ci(deps): bump github/codeql-action/analyze from 4.37.3 to 4.37.5 - #194
ci(deps): bump github/codeql-action/analyze from 4.37.3 to 4.37.5#194dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [github/codeql-action/analyze](https://github.com/github/codeql-action) from 4.37.3 to 4.37.5. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@e4fba86...d1ba80a) --- updated-dependencies: - dependency-name: github/codeql-action/analyze dependency-version: 4.37.5 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
dependabot
Bot
added
the
dependencies
📝 WalkthroughWalkthroughThe CodeQL workflow now uses the pinned ChangesCodeQL workflow update
Estimated code review effort: 1 (Trivial) | ~2 minutes Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches 💡 1🛠️ Fix failing CI checks 💡
🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/codeql.yml:
- Line 45: Update the CodeQL workflow’s init and autobuild steps to use revision
d1ba80a13dd99fba24a470575428917156a28b43 (v4.37.5), matching the existing
analyze step so every CodeQL action uses one consistent revision.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 16a8843a-a8e6-4d0e-a2e9-ad972d99ce05
📒 Files selected for processing (1)
.github/workflows/codeql.yml
|
|
||
| - name: Perform CodeQL Analysis | ||
| uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3 | ||
| uses: github/codeql-action/analyze@d1ba80a13dd99fba24a470575428917156a28b43 # v4.37.5 |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -eu
file=".github/workflows/codeql.yml"
cat -n "$file" | sed -n '1,80p'
printf '\nCodeQL action references:\n'
rg -n 'github/codeql-action/(init|autobuild|analyze)@' "$file"
printf '\nRepository status:\n'
git status --shortRepository: thedavidweng/OpenLoop
Length of output: 2142
🏁 Script executed:
#!/bin/bash
set -eu
file=".github/workflows/codeql.yml"
cat -n "$file" | sed -n '1,80p'
printf '\nCodeQL action references:\n'
rg -n 'github/codeql-action/(init|autobuild|analyze)@' "$file"Repository: thedavidweng/OpenLoop
Length of output: 2122
🏁 Script executed:
#!/bin/bash
set -eu
resolve_tag() {
tag="$1"
ref_json="$(curl -fsSL "https://api.github.com/repos/github/codeql-action/git/ref/tags/$tag")"
type="$(printf '%s' "$ref_json" | jq -r '.object.type')"
object_sha="$(printf '%s' "$ref_json" | jq -r '.object.sha')"
if [ "$type" = tag ]; then
commit_sha="$(curl -fsSL "https://api.github.com/repos/github/codeql-action/git/tags/$object_sha" | jq -r '.object.sha')"
else
commit_sha="$object_sha"
fi
printf '%s tag_object_type=%s resolved_commit=%s\n' "$tag" "$type" "$commit_sha"
}
resolve_tag v4.37.3
resolve_tag v4.37.5
printf '\nPinned commit existence:\n'
for sha in e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 d1ba80a13dd99fba24a470575428917156a28b43; do
curl -fsSL "https://api.github.com/repos/github/codeql-action/commits/$sha" | jq -r '[.sha, .commit.message | split("\n")[0]] | `@tsv`'
doneRepository: thedavidweng/OpenLoop
Length of output: 210
🌐 Web query:
github codeql-action mixing versions init autobuild analyze unsupported versions
💡 Result:
Mixing different versions of the CodeQL Action in the same workflow is unsupported and can lead to unpredictable results [1][2]. GitHub has implemented validation to detect this issue [1][2]: 1. The codeql-action/init step will emit a warning if it detects that different versions of the CodeQL Action (e.g., init, autobuild, or analyze) are being used within the same workflow file [1][2]. 2. Subsequent steps, such as analyze, will throw an error if they attempt to load a configuration file generated by a different version of the init step [1][2]. To avoid these issues, ensure that all references to the CodeQL Action steps (init, autobuild, and analyze) in your workflow file use the exact same version tag or commit SHA [3][1]. It is generally recommended to reference the CodeQL Action using a major version tag (such as v4) to ensure your workflow automatically receives the latest bug fixes and updates while maintaining consistency across all steps [4]. Additionally, using unsupported or discontinued versions of the CodeQL CLI can lead to failures or deprecation warnings [1][2]. GitHub regularly updates the CodeQL Action to drop support for older CLI versions that have reached the end of their lifecycle [1][2]. If you encounter warnings about unsupported versions, you should update your workflow to use a supported version of the CodeQL Action, or if necessary, pin to a specific older version of the action that still supports your required CLI version [1][5][6].
Citations:
- 1: https://github.com/github/codeql-action/blob/v4.31.7/CHANGELOG.md
- 2: https://github.com/github/codeql-action/blob/main/CHANGELOG.md
- 3: build(ci): bump github/codeql-action init/autobuild/analyze to v4.37.0 cloudfieldcz/shieldoo-gate#121
- 4: https://github.com/github/codeql-action
- 5: https://github.com/github/codeql-action/blob/v4.31.4/CHANGELOG.md
- 6: https://github.com/github/codeql-action/blob/v2.28.0/CHANGELOG.md
🏁 Script executed:
#!/bin/bash
set -eu
resolve_tag() {
tag="$1"
ref_json="$(curl -fsSL "https://api.github.com/repos/github/codeql-action/git/ref/tags/$tag")"
type="$(printf '%s' "$ref_json" | jq -r '.object.type')"
object_sha="$(printf '%s' "$ref_json" | jq -r '.object.sha')"
if [ "$type" = tag ]; then
commit_sha="$(curl -fsSL "https://api.github.com/repos/github/codeql-action/git/tags/$object_sha" | jq -r '.object.sha')"
else
commit_sha="$object_sha"
fi
printf '%s tag_object_type=%s resolved_commit=%s\n' "$tag" "$type" "$commit_sha"
}
resolve_tag v4.37.3
resolve_tag v4.37.5
printf '\nPinned commit existence:\n'
for sha in e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 d1ba80a13dd99fba24a470575428917156a28b43; do
curl -fsSL "https://api.github.com/repos/github/codeql-action/commits/$sha" |
jq -r '[.sha, (.commit.message | split("\n")[0])] | `@tsv`'
doneRepository: thedavidweng/OpenLoop
Length of output: 210
🏁 Script executed:
#!/bin/bash
set -eu
repo="https://github.com/github/codeql-action.git"
printf '%s\n' 'Tag refs:'
git ls-remote "$repo" \
"refs/tags/v4.37.3" "refs/tags/v4.37.3^{}" \
"refs/tags/v4.37.5" "refs/tags/v4.37.5^{}"
printf '%s\n' 'Exact pinned-object lookup:'
for sha in e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 d1ba80a13dd99fba24a470575428917156a28b43; do
printf '%s: ' "$sha"
git ls-remote "$repo" | awk -v sha="$sha" '$1 == sha {print; found=1} END {if (!found) print "not present in advertised refs"}'
doneRepository: thedavidweng/OpenLoop
Length of output: 647
Use one CodeQL Action revision for every CodeQL step.
init and autobuild use v4.37.3, while analyze uses v4.37.5. Mixing versions can cause configuration errors or unpredictable analysis results. Update both older pins to d1ba80a13dd99fba24a470575428917156a28b43 (v4.37.5).
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/codeql.yml at line 45, Update the CodeQL workflow’s init
and autobuild steps to use revision d1ba80a13dd99fba24a470575428917156a28b43
(v4.37.5), matching the existing analyze step so every CodeQL action uses one
consistent revision.
Bumps github/codeql-action/analyze from 4.37.3 to 4.37.5.
Release notes
Sourced from github/codeql-action/analyze's releases.
Changelog
Sourced from github/codeql-action/analyze's changelog.
... (truncated)
Commits
d1ba80aMerge pull request #4067 from github/update-v4.37.5-1cd4d01d5e74600bUpdate changelog for v4.37.51cd4d01Merge pull request #4061 from github/henrymercer/turbo-systemd2bfc30Merge pull request #4050 from github/mbg/status/registries68028fcMerge pull request #4062 from github/sam-robson/migrate-enterprise-release-patc29563eci: use federated enterprise release PAT155e522Link the PR from the changelog entry2d3b351Handle network errors when streaming the CodeQL bundle download5d3eb98Merge pull request #4055 from github/dependabot/npm_and_yarn/npm-minor-203262...c5f739bMerge branch 'main' into dependabot/npm_and_yarn/npm-minor-2032624187Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)Summary by CodeRabbit