ci: bump github/codeql-action/analyze from 4.37.3 to 4.37.6 #605
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change | ||||
|---|---|---|---|---|---|---|
|
|
@@ -45,6 +45,6 @@ jobs: | |||||
| uses: github/codeql-action/autobuild@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4 | ||||||
|
|
||||||
| - name: Perform CodeQL Analysis | ||||||
| uses: github/codeql-action/analyze@5595ccaf912efad79be6eef63a5619ff05969be3 # v4 | ||||||
|
Collaborator
There was a problem hiding this comment. [F-002] All three github/codeql-action steps carry the same # v4 trailing comment, but after this change lines 40 and 45 are v4.37.3 while line 48 is v4.37.6. Other actions in this workflow record the patch level (actions/checkout … # v7.0.1, actions/setup-go … # v7.0.0), so codeql-action is the one place where a reader cannot see that the pins have drifted apart.
Suggested change
Collaborator
There was a problem hiding this comment. [O-001] .github/dependabot.yml has no groups: entry for the github-actions ecosystem, so Dependabot files init, autobuild and analyze as three independent PRs (#604, #605, #607). Because CodeQL requires one version across the job, none of the three passes CI on its own and every codeql-action release reproduces this. Grouping them makes the bump atomic: - package-ecosystem: "github-actions"
directory: "/"
schedule:
interval: "weekly"
commit-message:
prefix: "ci"
groups:
codeql-action:
patterns:
- "github/codeql-action*" |
||||||
| with: | ||||||
| upload: always | ||||||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
[F-001] Only analyze moves to v4.37.6 here — init (line 40) and autobuild (line 45) stay pinned at e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 (v4.37.3). The CodeQL Action enforces version consistency across all github/codeql-action/* steps in a job, and the Analyze job on this PR fails at Perform CodeQL Analysis:
init and autobuild succeed; only the analyze step and its post-action fail, and recent Analyze runs on main pass — so the failure is introduced by this change, not pre-existing. Analysis aborts before SARIF upload, so upload: always on line 50 cannot preserve the scan results.
Landing this on its own puts main in the mismatched state for every push, pull request, and the weekly schedule until #604 (init) and #607 (autobuild) also land. Move all three pins to 5595ccaf912efad79be6eef63a5619ff05969be3 in one change, or hold this until the other two merge in the same batch.