From a906b8c73eff3759a1de9a73532017726d5f02fe Mon Sep 17 00:00:00 2001 From: William Storey Date: Tue, 21 Jul 2026 18:52:48 +0000 Subject: [PATCH 1/2] Run Dependabot updates weekly We now review dependency updates weekly rather than daily, so daily update runs only generate churn. Check for updates once a week on Monday morning instead. Co-Authored-By: Claude Fable 5 --- .github/dependabot.yml | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index b552ae4..1ac6641 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -3,7 +3,8 @@ updates: - package-ecosystem: uv directory: / schedule: - interval: daily + interval: weekly + day: monday time: '14:00' open-pull-requests-limit: 10 cooldown: @@ -11,7 +12,8 @@ updates: - package-ecosystem: github-actions directory: / schedule: - interval: daily + interval: weekly + day: monday time: '14:00' cooldown: default-days: 7 From 0ea29d95158b84b4284d20dc2617a51bedc20cdf Mon Sep 17 00:00:00 2001 From: William Storey Date: Tue, 21 Jul 2026 18:53:04 +0000 Subject: [PATCH 2/2] Group CodeQL action updates Dependabot treats the github/codeql-action subpath actions (init, analyze, autobuild) as separate dependencies and opens a separate PR for each. CI fails unless they are all updated together. Group them so that they arrive as a single PR. Co-Authored-By: Claude Fable 5 --- .github/dependabot.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 1ac6641..8b2f232 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -15,5 +15,9 @@ updates: interval: weekly day: monday time: '14:00' + groups: + codeql: + patterns: + - github/codeql-action* cooldown: default-days: 7