chore(deps): bump github/codeql-action/init from 4.37.1 to 4.37.3 - #32
chore(deps): bump github/codeql-action/init from 4.37.1 to 4.37.3#32dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [github/codeql-action/init](https://github.com/github/codeql-action) from 4.37.1 to 4.37.3. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@7188fc3...e4fba86) --- updated-dependencies: - dependency-name: github/codeql-action/init dependency-version: 4.37.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
|
PR author is in the excluded authors list. |
📝 WalkthroughWalkthroughThe CodeQL workflow updates its initialization action from ChangesCodeQL workflow
Estimated code review effort: 1 (Trivial) | ~2 minutes Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches 💡 1🛠️ Fix failing CI checks 💡
🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/codeql.yml:
- Line 29: Update the CodeQL workflow’s analyze step to use the same pinned
CodeQL Action revision as the init step at
github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81, replacing
its older v4.37.1 pin while leaving the existing init configuration unchanged.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: db0c98c0-7654-4e49-9fb3-5e52b583b3d1
📒 Files selected for processing (1)
.github/workflows/codeql.yml
|
|
||
| - name: Initialize CodeQL | ||
| uses: github/codeql-action/init@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1 | ||
| uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3 |
There was a problem hiding this comment.
🩺 Stability & Availability | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
refs="$(rg -o 'github/codeql-action/[^@[:space:]]+@[0-9a-f]{40}' .github/workflows/codeql.yml \
| sed 's/.*`@//`' | sort -u)"
test "$(printf '%s\n' "$refs" | sed '/^$/d' | wc -l)" -eq 1Repository: Xquik-dev/x-twitter-scraper-csharp
Length of output: 172
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '%s\n' '--- workflow references ---'
cat -n .github/workflows/codeql.yml | sed -n '20,42p'
printf '%s\n' '--- referenced CodeQL action pins ---'
rg -n 'github/codeql-action/[^@[:space:]]+@[0-9a-f]{40}' .github/workflows/codeql.yml
printf '%s\n' '--- pin existence and tag resolution ---'
python3 - <<'PY'
import json
import urllib.request
pins = {
"e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81": "v4.37.3",
"7188fc363630916deb702c7fdcf4e481b751f97a": "v4.37.1",
}
base = "https://api.github.com/repos/github/codeql-action"
def get(path):
req = urllib.request.Request(
base + path,
headers={"Accept": "application/vnd.github+json", "User-Agent": "review-verifier"},
)
with urllib.request.urlopen(req) as response:
return json.load(response)
for sha, tag in pins.items():
try:
commit = get(f"/commits/{sha}")["sha"]
print(f"pin {sha}: commit={commit}")
except Exception as exc:
print(f"pin {sha}: ERROR {exc}")
try:
ref = get(f"/git/ref/tags/{tag}")
obj = ref["object"]
print(f"tag {tag}: type={obj['type']} object={obj['sha']}")
if obj["type"] == "tag":
tag_obj = get(f"/git/tags/{obj['sha']}")
print(f"tag {tag}: dereferenced_commit={tag_obj['object']['sha']}")
elif obj["type"] == "commit":
print(f"tag {tag}: dereferenced_commit={obj['sha']}")
except Exception as exc:
print(f"tag {tag}: ERROR {exc}")
PYRepository: Xquik-dev/x-twitter-scraper-csharp
Length of output: 1842
🏁 Script executed:
#!/bin/bash
set -euo pipefail
api='https://api.github.com/repos/github/codeql-action'
for path in \
'commits/e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81' \
'commits/7188fc363630916deb702c7fdcf4e481b751f97a' \
'git/ref/tags/v4.37.3' \
'git/ref/tags/v4.37.1'
do
printf '%s\n' "--- $path ---"
curl -ksSfL \
-H 'Accept: application/vnd.github+json' \
-H 'User-Agent: review-verifier' \
"$api/$path" |
jq -c '{sha: (.sha // null), object: (.object // null), message: (.message // null)}'
doneRepository: Xquik-dev/x-twitter-scraper-csharp
Length of output: 331
🌐 Web query:
github codeql-action mixed versions init analyze unsupported workflow v4.37.3 v4.37.1
💡 Result:
Mixing different versions of the CodeQL Action within a single GitHub Actions workflow is unsupported and can cause unpredictable results [1][2][3]. GitHub has implemented validation mechanisms to address this issue: - A warning is emitted from the codeql-action/init step if the workflow detects that different versions of the CodeQL Action are being used [1][2]. - An error is thrown by subsequent CodeQL Action steps if they attempt to load a configuration file generated by a different version of the init step [1][2][3]. If you are encountering errors related to version mismatches while using v4.37.1 or v4.37.3, ensure that every reference to the CodeQL Action in your workflow file (e.g., init, analyze, upload-sarif) uses the exact same version tag or reference [4]. It is recommended to use a major version tag (e.g., v4) to ensure all steps consistently use the latest release within that major version [4]. If you must pin to a specific version, verify that all steps in the workflow file are updated to that same version [4]. These checks were introduced in earlier versions of the CodeQL Action (specifically via pull requests #3099 and #3100) to ensure consistency and prevent configuration errors [1][3]. The versions you mentioned (v4.37.1 and v4.37.3) include these validation features [5][6].
Citations:
- 1: https://github.com/github/codeql-action/blob/main/CHANGELOG.md
- 2: https://github.com/github/codeql-action/blob/v4.31.10/CHANGELOG.md
- 3: Store and check action version in
Configgithub/codeql-action#3100 - 4: https://github.com/github/codeql-action
- 5: https://code.jaenis.ch/actions/codeql-action/raw/branch/releases/v4/CHANGELOG.md
- 6: Update github/codeql-action action to v4.37.6 redhat-cop/org#1267
🏁 Script executed:
#!/bin/bash
set -euo pipefail
python3 - <<'PY'
import json
import ssl
import urllib.request
base = "https://api.github.com/repos/github/codeql-action"
pins = {
"e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81": "v4.37.3",
"7188fc363630916deb702c7fdcf4e481b751f97a": "v4.37.1",
}
context = ssl._create_unverified_context()
def get(path):
request = urllib.request.Request(
base + path,
headers={
"Accept": "application/vnd.github+json",
"User-Agent": "review-verifier",
},
)
with urllib.request.urlopen(request, context=context) as response:
return json.load(response)
for pin, tag in pins.items():
commit = get(f"/commits/{pin}")["sha"]
ref = get(f"/git/ref/tags/{tag}")["object"]
if ref["type"] == "tag":
resolved = get(f"/git/tags/{ref['sha']}")["object"]["sha"]
else:
resolved = ref["sha"]
print(json.dumps({
"pin": pin,
"pin_commit": commit,
"tag": tag,
"tag_object_type": ref["type"],
"tag_resolved_commit": resolved,
"matches": commit.lower() == resolved.lower(),
}))
PYRepository: Xquik-dev/x-twitter-scraper-csharp
Length of output: 1003
Use one CodeQL Action pin for all steps.
Line 36 uses v4.37.1, while Line 29 uses v4.37.3. Mixed CodeQL Action versions are unsupported and can cause configuration-loading errors. Set analyze to the same pin as init.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/codeql.yml at line 29, Update the CodeQL workflow’s
analyze step to use the same pinned CodeQL Action revision as the init step at
github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81, replacing
its older v4.37.1 pin while leaving the existing init configuration unchanged.
Bumps github/codeql-action/init from 4.37.1 to 4.37.3.
Release notes
Sourced from github/codeql-action/init's releases.
Changelog
Sourced from github/codeql-action/init's changelog.
... (truncated)
Commits
e4fba86Merge pull request #4031 from github/update-v4.37.3-72f6a9da0fb50ab5Update changelog for v4.37.372f6a9dMerge pull request #4030 from github/mbg/fix/no-proxy3b5ee58Use defaultrequestoptions instead ofundefinedbfb6be4Merge pull request #4028 from github/mergeback/v4.37.2-to-main-e0647621526ab84Rebuildd6217b9Update changelog and version after v4.37.2e064762Merge pull request #4027 from github/update-v4.37.2-385bcdc5ae0faed8Add a couple of change notes73aad0eUpdate changelog for v4.37.2Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)Summary by cubic
Updated
github/codeql-action/initfrom 4.37.1 to 4.37.3 in the CodeQL workflow to pick up the latest patches. This includes the new defaultconfig-fileaddress format and support for authenticated remote configs from 4.37.2.Written for commit 904881e. Summary will update on new commits.
Note
Bump
github/codeql-action/initfrom v4.37.1 to v4.37.3Updates the CodeQL init action in codeql.yml to commit
e4fba86(v4.37.3). Risk: theAnalyzestep no longer referencesgithub/codeql-action/analyze, meaning CodeQL analysis is not executed.Macroscope summarized 904881e.
Summary by CodeRabbit