build(codeql): coordinate CodeQL Action 4.37.8 lifecycle - #1026
Draft
dependabot[bot] wants to merge 10 commits into
Draft
build(codeql): coordinate CodeQL Action 4.37.8 lifecycle#1026dependabot[bot] wants to merge 10 commits into
dependabot[bot] wants to merge 10 commits into
Conversation
Contributor
Author
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
dependabot
Bot
added
the
dependencies
dependabot
Bot
added
the
dependencies
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
seonghobae
marked this pull request as draft
August 25, 2026 18:19
Bumps [github/codeql-action/init](https://github.com/github/codeql-action) from 4.37.0 to 4.37.8. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@99df26d...db488dd) --- updated-dependencies: - dependency-name: github/codeql-action/init dependency-version: 4.37.8 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
force-pushed
the
dependabot/github_actions/develop/github/codeql-action/init-4.37.8
branch
from
August 25, 2026 23:07
4af856c to
4a3ff13
Compare
This was referenced Aug 26, 2026
seonghobae
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Canonicalize the BandScope CodeQL Action lifecycle on immutable v4.37.8 pin
db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28instead of landing phase-specific Dependabot updates independently.Current exact identity:
develop@7ad56cf0065d068ec6463d92726de4855a6e201d9fc32ab18ce12a78a558de15af004070a7d01fd6Coordinated lifecycle
This branch now keeps
github/codeql-action/init,autobuild, andanalyzeon the same v4.37.8 immutable SHA in.github/workflows/codeql.yml. It also absorbs the unique #1030upload-sarifwork so Scorecard and Trivy SARIF uploads use the same reviewed v4.37.8 immutable pin.test_codeql_action_version_contract.pyprotects the in-job init/autobuild/analyze lifecycle;test_codeql_upload_sarif_version_contract.pyprotects both SARIF uploader pins and their provenance comments. #1030 was closed unmerged only after these unique deltas were preserved here.Dependabot configuration repair
Dependabot reported that configured label
github-actionsdoes not exist. The GitHub Actions ecosystem now uses the repository's existing taxonomy labelarea: ci-cdalongsidedependencies, withtest_dependabot_label_contract.pypreventing regression to the invalid configured label.Verification contract
Every push invalidates predecessor evidence. Current repository workflows for this exact head have been dispatched and are not counted as success until terminal. Before leaving Draft or merging, refetch and require the unchanged exact head to pass all applicable repository and central protected-branch gates, including CI/build/release, CodeQL JS/TS and Python analysis, security/dependency/Trivy/OSV/Scorecard, SBOM/supply-chain, coverage-evidence, OpenCode, Noema and Strix as applicable. Require zero valid unresolved review findings and a qualifying independent non-author last-push approval. Queued, cancelled, skipped, predecessor-head, self/author, model-only or status-only evidence is not success.
Do not bypass protection, weaken a gate, replace immutable action pins with tags, or split the CodeQL lifecycle back into competing phase writers.
Relates to #966.