Skip to content

ci: bump github/codeql-action/autobuild from 4.37.3 to 4.37.8 #621

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
dependabot wants to merge 1 commit into from
Closed

ci: bump github/codeql-action/autobuild from 4.37.3 to 4.37.8 #621

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/codeql.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,7 +42,7 @@ jobs:
languages: go

- name: Autobuild
uses: github/codeql-action/autobuild@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4
uses: github/codeql-action/autobuild@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4

@wbreza wbreza Aug 24, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[F-001] Merging this bump on its own leaves CodeQL scanning broken on the default branch.

The init step (line 40) and the analyze step (line 48) stay pinned to e4fba868... (v4.37.3) while this line moves autobuild to db488dde... (v4.37.8). The CodeQL Action validates that the config file written by init was produced by the same version as the step consuming it, and throws when it was not — src/config-utils.ts:

if (config.version !== getActionVersion()) {
  throw new ConfigurationError(
    `Loaded a configuration file for version '${config.version}', but running version '${getActionVersion()}'`,
  );
}

The Analyze check on this PR fails for exactly that reason:

##[error]We were unable to automatically build your code. Please replace the call to the autobuild action with your custom build steps.
Loaded a configuration file for version '4.37.3', but running version '4.37.8'

The scheduled run on main, where all three steps sit at matching v4.37.3, passes — so the breakage originates here rather than being pre-existing or environmental. It is also not a token-permission artifact of a bot-authored PR: the failure occurs inside Autobuild, well before any SARIF upload.

Because Autobuild aborts before analysis runs, the consequence is not a merely red check — Go code stops being scanned on main until the pins are realigned.

Land all three github/codeql-action/* pins on db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 in a single commit instead of merging this path in isolation. Lines 40 and 48 are outside this diff hunk, so they cannot be carried as suggestions here.

@wbreza wbreza Aug 24, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[O-001] 💡 Improvement Opportunity (optional — not required to merge)

Benefit: The trailing comment reads # v4 while the pin resolves to v4.37.8. The rest of this repo annotates pinned actions with the full version — actions/checkout ... # v7.0.1, actions/setup-go ... # v7.0.0 — 84 full-version comments against 4 major-only, all four of the latter being these codeql-action steps. Recording the full version makes a divergence between lines 40, 45, and 48 legible on inspection instead of concealing it behind three identical # v4 comments.
Effort: One comment per pinned codeql-action step.
Optionality: Optional
Sketch:

Suggested change
uses: github/codeql-action/autobuild@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4
uses: github/codeql-action/autobuild@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8


- name: Perform CodeQL Analysis
uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4

@wbreza wbreza Aug 24, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[F-002] Dependabot has no groups rule for github/codeql-action/*, so each release round produces three PRs that are mutually breaking.

This line still pins analyze to v4.37.3 because init, autobuild, and analyze are tracked as independent dependencies and each receives its own PR. Given that the three steps must execute at the same version, no single PR in the set can pass CI, and none is safe to merge alone. The pattern has already repeated: the init, autobuild, and analyze PRs from this round all fail with the same version-mismatch error, as did the preceding v4.37.7 round.

.github/dependabot.yml declares the github-actions ecosystem with no grouping. Adding a group preserves commit-level pinning while collapsing the three updates into one PR that is coherent on arrival:

- package-ecosystem: "github-actions"
  directory: "/"
  schedule:
    interval: "weekly"
  commit-message:
    prefix: "ci"
  groups:
    codeql-action:
      patterns:
        - "github/codeql-action/*"

Moving the three steps to the floating @v4 tag would also eliminate the mismatch, but it surrenders commit-level provenance on the security-scanning workflow itself and is the weaker trade.

Expand Down
Loading