitai]

🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

Group CodeQL security updates as well.

Because applies-to is omitted, this group applies only to version updates. A security update can therefore produce separate PRs for init, analyze, and autobuild, violating the stated requirement that these actions be updated together. Add a second, separately named group with applies-to: security-updates and the same pattern. (docs.github.com)

Proposed configuration

     groups:
       codeql:
+        applies-to: version-updates
         patterns:
           - github/codeql-action*
+      codeql-security:
+        applies-to: security-updates
+        patterns:
+          - github/codeql-action*

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	groups:
	codeql:
	patterns:
	- github/codeql-action*
	groups:
	codeql:
	applies-to: version-updates
	patterns:
	- github/codeql-action*
	codeql-security:
	applies-to: security-updates
	patterns:
	- github/codeql-action*

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/dependabot.yml around lines 9 - 12, Add a second uniquely named
Dependabot group alongside codeql with applies-to set to security-updates and
the same github/codeql-action* pattern, preserving the existing version-update
group so CodeQL actions are grouped for both update types.