AIOSAI 3071ea8eac ci(deps): bump codeql-action init+analyze to v4.36.3 together + group future bumps ...

The split Dependabot PRs (#init, #analyze) each bumped one path in security.yml,
leaving the sibling at v4.36.2 -> CodeQL fails 'init and analyze must match'.
Bump both to v4.36.3 (SHA 54f647b) in one commit, and add a dependabot groups
block so codeql-action (init/analyze/upload-sarif, one monorepo release) always
lands as a single grouped PR. Fixes the two red Security Scan runs.

2026-07-05 02:07:18 -07:00

..

ci.yml

ci(deps): bump actions/setup-python from 6.2.0 to 6.3.0

2026-06-27 08:02:22 +00:00

e2e-wheel.yml

ci(deps): bump actions/setup-python from 6.2.0 to 6.3.0

2026-06-27 08:02:22 +00:00

macos-test.yml

ci(deps): bump actions/setup-python from 6.2.0 to 6.3.0

2026-06-27 08:02:22 +00:00

publish.yml

ci(deps): bump actions/setup-python from 6.2.0 to 6.3.0

2026-06-27 08:02:22 +00:00

scorecard.yml

ci(deps): bump actions/checkout from 6.0.3 to 7.0.0

2026-06-20 08:02:50 +00:00

security.yml

ci(deps): bump codeql-action init+analyze to v4.36.3 together + group future bumps

2026-07-05 02:07:18 -07:00

stale.yml

ci: harden workflows — least-privilege permissions + SHA-pinned actions

2026-05-29 23:47:27 -07:00

windows-test.yml

ci(deps): bump actions/setup-python from 6.2.0 to 6.3.0

2026-06-27 08:02:22 +00:00