Skip to content

chore(deps): bump github/codeql-action/analyze from 4.37.0 to 4.37.8 #1306

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
dependabot wants to merge 1 commit into
base: main
Choose a base branch
from
+3 −3
Open

chore(deps): bump github/codeql-action/analyze from 4.37.0 to 4.37.8 #1306

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions .github/workflows/codeql-pr.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -96,7 +96,7 @@ jobs:
build-mode: ${{ matrix.build-mode }}

- name: Perform CodeQL Analysis
uses: github/codeql-action/analyze@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
uses: github/codeql-action/analyze@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8

@devin-ai-integration devin-ai-integration Bot Aug 24, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔴 CodeQL init and analyze pinned to different versions

analyze was bumped to v4.37.8 while init stays at v4.37.0. CodeQL requires both to run the same version, and test_codeql_action_steps_use_one_version_per_workflow asserts a single ref per workflow, so analysis and the contract test both break.

Prompt for agents 
The analyze step was bumped to github/codeql-action/analyze@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 (v4.37.8) but the init steps at lines 93 and 200 still use github/codeql-action/init@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 (v4.37.0). CodeQL requires init and analyze to run the same version, and tests/test_codeql_pr_workflow_contract.py::test_codeql_action_steps_use_one_version_per_workflow asserts every codeql-action init/analyze/upload-sarif ref in a workflow resolves to a single SHA. Bump the two init steps in codeql-pr.yml to the matching v4.37.8 SHA so all refs agree.
Open in Devin Review

Was this helpful? React with 👍 or 👎 to provide feedback.

with:
category: "/language:${{ matrix.language }}"
upload: false
Expand Down Expand Up @@ -203,7 +203,7 @@ jobs:
build-mode: ${{ matrix.build-mode }}

- name: Perform CodeQL Analysis
uses: github/codeql-action/analyze@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
uses: github/codeql-action/analyze@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
with:
category: "/language:${{ matrix.language }}-merge"
upload: false
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/scheduled-security-scan.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -96,7 +96,7 @@ jobs:
build-mode: ${{ matrix.build-mode }}
- name: Perform CodeQL Analysis
continue-on-error: true
uses: github/codeql-action/analyze@d1ba80a13dd99fba24a470575428917156a28b43 # v4.37.5
uses: github/codeql-action/analyze@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8

@devin-ai-integration devin-ai-integration Bot Aug 24, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔴 CodeQL analyze version split from init and upload-sarif

analyze was bumped to v4.37.8 while init and upload-sarif stay at v4.37.5. CodeQL requires init and analyze to match, and test_codeql_action_steps_use_one_version_per_workflow asserts a single ref per workflow, so both analysis and the contract test break.

Prompt for agents 
The analyze step was bumped to github/codeql-action/analyze@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 (v4.37.8) but init (line 93) and upload-sarif (line 134) still use d1ba80a13dd99fba24a470575428917156a28b43 (v4.37.5). CodeQL requires init and analyze to run the same version, and tests/test_codeql_pr_workflow_contract.py::test_codeql_action_steps_use_one_version_per_workflow asserts a single codeql-action SHA per workflow. Bump init and upload-sarif in scheduled-security-scan.yml to the matching v4.37.8 SHA.
Open in Devin Review

Was this helpful? React with 👍 or 👎 to provide feedback.

with:
category: "/language:${{ matrix.language }}-scheduled"

Expand Down
Loading