Skip to content

ci: bump github/codeql-action/init from 4.37.3 to 4.37.8 #620

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
dependabot wants to merge 1 commit into from
Closed

ci: bump github/codeql-action/init from 4.37.3 to 4.37.8 #620

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/codeql.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,7 +37,7 @@ jobs:
cache-dependency-path: cli/go.sum

- name: Initialize CodeQL
uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4
uses: github/codeql-action/init@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4

@wbreza wbreza Aug 24, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[F-001] This bump moves init to db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 (v4.37.8), but autobuild (line 45) and analyze (line 48) remain pinned to e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 (v4.37.3). CodeQL requires every step in the job to run the same version, and the mismatch is a hard failure, not a warning.

The Analyze check on this PR fails at the Autobuild step:

We were unable to automatically build your code. Please replace the call to the autobuild action
with your custom build steps. Loaded a configuration file for version '4.37.8', but running version '4.37.3'

Analysis aborts before any SARIF is uploaded, so the branch gets no CodeQL results at all. The last 10 CodeQL runs on main all succeeded with the three steps aligned at 4.37.3, which confirms the skew is introduced here rather than pre-existing.

Fix: repoint all three CodeQL steps to db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 in a single change.

      - name: Autobuild
        uses: github/codeql-action/autobuild@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8

@wbreza wbreza Aug 24, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[F-002] Dependabot split this upgrade across three PRs, one per action path:

Because the three steps must share a version, merging any subset leaves main in a mixed-version state and breaks CodeQL there the same way it is broken on this branch. Merging this one first is the worst case: main starts failing immediately and stays failing until #622 lands.

Fix: merge all three in one batch, or fold the autobuild and analyze pins into this PR and close #621 and #622 as superseded.

@wbreza wbreza Aug 24, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[F-003] The trailing comment records # v4 — a floating major — rather than the exact release being pinned. The rest of the repository records the precise version alongside the SHA, including the step directly above this one:

  • .github/workflows/codeql.yml:34 — actions/setup-go@b7ad1da... # v7.0.0
  • .github/workflows/ci.yml:43 — # v7.0.1
  • .github/workflows/ci.yml:53 — # v6.1.0
  • .github/workflows/release.yml:499 — # v4.1.2

The imprecise comment predates this PR on the CodeQL steps, so this is carried forward rather than introduced, but it hides which release was actually audited and makes the skew in F-001 invisible to a reader scanning the file. Recording # v4.37.8 on all three CodeQL steps would make the mismatch obvious at a glance.

with:
languages: go

Expand Down
Loading