Group codeql-action bumps into one pull request to end the split-PR deadlock

[unbraind]

Problem

Dependabot opens github/codeql-action/init and github/codeql-action/analyze as two separate pull requests. The two actions MUST be the same version in a workflow, so each PR alone leaves the pair mismatched and the codeql check fails on BOTH. Neither can go green on its own — a permanent deadlock that has to be broken by hand every single time.

Measured evidence

Right now unbraind/pm-gantt-chart #87 (init 4.37.8→4.37.9) and #88 (analyze 4.37.8→4.37.9) each show FAILURE codeql with every other check green. Both PRs are deadlocked against each other.

Fix

Add a groups: block to .github/dependabot.yml so all github/codeql-action/* bumps arrive as ONE pull request, keeping init and analyze in lock-step so codeql can go green.

This repo gets the same grouping applied preventively.

pm item

• pm-github-11qm

---

Summary by cubic

Groups Dependabot updates for github/codeql-action into a single PR so init and analyze are always updated together. Previously Dependabot opened two separate PRs, each leaving the action pair version-mismatched and failing the codeql check on both until someone resolved it by hand.

• Adds a groups block to .github/dependabot.yml that matches github/codeql-action*.

^{Written for commit 429b6f1. Summary will update on new commits.}

Summary by Sourcery

Configure Dependabot to keep all GitHub CodeQL action updates together, preventing split pull requests from leaving workflows with mismatched action versions.

Bug Fixes:

• Group GitHub CodeQL action dependency updates into a single Dependabot pull request so required action versions remain synchronized.

Chores:

• Add project-management tracking records for the Dependabot grouping change.

[sourcery-ai]

Reviewer's guide (collapsed on small PRs)

Reviewer's Guide

This PR prevents CodeQL Dependabot deadlocks by grouping all github/codeql-action updates into one synchronized pull request, and records the change in the changelog and project-management history.

Flow diagram for grouped CodeQL Dependabot updates

flowchart LR
    Dependabot[Dependabot detects CodeQL updates] --> Group[group codeql-action updates]
    Group --> PR[Open one pull request]
    PR --> Workflow[CodeQL workflow uses matching action versions]
    Workflow --> Checks[CodeQL check can pass]

Loading

File-Level Changes

Change	Details	Files
Configure Dependabot to group all CodeQL action updates into a single pull request.	Add a codeql-action group matching github/codeql-action* under the existing Dependabot update configuration. Keep CodeQL action versions synchronized so workflows can validate the combined update instead of deadlocking on split PRs.	.github/dependabot.yml
Document the Dependabot grouping fix and track its associated project-management item.	Add an Unreleased changelog entry describing the fix. Add PM issue and history records for pm-github-11qm.	CHANGELOG.md .agents/pm/issues/pm-github-11qm.toon .agents/pm/history/pm-github-11qm.jsonl

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 733e0a5f-049e-43a3-ab1b-e4755151ad3c

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Greptile Summary

Adds a Dependabot group that combines CodeQL action updates into one pull request, preventing mismatched init and analyze versions.

• Groups all github/codeql-action* dependencies in the GitHub Actions update configuration.
• Records and closes the associated project-management item.
• Documents the fix in the unreleased changelog.

Confidence Score: 5/5

The PR appears safe to merge because the new group covers both CodeQL action dependencies without matching the repository’s unrelated actions.

The configured prefix matches the existing CodeQL init and analyze dependency identifiers under the correct GitHub Actions update entry, and no accepted correctness, security, or quality issue remains.

Important Files Changed

Filename	Overview
.github/dependabot.yml	Adds a correctly scoped group matching both CodeQL actions used by the repository.
.agents/pm/issues/pm-github-11qm.toon	Records the completed issue and accurately describes the Dependabot grouping change.
.agents/pm/history/pm-github-11qm.jsonl	Captures the issue lifecycle and completion metadata consistently.
CHANGELOG.md	Documents the grouping fix under the unreleased section.

_{Reviews (1): Last reviewed commit: "ci: group codeql-action bumps into one p..." | Re-trigger Greptile}

[sourcery-ai]

Hey - I've reviewed your changes and they look great!

Sourcery assessment

Approved.

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

[unbraind]

Acknowledging every bot on this PR, and recording one correction that came out of the review round rather than just thanking everyone.

@greptileai flagged, on the sibling PR in pm-graph, that the central pattern-matching claim is asserted rather than shown — and it was right. I was about to cite the five already-grouped repositories as proof and they do not prove it:

repo	group added	grouped Dependabot PR observed since
pm-beads	2026-08-30 (#94)	none
pm-brief	2026-08-30 (#96)	none
pm-context	2026-08-30 (#91)	none
pm-csv	2026-08-30 (#96)	none
pm-web	2026-08-30 (#118)	none

In every one of those the group landed inside a hand-authored PR that also carried both bumps and closed the split pair. So what is demonstrated is the deadlock half — landing both bumps in one commit makes codeql pass. That patterns: ["github/codeql-action*"] causes Dependabot to emit one PR instead of two is documented behaviour and nothing more; the schedule is weekly, so the first real observation is up to seven days out. Their clean state is unearned, not evidence.

Two things follow:

1. The change is strictly better than the status quo even if the pattern were wrong. A group that matches nothing degrades to today's behaviour — there is no failure mode in which this is worse than no group.
2. The claim is falsifiable and should be treated that way. The next github/codeql-action release is the test. If two separate PRs appear after this merges, the matcher is wrong and the fix is a different matcher, not more prose.

@sourcery-ai and @coderabbitai — both summaries are accurate for this diff. Worth stating for future rounds that a rate-limited or budget-exhausted pass and a pass that reviewed and found nothing produce identical silence here, and silence has previously been misread as approval in this fleet; where the comment on a PR is a limit notice rather than an analysis, it is downvoted for that reason alone and not for quality.

Context worth carrying: this repository's .github/dependabot.yml was hand-edited in place, not replaced with a sibling's copy. A previous fleet-wide propagation silently overwrote eleven repositories with one repository's workflow file, so the thing being asserted in a change like this is the identity of the surrounding content — schedule, limits, labels and the npm entry — not merely that the diff looks small.

[coderabbitai]

Tip

For best results, initiate chat on the files or code changes.

@unbraind, agreed. The existing merged PRs demonstrate that aligned init and analyze versions let codeql pass. They do not demonstrate that Dependabot emits one grouped PR.

The next github/codeql-action release is the required runtime observation. If Dependabot opens separate PRs, the patterns matcher needs correction.

The in-place edit also matters. Review of .github/dependabot.yml must verify the unchanged surrounding entries, including schedules, limits, labels, and the npm update configuration.

🐇🔎

---

✏️ Learnings added

Learnt from: unbraind
URL: https://github.com/unbraind/pm-github/pull/65

Timestamp: 2026-08-31T10:47:06.423Z
Learning: For Dependabot grouping changes that use `patterns: ["github/codeql-action*"]`, merged hand-authored PRs that include both `github/codeql-action/init` and `github/codeql-action/analyze` updates demonstrate only that aligned action versions make the `codeql` check pass. They do not demonstrate that Dependabot will emit one grouped PR. The next matching Dependabot update is the observable test; two separate PRs mean the matcher must be corrected.

---

Learnt from: unbraind
URL: https://github.com/unbraind/pm-github/pull/65

Timestamp: 2026-08-31T10:47:06.423Z
Learning: In the pm-github repository fleet, edit `.github/dependabot.yml` in place. Do not replace it with a sibling repository copy. When reviewing these changes, verify the identity of unchanged surrounding configuration, including schedules, open-pull-request limits, labels, and npm update entries, because a previous fleet-wide propagation overwrote repository-specific workflow content.

Note: Learnings are effective only in the context of similar code segments. To apply general coding guidelines, please configure review instructions. You can manage existing learnings in the app.

_{You are interacting with an AI system.}

[greptile-apps]

That correction is right. The five repositories demonstrate only that landing both CodeQL bumps together resolves the version-mismatch deadlock; they do not demonstrate that patterns: ["github/codeql-action*"] makes Dependabot emit one PR. That remains a documented, falsifiable claim whose first real validation is the next CodeQL release. If Dependabot still opens split PRs, the matcher should be corrected rather than defended with additional examples.

The surrounding-file point is also well taken: preserving the existing schedule, limits, labels, and npm entry is part of correctness here, not incidental context. A rate-limit or budget notice is likewise not evidence of a substantive review or approval.