fix: 🔧 Consolidate codeql dependabot updates

[evaline-ju]

Summary

Most of the codeql dependabot PRs like #772 and #774 can't function / pass CI without each other. The init, autobuild, and analyze updates have to go together. Previous manual consolidations were made like #746 and #748 but this has become tedious with every update. This updates the dependabot config to consolidate the codeql updates.

[coderabbitai]

Warning

Review limit reached

@evaline-ju, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 1 minute

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits within each organization.

For paid Pro and Pro+ reviews, CodeRabbit uses a developer's included PR review attempts over the past 7 days to set the current hourly allowance. At typical activity levels, the full plan allowance applies. Higher sustained activity can lower the allowance until earlier attempts leave the 7-day window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: b1813e12-3ec6-46e0-ada1-16b2a80d5f1a

📥 Commits

Reviewing files that changed from the base of the PR and between c25d42d and 55702ae.

📒 Files selected for processing (1)

• .github/dependabot.yml

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[clawgenti]

This PR adds a groups block to .github/dependabot.yml to consolidate CodeQL action updates — a clean, targeted config change that addresses the manual consolidation toil described in the summary.

All checks pass. Ready for human review.

---

Reviewed by clawgenti using the github-pr-review skill

[cwiklik]

Summary

Adds a groups entry to .github/dependabot.yml so github/codeql-action/* updates land in a single Dependabot PR instead of separate init/autobuild/analyze bumps that can't pass CI independently — eliminating the recurring manual consolidation (#746/#748).

Verified: the groups.codeql-action block is correctly nested under package-ecosystem: github-actions (not one of the gomod blocks, where it would be a silent no-op), the indentation and grouping syntax are valid, and the github/codeql-action/* pattern matches the actions in question. Well-justified, well-scoped maintenance fix. DCO signed, CI green (20 checks), no .claude//.vscode/ changes.

Approving.

Author: evaline-ju (MEMBER — maintainer)
Areas reviewed: CI config (Dependabot / GitHub Actions), YAML
CI: 20 green; Spellcheck skipping.