Skip to content

ci: bump github/codeql-action/init from 4.37.3 to 4.37.7 #617

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
dependabot wants to merge 1 commit into from
Closed

ci: bump github/codeql-action/init from 4.37.3 to 4.37.7 #617

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/codeql.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,7 +37,7 @@ jobs:
cache-dependency-path: cli/go.sum

- name: Initialize CodeQL
uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4
uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4

@wbreza wbreza Aug 17, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[F-001] Bumping init on its own puts this workflow on two different CodeQL Action versions, and the Analyze job fails as a direct result.

After this change codeql.yml reads:

  • L40 init@ff2f1c62... -> v4.37.7
  • L45 autobuild@e4fba868... -> v4.37.3
  • L48 analyze@e4fba868... -> v4.37.3

init exports CODEQL_ACTION_VERSION: 4.37.7, and autobuild at 4.37.3 then refuses to load the configuration it wrote. The run on this head fails with:

##[warning]1 issue was detected with this workflow: Not all workflow steps that use `github/codeql-action` actions use the same version.
##[error]We were unable to automatically build your code. ... Loaded a configuration file for version '4.37.7', but running version '4.37.3'

The job ends in configuration error. The last five CodeQL runs on main are green, so this is introduced here rather than inherited.

The companion bumps already exist and target the identical SHA: #616 (autobuild) and #618 (analyze). Merge all three together instead of any one in isolation — merging a subset only relocates the mismatch to a different pair of steps.

To keep this from recurring, group the github/codeql-action/* updates in .github/dependabot.yml so the three sub-actions ship as a single PR.

with:
languages: go

Expand Down
Loading