Group GH actions updates.

[simonmarty]

Description

Why is this change being made?

1. Reduce dependabot PR counts, make it easier to merge updates to GH actions.

What is changing?

1. Added GH actions update group.

Related Links

• Issue #, if available:

---

Testing

How was this tested?

1. Just linted the dependabot file.
2. Docs reference https://docs.github.com/en/code-security/reference/supply-chain-security/dependabot-options-reference#groups--

When testing locally, provide testing artifact(s):

---

Reviewee Checklist

Update the checklist after submitting the PR

• I have reviewed, tested and understand all changes
  If not, why:
• I have filled out the Description and Testing sections above
  If not, why:
• Build and Unit tests are passing
  If not, why:
• Unit test coverage check is passing
  If not, why:
• Integration tests pass locally
  If not, why:
• I have updated integration tests (if needed)
  If not, why:
• I have ensured no sensitive information is leaking (i.e., no logging of sensitive fields, or otherwise)
  If not, why:
• I have added explanatory comments for complex logic, new classes/methods and new tests
  If not, why:
• I have updated README/documentation (if needed)
  If not, why:
• I have clearly called out breaking changes (if any)
  If not, why:

---

Reviewer Checklist

All reviewers please ensure the following are true before reviewing:

• Reviewee checklist has been accurately filled out
• Code changes align with stated purpose in description
• Test coverage adequately validates the changes

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 76.92%. Comparing base (9e32e0e) to head (111874f).

Additional details and impacted files

@@           Coverage Diff           @@
##           master     #195   +/-   ##
=======================================
  Coverage   76.92%   76.92%           
=======================================
  Files           5        5           
  Lines         234      234           
  Branches       24       24           
=======================================
  Hits          180      180           
  Misses         46       46           
  Partials        8        8           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[secrets-manager-ai-code-review]

Claude finished @simonmarty's task in 27s —— View job

---

Code Review: Group GH Actions updates

I reviewed the change to .github/dependabot.yml.

• Read the changed file and diff
• Validate against Dependabot options reference
• Provide review feedback

---

The change adds a groups block to the github-actions ecosystem so that Dependabot bundles action updates into a single PR. This mirrors the existing nuget group and aligns with the Dependabot groups reference. The change is small, correct, and achieves the stated goal of reducing PR noise. ✅

Observations (optional, non-blocking):

1. applies-to: version-updates is the default — For the github-actions group (.github/dependabot.yml:25), applies-to defaults to version-updates when omitted, so this line is technically redundant. It's harmless and arguably improves readability by being explicit, so keeping it is fine — just noting it isn't required.

2. Inconsistency with the nuget group — The nuget group (line 13-18) filters to dependency-type: production and only minor/patch updates, whereas the new actions group includes major updates and has no dependency-type filter. This is a reasonable choice for GitHub Actions (there's no prod/dev distinction, and grouping majors is common), but worth confirming it's intentional. Grouping major updates means a single breaking action bump could block the whole grouped PR from merging until resolved — that's the usual trade-off and generally acceptable for actions.

3. All groups produce one combined PR — With this config, all eligible action updates land in one PR per run. That's exactly the intent stated in the description. 👍

Security: No concerns. Grouping only affects how update PRs are batched, not what gets updated or from where.

Verdict: Looks good to merge. No changes required.