Skip to content

build(deps): bump github/codeql-action/analyze from 4.37.7 to 4.37.9 #81

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
dependabot wants to merge 1 commit into from
Closed

build(deps): bump github/codeql-action/analyze from 4.37.7 to 4.37.9 #81

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/codeql.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -62,6 +62,6 @@ jobs:
queries: security-extended

- name: Analyze
uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9

@revuto-review revuto-review Bot Aug 29, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is an auto review done by revuto.

analyze is now v4.37.9, but the init step (line 57) is still pinned to ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7. All github/codeql-action/* steps in a workflow must use the same action version — init writes the database/env state that analyze consumes, and mixed versions are unsupported (this workflow was created in #70 with both pins at the identical commit). Concretely, 4.37.9's only change is "default CodeQL bundle → 2.26.4", so a run would create databases with the 2.26.3 bundle via init 4.37.7 and analyze expecting 2.26.4. Since this workflow exists to keep the required code_scanning check satisfiable for fork PRs, please bump the line 57 init pin to cdf488f595d80d6e07e03d4674febd5ab45fa938 in this same PR (dependabot tracks the two sub-actions as separate deps, so waiting for the companion init PR leaves a mixed-version window on main).

with:
category: "/language:${{ matrix.language }}"
Loading