chore(deps): bump github/codeql-action/analyze from 4.37.1 to 4.37.6 - #33
dependabot[bot] wants to merge 1 commit into
Conversation
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
|
PR author is in the excluded authors list. |
📝 WalkthroughWalkthroughThe CodeQL workflow now uses the pinned v4.37.3 analyze action commit instead of v4.37.1. ChangesCodeQL workflow maintenance
Estimated code review effort: 1 (Trivial) | ~2 minutes Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/codeql.yml:
- Line 38: Update the CodeQL workflow’s init, autobuild, and analyze action
references so every CodeQL Action step uses one identical version and commit
SHA, matching the selected version consistently across all steps.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: f6b52968-665a-4b44-bf96-fb6ca67f0b0f
📒 Files selected for processing (1)
.github/workflows/codeql.yml
|
|
||
| - name: Analyze | ||
| uses: github/codeql-action/analyze@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1 | ||
| uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3 |
There was a problem hiding this comment.
🩺 Stability & Availability | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '--- workflow ---'
cat -n .github/workflows/codeql.yml | sed -n '20,45p'
printf '%s\n' '--- action references ---'
rg -n 'github/codeql-action/(init|autobuild|analyze)@' .github/workflows/codeql.yml
printf '%s\n' '--- tag refs ---'
for tag in v2.1.25 v4.37.1 v4.37.3; do
curl -fsSL "https://api.github.com/repos/github/codeql-action/git/ref/tags/$tag" |
jq -c --arg tag "$tag" '{tag:$tag, object_type:.object.type, object_sha:.object.sha}'
done
printf '%s\n' '--- pinned commit resolution ---'
for sha in 7188fc363630916deb702c7fdcf4e481b751f97a e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81; do
curl -fsSL "https://api.github.com/repos/github/codeql-action/commits/$sha" |
jq -c --arg requested "$sha" '{requested:$requested, resolved_sha:.sha, message:.commit.message}'
doneRepository: Xquik-dev/x-twitter-scraper-go
Length of output: 1590
🌐 Web query:
GitHub CodeQL Action mixed versions init autobuild analyze unsupported same version workflow
💡 Result:
Mixing different versions of the CodeQL Action steps (init, autobuild, and analyze) within the same GitHub Actions workflow is unsupported and will lead to workflow failures [1][2][3]. The CodeQL Action requires all sub-actions to run the same version [4][5][6]. This is because the init step generates a configuration file tagged with its specific version, and the subsequent autobuild and analyze steps are designed to validate this configuration [5][1]. If a mismatch is detected—for example, if init runs at one version and autobuild or analyze runs at another—the later steps will throw an error and refuse to read the configuration file, causing the workflow to fail [4][5][7]. Common symptoms of this issue include: - Workflow failure logs containing errors such as: Loaded a configuration file for version 'X', but running version 'Y' [4][5][7]. - Errors or warnings triggered during the CodeQL analysis process [1]. To ensure a stable and supported configuration: - You must keep all github/codeql-action references (init, autobuild, and analyze) pinned to the exact same version or tag [4][7][8]. - If you use automated dependency update tools like Dependabot, ensure they are configured to update all related CodeQL Action steps together in a single atomic pull request, rather than as separate, partial updates [5][7]. Adding a group for these actions in your Dependabot configuration can help prevent split-version updates [7].
Citations:
- 1: https://github.com/github/codeql-action/blob/main/CHANGELOG.md
- 2: https://github.com/github/codeql-action/blob/v4.31.7/CHANGELOG.md
- 3: https://github.com/github/codeql-action/blob/v4.31.0/CHANGELOG.md
- 4: fix: bump codeql-action init/autobuild/analyze to v4.36.3 together aevum-labs/aevum#343
- 5: chore(ci): bump codeql-action init/autobuild/analyze to v4.37.0 atomically aevum-labs/aevum#385
- 6: mozilla/fxa@4f50544
- 7: chore(ci): bump github/codeql-action to v4.36.3 across init/autobuild/analyze [RUB-612] 2tbmz9y2xt-lang/rubin-protocol#2224
- 8: Linuxfabrik/kickstart@8e4fff0
Use one CodeQL Action version for all steps.
init and autobuild use v4.37.1, while analyze uses v4.37.3. Update all CodeQL Action steps to the same version and commit SHA.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/codeql.yml at line 38, Update the CodeQL workflow’s init,
autobuild, and analyze action references so every CodeQL Action step uses one
identical version and commit SHA, matching the selected version consistently
across all steps.
Bumps [github/codeql-action/analyze](https://github.com/github/codeql-action) from 4.37.1 to 4.37.6. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@7188fc3...5595cca) --- updated-dependencies: - dependency-name: github/codeql-action/analyze dependency-version: 4.37.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
changed the title
f91c96f to
1d5fc63
Compare
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
Bumps github/codeql-action/analyze from 4.37.1 to 4.37.6.
Release notes
Sourced from github/codeql-action/analyze's releases.
Changelog
Sourced from github/codeql-action/analyze's changelog.
... (truncated)
Commits
5595ccaMerge pull request #4071 from github/update-v4.37.6-6a9359a1bec9c757Add change note for PR 407045c8742Update changelog for v4.37.66a9359aMerge pull request #4070 from github/mbg/remote-address/change-file-default065cdc0ChangeDEFAULT_CONFIG_FILE_NAMEf99dd5aMerge pull request #4066 from github/dependabot/npm_and_yarn/js-yaml-5.2.21804b21Merge pull request #4068 from github/mergeback/v4.37.5-to-main-d1ba80a13020a2fRebuild93c3a5aUpdate changelog and version after v4.37.5d1ba80aMerge pull request #4067 from github/update-v4.37.5-1cd4d01d5