chore(ci): bump github/codeql-action to v4 for the SARIF uploads - #54
Conversation
Dependabot opened this as #25 and closed it when asked to rebase, saying the action was up to date. It was not: security.yml still pinned v3 in both places that upload SARIF, so the bump was neither applied nor tracked anywhere after the branch was deleted. This is that PR's two lines, reopened by hand. The change is confined to the two upload-sarif steps, one for the Trivy filesystem scan and one for the Trivy image scan. v3 is still maintained, released the same day as v4, so this is not urgent: it is here so the update stops being invisible.
✅ PR Validation Summary
Next Steps
This comment was automatically generated by the PR validation workflow |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review. 📝 WalkthroughWalkthroughThe security workflow updates the SARIF upload action from v3 to v4 in the Trivy and Docker scan jobs. ChangesSecurity SARIF uploads
Estimated code review effort: 1 (Trivial) | ~2 minutes Merge Risk: ⚪ Minimal · up to This localized CI change updates the SARIF upload action used by two security scans without changing scan inputs, permissions, destinations, or application behavior. No actionable merge-blocking risk remains after normal checks and review. 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
Full details: Description checkExplanation The description clearly explains the reason for the change, identifies both modified locations, confirms that no other changes are included, and states the urgency. It is sufficiently complete for this small CI-only update, although it does not use every template heading. Full details: Docstring CoverageExplanation No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.) Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
📊 Measured on this branch
Chaos certification: PASSED at RF 3: 4 faults injected, 1,426 acknowledged writes verified These numbers are measured, not committed: a shared runner varies enough between runs that This comment was automatically generated by the results workflow |
1 participant
Reopens by hand what Dependabot closed as #25.
Why this exists
Asked to rebase, Dependabot closed #25 with
Looks like github/codeql-action is up-to-date now, so this is no longer neededand deleted its branch. It is not up to date:security.ymlpinnedupload-sarif@v3in both places, and the closure left the bump applied nowhere and tracked nowhere. Reopening #25 is impossible now that its branch is gone.What changed
The same two lines #25 carried, and nothing else:
.github/workflows/security.yml:134, the SARIF upload for the Trivy filesystem scan.github/workflows/security.yml:200, the SARIF upload for the Trivy image scanUrgency
Low. v3 and v4 are released on the same day (4.37.9 and 3.37.9), and neither the releases page nor the action's documentation carries a deprecation notice for v3, so nothing is about to stop working. This is here so the update stops being invisible, not because it is pressing.
Summary by CodeRabbit