chore(deps): bump github/codeql-action/analyze from 4.37.1 to 4.37.3 - #34
chore(deps): bump github/codeql-action/analyze from 4.37.1 to 4.37.3#34dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [github/codeql-action/analyze](https://github.com/github/codeql-action) from 4.37.1 to 4.37.3. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@7188fc3...e4fba86) --- updated-dependencies: - dependency-name: github/codeql-action/analyze dependency-version: 4.37.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
|
PR author is in the excluded authors list. |
📝 WalkthroughWalkthroughThe CodeQL workflow now pins the analyze action to the v4.37.3 commit instead of v4.37.1. ChangesCodeQL workflow
Estimated code review effort: 1 (Trivial) | ~2 minutes Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches 💡 1🛠️ Fix failing CI checks 💡
🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/codeql.yml:
- Line 36: Update the CodeQL Action init step to use commit
e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81, matching the existing analyze step and
keeping all CodeQL actions on the same version.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 754c3382-1431-4ee3-9593-a9af6c59294b
📒 Files selected for processing (1)
.github/workflows/codeql.yml
|
|
||
| - name: Analyze | ||
| uses: github/codeql-action/analyze@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1 | ||
| uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
workflow=".github/workflows/codeql.yml"
init_ref="$(rg -o 'github/codeql-action/init@[0-9a-f]+' "$workflow" | sed 's/.*`@//`')"
analyze_ref="$(rg -o 'github/codeql-action/analyze@[0-9a-f]+' "$workflow" | sed 's/.*`@//`')"
test "$init_ref" = "$analyze_ref"Repository: Xquik-dev/x-twitter-scraper-csharp
Length of output: 172
🏁 Script executed:
set -euo pipefail
workflow=".github/workflows/codeql.yml"
printf '%s\n' '--- workflow references ---'
cat -n "$workflow" | sed -n '20,42p'
printf '%s\n' '--- all CodeQL references ---'
rg -n 'github/codeql-action/(init|analyze|autobuild|upload-sarif|start|finalize)@' .github/workflows
printf '%s\n' '--- repository metadata ---'
git remote -v | head -n 4
printf '%s\n' '--- pinned commit existence ---'
for sha in \
7188fc363630916deb702c7fdcf4e481b751f97a1 \
e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81
do
curl -fsSL "https://api.github.com/repos/github/codeql-action/commits/$sha" |
jq -r '[.sha, .commit.message] | `@tsv`'
done
printf '%s\n' '--- v4.37.1 and v4.37.3 tag objects ---'
for tag in v4.37.1 v4.37.3
do
curl -fsSL "https://api.github.com/repos/github/codeql-action/git/ref/tags/$tag" |
jq -r '[.object.type, .object.sha] | `@tsv`'
doneRepository: Xquik-dev/x-twitter-scraper-csharp
Length of output: 1571
🏁 Script executed:
set -euo pipefail
printf '%s\n' '--- CodeQL tag refs ---'
git ls-remote https://github.com/github/codeql-action.git \
'refs/tags/v4.37.1' 'refs/tags/v4.37.1^{}' \
'refs/tags/v4.37.3' 'refs/tags/v4.37.3^{}'
printf '%s\n' '--- pinned refs in the CodeQL repository ---'
git ls-remote https://github.com/github/codeql-action.git \
'7188fc363630916deb702c7fdcf4e481b751f97a1' \
'e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81'
printf '%s\n' '--- CodeQL changelog references to version mixing ---'
curl -fsSL https://raw.githubusercontent.com/github/codeql-action/main/CHANGELOG.md |
rg -n -i -C 3 'mix|version|unsupported|unpredictable' | head -n 120Repository: Xquik-dev/x-twitter-scraper-csharp
Length of output: 16772
🌐 Web query:
site:github.com/github/codeql-action CHANGELOG mixed versions actions in a workflow unsupported unpredictable results
💡 Result:
Mixing different versions of the CodeQL Action within a single GitHub Actions workflow is unsupported and can lead to unpredictable results [1][2]. GitHub has implemented validation mechanisms within the CodeQL Action to detect this behavior and mitigate issues [1][3]: - Warning Emittance: The codeql-action/init step will issue a warning if it detects that different versions of the CodeQL Action are being used across steps in the same workflow [1][4]. - Execution Errors: Other CodeQL Action steps will now throw an error if they attempt to load a configuration file generated by a different version of the codeql-action/init step [1][5]. To ensure stable performance, you should maintain consistency by referencing the same version of the CodeQL Action throughout your entire workflow file [1][6].
Citations:
- 1: https://github.com/github/codeql-action/blob/main/CHANGELOG.md
- 2: https://github.com/github/codeql-action/blob/v4.31.9/CHANGELOG.md
- 3: https://github.com/github/codeql-action/blob/v4.31.0/CHANGELOG.md
- 4: https://github.com/github/codeql-action/blob/v4.31.7/CHANGELOG.md
- 5: https://github.com/github/codeql-action/blob/v4.31.10/CHANGELOG.md
- 6: github/codeql-action@0a3e317
Align all CodeQL Action steps in this workflow.
init still uses v4.37.1, while analyze uses v4.37.3. Update init to commit e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81. Mixed versions are unsupported and can cause CodeQL analysis errors.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/codeql.yml at line 36, Update the CodeQL Action init step
to use commit e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81, matching the existing
analyze step and keeping all CodeQL actions on the same version.
|
Superseded by #39. |
Bumps github/codeql-action/analyze from 4.37.1 to 4.37.3.
Release notes
Sourced from github/codeql-action/analyze's releases.
Changelog
Sourced from github/codeql-action/analyze's changelog.
... (truncated)
Commits
e4fba86Merge pull request #4031 from github/update-v4.37.3-72f6a9da0fb50ab5Update changelog for v4.37.372f6a9dMerge pull request #4030 from github/mbg/fix/no-proxy3b5ee58Use defaultrequestoptions instead ofundefinedbfb6be4Merge pull request #4028 from github/mergeback/v4.37.2-to-main-e0647621526ab84Rebuildd6217b9Update changelog and version after v4.37.2e064762Merge pull request #4027 from github/update-v4.37.2-385bcdc5ae0faed8Add a couple of change notes73aad0eUpdate changelog for v4.37.2Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)Summary by cubic
Upgrade
github/codeql-action/analyzein the CodeQL workflow from v4.37.1 to v4.37.3 to keep our security analysis action current. Pinned to the new commit SHA; no behavior changes expected.Written for commit 1e30170. Summary will update on new commits.
Note
Bump
github/codeql-action/analyzefrom v4.37.1 to v4.37.3Updates the CodeQL 'Analyze' step in codeql.yml to use the latest patch release.
Macroscope summarized 1e30170.
Summary by CodeRabbit