Skip to content

chore(deps): bump github/codeql-action/analyze from 4.37.1 to 4.37.3 #35

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
dependabot wants to merge 1 commit into
base: main
Choose a base branch
from
Open

chore(deps): bump github/codeql-action/analyze from 4.37.1 to 4.37.3 #35

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/codeql.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,4 +33,4 @@ jobs:
queries: security-extended

- name: Analyze
uses: github/codeql-action/analyze@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1
uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3

@coderabbitai coderabbitai Bot Aug 3, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -eu
printf '%s\n' '--- workflow ---'
cat -n .github/workflows/codeql.yml | sed -n '20,42p'
printf '%s\n' '--- CodeQL action references ---'
rg -n 'github/codeql-action/(init|autobuild|autoc|analyze|upload-sarif)@' .github/workflows
printf '%s\n' '--- repository metadata ---'
git remote -v || true

Repository: Xquik-dev/x-twitter-scraper-ruby

Length of output: 1963

🏁 Script executed:

#!/bin/bash
set -eu
repo='Xquik-dev/x-twitter-scraper-ruby'
printf '%s\n' '--- workflow ---'
curl -fsSL "https://raw.githubusercontent.com/${repo}/HEAD/.github/workflows/codeql.yml" | nl -ba | sed -n '20,42p'
printf '%s\n' '--- CodeQL action references ---'
curl -fsSL "https://api.github.com/repos/${repo}/contents/.github/workflows/codeql.yml" |
  python3 -c 'import sys,json,base64; print(base64.b64decode(json.load(sys.stdin)["content"]).decode())' |
  nl -ba | sed -n '20,42p'
printf '%s\n' '--- tag refs ---'
for tag in v4.37.1 v4.37.3; do
  curl -fsSL -H 'Accept: application/vnd.github+json' \
    "https://api.github.com/repos/github/codeql-action/git/ref/tags/${tag}" |
    python3 -c 'import sys,json; d=json.load(sys.stdin); print(json.dumps(d["object"]))'
done
printf '%s\n' '--- release commits ---'
for sha in \
  7188fc363630916deb702c7fdcf4e481b751f97a \
  e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81; do
  curl -fsSL -H 'Accept: application/vnd.github+json' \
    "https://api.github.com/repos/github/codeql-action/commits/${sha}" |
    python3 -c 'import sys,json; d=json.load(sys.stdin); print(d.get("sha"), d.get("commit",{}).get("message","").splitlines()[0])'
done

Repository: Xquik-dev/x-twitter-scraper-ruby

Length of output: 1043

🏁 Script executed:

#!/bin/bash
set -eu
repo='Xquik-dev/x-twitter-scraper-ruby'
printf '%s\n' '--- workflow ---'
curl -fsSL "https://raw.githubusercontent.com/${repo}/HEAD/.github/workflows/codeql.yml" |
  awk 'NR >= 20 && NR <= 42 { printf "%6d  %s\n", NR, $0 }'
printf '%s\n' '--- action references ---'
curl -fsSL "https://api.github.com/repos/${repo}/contents/.github/workflows/codeql.yml" |
  python3 -c 'import sys,json,base64; print(base64.b64decode(json.load(sys.stdin)["content"]).decode())' |
  awk 'NR >= 20 && NR <= 42 { printf "%6d  %s\n", NR, $0 }'
printf '%s\n' '--- dereferenced tag commits ---'
for tag in v4.37.1 v4.37.3; do
  tag_object=$(
    curl -fsSL -H 'Accept: application/vnd.github+json' \
      "https://api.github.com/repos/github/codeql-action/git/ref/tags/${tag}" |
    python3 -c 'import sys,json; print(json.load(sys.stdin)["object"]["sha"])'
  )
  printf '%s tag-object %s\n' "$tag" "$tag_object"
  curl -fsSL -H 'Accept: application/vnd.github+json' \
    "https://api.github.com/repos/github/codeql-action/git/tags/${tag_object}" |
    python3 -c 'import sys,json; d=json.load(sys.stdin); print("commit", d["object"]["sha"])'
done
printf '%s\n' '--- declared pin resolution ---'
for sha in \
  7188fc363630916deb702c7fdcf4e481b751f97a \
  e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81; do
  curl -fsSL -H 'Accept: application/vnd.github+json' \
    "https://api.github.com/repos/github/codeql-action/commits/${sha}" |
    python3 -c 'import sys,json; d=json.load(sys.stdin); print(d.get("sha"), d.get("commit",{}).get("message","").splitlines()[0])'
done

Repository: Xquik-dev/x-twitter-scraper-ruby

Length of output: 2119

🌐 Web query:

GitHub CodeQL Action documentation mixed versions init analyze same version unsupported

💡 Result:

Mixing different versions of the GitHub CodeQL Action in the same workflow is unsupported and can lead to unpredictable results [1][2]. According to the official CodeQL Action documentation and changelogs, the following mechanisms are in place to manage this requirement: 1. Warning Mechanism: The codeql-action/init step will emit a warning if it detects that different versions of the CodeQL Action are being used across different steps in the same workflow file [1][3]. 2. Error Mechanism: Subsequent CodeQL Action steps (such as analyze) will throw an error if they attempt to load a configuration file that was generated by a different version of the codeql-action/init step [1][4]. To ensure consistent behavior, it is recommended to reference the CodeQL Action using a consistent major version tag (e.g., v4) across all steps in your workflow [5]. This ensures that your workflow automatically picks up the latest release within that major version, maintaining consistency while allowing for necessary updates [5].

Citations:

🏁 Script executed:

#!/bin/bash
set -eu
printf '%s\n' '--- CodeQL action documentation references ---'
for url in \
  'https://raw.githubusercontent.com/github/codeql-action/main/README.md' \
  'https://raw.githubusercontent.com/github/codeql-action/main/CHANGELOG.md'; do
  echo "$url"
  curl -fsSL "$url" | grep -Ein -C 3 'same version|version.*same|mixed|init.*analy|analy.*init|unsupported' | head -80 || true
done
printf '%s\n' '--- v4.37.3 release tree ---'
curl -fsSL -H 'Accept: application/vnd.github+json' \
  'https://api.github.com/repos/github/codeql-action/git/trees/e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81?recursive=1' |
  python3 -c 'import sys,json; d=json.load(sys.stdin); print("\n".join(x["path"] for x in d.get("tree",[]) if x["path"] in ("init/action.yml","analyze/action.yml","README.md","CHANGELOG.md")))'

Repository: Xquik-dev/x-twitter-scraper-ruby

Length of output: 11220

Use one CodeQL Action release in the workflow.

Line 29 uses v4.37.1, while line 36 uses v4.37.3. Mixed versions are unsupported and can produce warnings or unpredictable results. Update init to the v4.37.3 commit.

Proposed fix 
-        uses: github/codeql-action/init@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1
+        uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/codeql.yml at line 36, Align the CodeQL action versions in
the workflow by updating the `init` step to use the same v4.37.3 commit already
used by `analyze`, while preserving the existing pinned-action format.

Loading