Group your Dependabot Updates

Over the last week Dependabot has had more burr than usual, including a bunch of GitHub workflow updates for CodeQL. The problem for me was it would create a PR for each action, separating the updates for codeql-action/init, codeql-action/analyze and codeql-action/upload-sarif and, if you update a single version so it becomes out of sync with the others, failed workflow.

I swear it didn't use to do this, and after a disgruntled Bluesky post it was pointed out that you can control this with the Dependabot configuration file, with groups.

For example, to group CodeQL together you would do the following

version: 2
updates:
- package-ecosystem: "github-actions"
  directory: "/"
  schedule:
    interval: "daily"
  cooldown:
    default-days: 7
  groups:
    github/codeql-action:
      patterns:
        - github/codeql-action/analyze
        - github/codeql-action/init
        - github/codeql-action/upload-sarif

For nuget packages I've also added

version: 2
updates:
- package-ecosystem: nuget
  directory: "/"
  schedule:
    interval: daily
  cooldown:
    default-days: 7
  groups:
    TestSdk:
      patterns:
        - Microsoft.NET.Test.Sdk
        - Microsoft.CodeCoverage
    AspNetCoreTesting:
      patterns:
        - Microsoft.AspNetCore.Mvc.Testing
        - Microsoft.AspNetCore.TestHost
    Xunit:
      patterns:
        - xunit.v3
        - xunit.runner.visualstudio
    IdentityJwt:
      patterns:
        - System.IdentityModel.Tokens.Jwt
        - Microsoft.IdentityModel.JsonWebTokens

I'm sure there are more, but this is a good starting point.