Martin Vogel 0b81154813 ci: bump the CodeQL actions to v4.39.0 together and group their Dependabot updates ...

Dependabot opened one PR per CodeQL action (#2504 init, #2505 analyze, #2506 upload-sarif), each moving to 4.38.2. Merging them one at a time would leave init and analyze on different versions in between. This moves all three to v4.39.0 (6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee, the commit the v4.39.0 tag points to) in one change, and adds a Dependabot group so future CodeQL Action updates arrive as a single PR.

Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>

2026-10-21 00:34:05 +02:00

..

codeql

ci(codeql): PR scan per language inside PR CI, full scan on main

2026-10-20 23:09:09 +02:00

ISSUE_TEMPLATE

feat(diag): persistent memory trajectory + query-leak CI soak for #581

2026-06-28 23:28:01 +02:00

workflows

ci: bump the CodeQL actions to v4.39.0 together and group their Dependabot updates

2026-10-21 00:34:05 +02:00

CODEOWNERS

docs: make maintainer policy project-oriented

2026-06-29 00:00:10 +02:00

dependabot.yml

ci: bump the CodeQL actions to v4.39.0 together and group their Dependabot updates

2026-10-21 00:34:05 +02:00

issue-labeler.yml

fix(ci): issue labeler no-oped on every issue — (?i) is invalid in JS RegExp

2026-07-10 00:03:43 +02:00

label-actions.yml

ci: add issue-triage bots (stale, label-actions, area-labeler)

2026-06-24 01:18:29 +02:00

pr-acknowledgement.md

docs(ci): tell contributors the release freeze is over, not that it is ongoing

2026-07-31 02:29:13 +02:00

pull_request_template.md

Adopt the Developer Certificate of Origin for all commits

2026-06-12 14:31:55 +02:00

scancode-constraints.txt

ci(security): pin the ScanCode install; pluggy 1.7.0 breaks it

2026-10-15 18:16:16 +02:00