chore(deps): bump codeql-action to 4.37.4 across all six references - #1208
Merged
Conversation
Dependabot opened three separate PRs for the same action (init #1199, analyze #1200, upload-sarif #1201), and two of them fail on their own with: Loaded a configuration file for version '4.37.4', but running version '4.37.3' The init step writes a config that the analyze step refuses when their versions differ, so no single-step bump can ever go green: the three are one unit. GitHub's own README recommends a major-version tag precisely so every step moves together, but this repo pins by SHA for supply-chain reasons (Scorecard pinned-dependencies), which makes moving them together a manual step. All six references across five workflows now point at f205ea1c3313d32999d8d6a48b4f6530d4437b38, the commit behind tag v4.37.4 (verified against the GitHub API, and identical to the SHA Dependabot proposed). Supersedes #1199, #1200 and #1201. Signed-off-by: Felipe Marzochi <fmarzochi@gmail.com>
|
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why Dependabot's PRs cannot pass on their own
Dependabot opened three PRs for the same action — init (#1199), analyze (#1200), upload-sarif (#1201). Two of them fail, and the log says exactly why:
The
initstep writes a config that theanalyzestep rejects when their versions differ. The three steps are one unit: no single-step bump can ever go green, and re-running them will not help.GitHub's own codeql-action README recommends referencing a major version tag (
v4) so "your workflow automatically picks up the latest release within that major version" — i.e. every step moves together. This repo pins by SHA instead, for supply-chain reasons (Scorecardpinned-dependencies, tracked in #322), so moving them together has to be done in one commit.This PR
All six references across five workflows (
codeql.yml×2,cflite_pr,cflite_batch,cflite_cron,scorecard) now point atf205ea1c3313d32999d8d6a48b4f6530d4437b38— the commit behind tagv4.37.4, verified against the GitHub API and identical to the SHA Dependabot proposed.Supersedes #1199, #1200 and #1201, which should be closed once this merges.
Summary by cubic
Pin
github/codeql-actionto v4.37.4 across all six references to keepinit,analyze, andupload-sarifin sync and fix CI failures from mixed versions. All steps now use commit f205ea1c3313d32999d8d6a48b4f6530d4437b38.github/codeql-action/init,github/codeql-action/analyze, andgithub/codeql-action/upload-sarifto v4.37.4 (f205ea1c3).codeql.yml(init, analyze),cflite_pr,cflite_batch,cflite_cron,scorecard.Written for commit 8588f6c. Summary will update on new commits.