[JarryShaw]

• Searched for similar pull requests
• Followed the coding style
• make test passes, and a test case covers the change
• Changelog entry: N/A — centralised in docs(changelog): shared 1.5.0 changelog — long-lived, merges last (#610, #616, #617, #618, #620) #657

What is the purpose of your pull request?

• ci — workflows or build tooling

---

Description

• Problem: Dependabot opened three separate PRs (build(deps): bump github/codeql-action/autobuild from 4.39.0 to 4.39.1 #2384, build(deps): bump github/codeql-action/analyze from 4.39.0 to 4.39.1 #2385, build(deps): bump github/codeql-action/init from 4.39.0 to 4.39.1 #2386) bumping one github/codeql-action step each (autobuild, analyze, init). codeql-action now refuses to run unless every step in the workflow is on the same version, so none of the three can pass CI alone — init persists a configuration tagged with its own version, and the next step that runs at a different version refuses to read it: Autobuild on build(deps): bump github/codeql-action/autobuild from 4.39.0 to 4.39.1 #2384/build(deps): bump github/codeql-action/init from 4.39.0 to 4.39.1 #2386, Perform CodeQL Analysis on build(deps): bump github/codeql-action/analyze from 4.39.0 to 4.39.1 #2385 (Loaded a configuration file for version '4.39.0', but running version '4.39.1').
• Fix: group all github/codeql-action/* bumps under the github-actions ecosystem's Dependabot config, so future bumps land as one PR that updates every step together.
• Test: tests/project/test_actions_pinned_1968.py's new TestDependabotGroupsTheCodeQLSteps checks the group sits under the right ecosystem and under no other, that its pattern claims every codeql-action step and nothing else, and that those steps are pinned to one release.

[JarryShaw]

Review: NEEDS CHANGES at current head (Sonnet). The groups: stanza itself is correct (schema-validated, glob-matching confirmed against Dependabot's real matcher over all 152 uses: lines, parses identically under PyYAML and Ruby Psych). Three fixes needed:

1. No test covers the new stanza — test_actions_pinned_1968.py pins every other dependabot.yml stanza but not this one; 7 mutations to the group (removed, typo'd, widened to *, emptied, moved under pip, invalid id, key typo) all pass identically. The PR body ticks "a test case covers the change" without one.
2. Metadata: tickbox says chore where the subject says ci(deps); labels stack chore on ci (against the owner's ruling against stacking where ci already fits).
3. Body wording: "init writes a config and analyze then refuses" overclaims — autobuild refuses on build(deps): bump github/codeql-action/autobuild from 4.39.0 to 4.39.1 #2384/build(deps): bump github/codeql-action/init from 4.39.0 to 4.39.1 #2386, only analyze refuses on build(deps): bump github/codeql-action/analyze from 4.39.0 to 4.39.1 #2385; build(deps): bump github/codeql-action/init from 4.39.0 to 4.39.1 #2386 shows the reversed version mismatch.

Also surfaced, worth knowing: this grouping does NOT retroactively fix #2384-#2386 (Dependabot only reads config from main, after merge), and manually closing those three risks Dependabot never reopening a grouped bump (seen on #1987 in this repo — "I won't notify you again about this release"). Cleanest path for those three: one hand-made commit bumping all three pins together, which lets Dependabot close the singles as up-to-date on its own. Fix in progress.

[github-actions]

Coverage: 91.58% (unit tier, Python 3.15, 9c1afb325, Unit Tests run success)

Package	Statements	Missed	Branches	Partial	Cover
pcapkit (top level)	104	4	20	2	95.16%
pcapkit/const	19601	881	2620	867	92.12%
pcapkit/corekit	2596	74	818	37	96.51%
pcapkit/dumpkit	282	3	102	3	98.44%
pcapkit/foundation	3029	23	1050	25	98.82%
pcapkit/interface	138	4	52	3	96.32%
pcapkit/protocols	17455	218	4598	185	98.15%
pcapkit/toolkit	914	36	334	10	95.51%
pcapkit/utilities	502	7	144	5	98.14%
pcapkit/vendor	4432	1988	1018	167	51.87%

Per-file detail: the coverage-html artifact of this run.

[JarryShaw]

Amended: added TestDependabotGroupsTheCodeQLSteps (5 tests, pattern claims re-derived from dependabot-core's own File.fnmatch? semantics rather than hardcoded) — 8 mutations all caught. Rebased through 7 intervening merges, 21/21 pass. Fixed the tickbox (ci, not chore — the type was already right in the title/labels). Also re-verified which step actually refuses on each of #2384-2386: it's whichever codeql-action step runs after the mismatched one — Autobuild on #2384/#2386, Perform CodeQL Analysis on #2385 — not uniformly "analyze", corrected in the commit message.

[JarryShaw]

Review: NEEDS CHANGES at a9bd9ebac (Sonnet, round 2). All 5 tests confirmed real and non-trivial, 19 mutations tried (your 4 required + 9 more, including literal replays of #2384/#2385/#2386), tickbox confirmed correct, "which step refuses" table confirmed from job logs. Two fixes:

1. grouped()'s docstring and implementation claim dependabot-core uses File.fnmatch?(..., FNM_CASEFOLD) — it doesn't. The real matcher is WildcardMatcher.match?, which lowercases both sides and treats * as .* but every other character (including ? and [...]) as LITERAL. Measured disagreement on 25 of 255 pattern/name pairs tried, all [...]/? patterns — github/codeql-action/[a-z]* would pass this test suite but group nothing in real Dependabot. Exact-port replacement provided and verified (0 disagreements over 255 pairs): re.fullmatch('.*'.join(map(re.escape, p.lower().split('*'))), name.lower(), re.S), drop the fnmatch import.
2. PR body's Problem bullet still says "analyze then refuses to load it" uniformly — true only for build(deps): bump github/codeql-action/analyze from 4.39.0 to 4.39.1 #2385; build(deps): bump github/codeql-action/autobuild from 4.39.0 to 4.39.1 #2384/build(deps): bump github/codeql-action/init from 4.39.0 to 4.39.1 #2386 fail in Autobuild (already correct in the commit message after the last amend, just not the body).

Fix in progress.

[JarryShaw]

Amended a9bd9ebac → 50243916c: fixed grouped()'s matcher — it claimed dependabot-core uses File.fnmatch?(..., FNM_CASEFOLD), but the real matcher (WildcardMatcher.match?) treats [...]/? as literal, only * as a wildcard. Replaced with an exact port, verified (github/codeql-action/[a-z]* now correctly matches nothing; the real pattern still matches). Also fixed the PR body's "analyze then refuses" overclaim and merged the duplicate Test bullets. 21/21 pass.

All findings across both rounds now addressed.

[JarryShaw]

Review: GOOD TO GO at 50243916c (Sonnet, round 3). The matcher fix independently confirmed against the real upstream Ruby source (common/lib/wildcard_matcher.rb, fetched and run directly) over 446,150 differential pairs — 0 disagreements, vs 11,143 for the old fnmatch-based version. All 4 of the exact cases from round 2's required fix confirmed correct. Regex construction, edge cases (empty pattern, ***), and performance all checked. 21/21 tests pass, clean merge onto current main.

All findings across all 3 rounds now addressed.