build(deps): bump github/codeql-action/analyze from 4.37.1 to 4.37.6 - #16
build(deps): bump github/codeql-action/analyze from 4.37.1 to 4.37.6#16dependabot[bot] wants to merge 1 commit into
Conversation
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
📝 WalkthroughWalkthroughThe CodeQL workflow now uses the pinned v4.37.3 action commit for analysis instead of v4.37.1. ChangesCodeQL workflow update
Estimated code review effort: 1 (Trivial) | ~2 minutes Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/codeql.yml:
- Line 40: Align the CodeQL Action versions in the workflow by updating the
analyze step’s uses reference to match the v4.37.1 release already used by init,
including its pinned commit and version comment.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 5f64f3aa-64be-42c0-bcdf-174398a2a8c6
📒 Files selected for processing (1)
.github/workflows/codeql.yml
|
|
||
| - name: Analyze | ||
| uses: github/codeql-action/analyze@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1 | ||
| uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3 |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
versions="$(
sed -nE 's/.*github\/codeql-action\/[^@]+@[^ ]+ # (v[^ ]+).*/\1/p' \
.github/workflows/codeql.yml | sort -u
)"
test "$(printf '%s\n' "$versions" | sed '/^$/d' | wc -l)" -eq 1Repository: Xquik-dev/xquik-haystack
Length of output: 162
🏁 Script executed:
set -euo pipefail
printf '%s\n' '--- workflow ---'
sed -n '1,100p' .github/workflows/codeql.yml
printf '%s\n' '--- CodeQL action references ---'
rg -n 'github/codeql-action/(init|autobuild|manual-build|analyze|upload-sarif)@' .github/workflows
printf '%s\n' '--- tag resolution ---'
python3 - <<'PY'
import json, urllib.request
repo = "github/codeql-action"
for tag in ("v4.37.1", "v4.37.3"):
url = f"https://api.github.com/repos/{repo}/git/ref/tags/{tag}"
with urllib.request.urlopen(url) as response:
ref = json.load(response)["object"]
print(tag, "ref_object_type=", ref["type"], "ref_object_sha=", ref["sha"])
if ref["type"] == "tag":
with urllib.request.urlopen(
f"https://api.github.com/repos/{repo}/git/tags/{ref['sha']}"
) as response:
target = json.load(response)["object"]
print(tag, "dereferenced_type=", target["type"], "commit_sha=", target["sha"])
else:
print(tag, "commit_sha=", ref["sha"])
PYRepository: Xquik-dev/xquik-haystack
Length of output: 3843
🏁 Script executed:
set -euo pipefail
api() {
curl -fsSLk -H 'Accept: application/vnd.github+json' \
-H 'X-GitHub-Api-Version: 2022-11-28' "$1"
}
for tag in v4.37.1 v4.37.3; do
ref="$(api "https://api.github.com/repos/github/codeql-action/git/ref/tags/$tag")"
type="$(printf '%s' "$ref" | jq -r '.object.type')"
object_sha="$(printf '%s' "$ref" | jq -r '.object.sha')"
if [ "$type" = tag ]; then
target="$(api "https://api.github.com/repos/github/codeql-action/git/tags/$object_sha" | jq -r '.object.sha')"
else
target="$object_sha"
fi
commit="$(api "https://api.github.com/repos/github/codeql-action/commits/$target" | jq -r '.sha')"
printf '%s ref_type=%s ref_object=%s commit=%s\n' "$tag" "$type" "$object_sha" "$commit"
done
printf '%s\n' '--- repository guidance references ---'
curl -fsSLk https://raw.githubusercontent.com/github/codeql-action/main/README.md |
rg -n -i 'version|same|init|analy' | head -30 || trueRepository: Xquik-dev/xquik-haystack
Length of output: 264
🌐 Web query:
github codeql-action v4.37.3 v4.37.1 mixed versions init analyze same release supported
💡 Result:
Mixing different versions of the CodeQL Action within the same workflow is unsupported and explicitly discouraged [1][2]. Doing so can lead to unpredictable results [1][2]. The CodeQL Action includes built-in validation to detect if multiple versions are being used in a single workflow file [1]. Specifically: 1. The codeql-action/init step will emit a warning if it detects that different versions of the CodeQL Action are present in the workflow [1][2]. 2. Subsequent CodeQL Action steps (such as analyze) will throw an error if they attempt to load a configuration file that was generated by a different version of the init step [1][2]. To ensure a stable and supported configuration, you should use the same version tag or commit SHA for all CodeQL Action steps (init, autobuild, analyze, etc.) in your workflow [3][4]. For advanced setups, it is recommended to reference the CodeQL Action using a major version tag (e.g., v4) to automatically receive updates, including bug fixes and compatibility improvements [3][4]. If you must pin to a specific version (such as v4.37.1 or v4.37.3), ensure that all steps in the workflow reference the identical version [3].
Citations:
- 1: https://github.com/github/codeql-action/blob/main/CHANGELOG.md
- 2: https://github.com/github/codeql-action/blob/3a7caafd7343453355360f8c336d6b653d6e2ceb/CHANGELOG.md
- 3: https://github.com/github/codeql-action
- 4: https://github.com/github/codeql-action/tree/refs/heads/main
Align the CodeQL Action versions.
init uses v4.37.1, while analyze uses v4.37.3. Use the same release for both steps. Mixed versions are unsupported and can cause warnings or analysis failures.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/codeql.yml at line 40, Align the CodeQL Action versions in
the workflow by updating the analyze step’s uses reference to match the v4.37.1
release already used by init, including its pinned commit and version comment.
Source: MCP tools
Bumps [github/codeql-action/analyze](https://github.com/github/codeql-action) from 4.37.1 to 4.37.6. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@7188fc3...5595cca) --- updated-dependencies: - dependency-name: github/codeql-action/analyze dependency-version: 4.37.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
changed the title
dd30caa to
d8ef982
Compare
|
Closed as superseded by the consolidated dependency update merged into the default branch. |
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
1 participant
Bumps github/codeql-action/analyze from 4.37.1 to 4.37.6.
Release notes
Sourced from github/codeql-action/analyze's releases.
Changelog
Sourced from github/codeql-action/analyze's changelog.
... (truncated)
Commits
5595ccaMerge pull request #4071 from github/update-v4.37.6-6a9359a1bec9c757Add change note for PR 407045c8742Update changelog for v4.37.66a9359aMerge pull request #4070 from github/mbg/remote-address/change-file-default065cdc0ChangeDEFAULT_CONFIG_FILE_NAMEf99dd5aMerge pull request #4066 from github/dependabot/npm_and_yarn/js-yaml-5.2.21804b21Merge pull request #4068 from github/mergeback/v4.37.5-to-main-d1ba80a13020a2fRebuild93c3a5aUpdate changelog and version after v4.37.5d1ba80aMerge pull request #4067 from github/update-v4.37.5-1cd4d01d5