ci: bump github/codeql-action to 4.37.9 and group its bumps - #796
Conversation
Dependabot raised #793 and #794, each bumping one half of the init/analyze pair. init stamps its version into the config file analyze then loads, so either PR alone fails analyze-codeql with "Loaded a configuration file for version '4.37.6', but running version '4.37.9'". Both are required checks, so merging either would have blocked main. Bumps both pins to cdf488f, verified as the commit tag v4.37.9 resolves to, and groups github/codeql-action* so the split cannot recur. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (2)
Included review availability: 3 reviews are currently available. Your included PR review attempts over the past 7 days set your current allowance at 5 reviews per hour. WalkthroughThe pull request updates both pinned CodeQL actions to v4.37.9 and groups matching Dependabot updates into one weekly pull request. ChangesCodeQL maintenance
Estimated code review effort: 1 (Trivial) | ~5 minutes Merge Risk: ⚪ Minimal · up to This change aligns both CodeQL workflow pins and groups future updates for that action, with no actionable merge-blocking risk remaining after normal checks and review. 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
Full details: Docstring CoverageExplanation No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (2 skipped: 2 unsupported.) ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
☀️ Quality Summary Created by Quality Monitor v4.15.0 (#82d77af). More details are shown in the GitHub Checks Result. |
1 participant
Purpose
Supersedes #793 and #794, which both fail
analyze-codeqland cannot pass on their own.Dependabot treats
github/codeql-action/initandgithub/codeql-action/analyzeas two dependencies, so it raised one PR per line — #794 bumpinginit, #793 bumpinganalyze, both to the same v4.37.9 SHA. CodeQL will not tolerate the halves disagreeing:initstamps its version into the config file thatanalyzelater loads, andanalyzerefuses a config another version wrote.The job says so as a warning 30 s before it fails, which is the line to grep for if this shape recurs:
analyze-codeqlandCodeQLare both required contexts onmain, so merging either PR alone would have blocked every subsequent PR until the other landed.Change Description
Two parts.
The bump. Both pins in
codeql.ymlmove tocdf488f595d80d6e07e03d4674febd5ab45fa938together — the two-line change Dependabot should have raised as one. The SHA was checked against the upstream tag rather than taken from the PR body:v4.37.9is an annotated tag whose commit iscdf488f5, which is what both PRs proposed.The grouping. A
groups:entry forgithub/codeql-action*in the github-actions ecosystem, so the next release arrives as one PR holding both pins. Without it the split recurs on every codeql-action release — #793/#794 is the symptom, not the cause.The grouping is also what makes the SHA pinning mean what it says. Pinning by digest is a hardening posture, and a configuration in which two halves of one action can drift to different digests has a gap in exactly the place the pinning was meant to close. The comment in
dependabot.ymlrecords that, so a future reader does not un-group it as mere PR-noise reduction.Scoped to this one action deliberately: other action bumps stay individual, which keeps their changelog entries and their blast radius separate.
Test Evidence
CI is the evidence here —
analyze-codeqlpassing on this branch is the assertion, since it is the check both superseded PRs fail. Everything else was already green on both of them (29 of 30 lanes).Locally: the SHA verified against the upstream annotated tag as above;
dependabot.ymlparsed to confirm the group attaches to the github-actions ecosystem and leaves the pip ecosystem untouched;check_references.pyandcheck_platform_docs.pyboth clean.Areas Affected
.github/workflows/codeql.ymland.github/dependabot.yml. No source, no build, no documentation. #793 and #794 can be closed once this merges — Dependabot will also close them itself on its next run, having seen the dependency reach the version they proposed.Summary by CodeRabbit
Chores
Security