From 4a3ff1323c956c294dc01955d6603d526255f4b7 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 25 Aug 2026 23:07:41 +0000 Subject: [PATCH 01/10] build(deps): bump github/codeql-action/init from 4.37.0 to 4.37.8 Bumps [github/codeql-action/init](https://github.com/github/codeql-action) from 4.37.0 to 4.37.8. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/99df26d4f13ea111d4ec1a7dddef6063f76b97e9...db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28) --- updated-dependencies: - dependency-name: github/codeql-action/init dependency-version: 4.37.8 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] --- .github/workflows/codeql.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 27c5b540f..e3d704b52 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -32,7 +32,7 @@ jobs: - python steps: - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - - uses: github/codeql-action/init@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0 + - uses: github/codeql-action/init@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8 with: languages: ${{ matrix.language }} - uses: github/codeql-action/autobuild@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0 From 661afd39839c947569de5b1227f17a4c36e7c9e1 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 25 Aug 2026 18:16:05 -0700 Subject: [PATCH 02/10] test(codeql): require coordinated action versions --- .../test_codeql_action_version_contract.py | 23 +++++++++++++++++++ 1 file changed, 23 insertions(+) create mode 100644 services/analysis-engine/tests/test_codeql_action_version_contract.py diff --git a/services/analysis-engine/tests/test_codeql_action_version_contract.py b/services/analysis-engine/tests/test_codeql_action_version_contract.py new file mode 100644 index 000000000..2f4c69b0e --- /dev/null +++ b/services/analysis-engine/tests/test_codeql_action_version_contract.py @@ -0,0 +1,23 @@ +"""Regression contract for coordinated CodeQL Action component upgrades.""" + +from __future__ import annotations + +import re +from pathlib import Path + + +REPO_ROOT = Path(__file__).resolve().parents[3] +CODEQL_WORKFLOW = REPO_ROOT / ".github" / "workflows" / "codeql.yml" +CODEQL_ACTION_PATTERN = re.compile( + r"github/codeql-action/(?:init|autobuild|analyze)@([0-9a-f]{40})\s+#\s+(v[0-9.]+)" +) + + +def test_codeql_job_uses_one_action_release() -> None: + """Require init, autobuild, and analyze to use one reviewed CodeQL release.""" + workflow = CODEQL_WORKFLOW.read_text(encoding="utf-8") + action_refs = CODEQL_ACTION_PATTERN.findall(workflow) + + assert len(action_refs) == 3 + assert len({sha for sha, _version in action_refs}) == 1 + assert len({version for _sha, version in action_refs}) == 1 From 9532f27b4fc711e198f944e982669eba184519c2 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 25 Aug 2026 18:16:20 -0700 Subject: [PATCH 03/10] fix(codeql): keep action components aligned --- .github/workflows/codeql.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index e3d704b52..54616541d 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -35,5 +35,5 @@ jobs: - uses: github/codeql-action/init@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8 with: languages: ${{ matrix.language }} - - uses: github/codeql-action/autobuild@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0 - - uses: github/codeql-action/analyze@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0 + - uses: github/codeql-action/autobuild@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8 + - uses: github/codeql-action/analyze@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8 From ffcc758f5868d23045619ef498853c69a0c8b9e5 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 25 Aug 2026 19:13:27 -0700 Subject: [PATCH 04/10] test(codeql): require coordinated SARIF uploader release --- ...st_codeql_upload_sarif_version_contract.py | 24 +++++++++++++++++++ 1 file changed, 24 insertions(+) create mode 100644 services/analysis-engine/tests/test_codeql_upload_sarif_version_contract.py diff --git a/services/analysis-engine/tests/test_codeql_upload_sarif_version_contract.py b/services/analysis-engine/tests/test_codeql_upload_sarif_version_contract.py new file mode 100644 index 000000000..17419ea6b --- /dev/null +++ b/services/analysis-engine/tests/test_codeql_upload_sarif_version_contract.py @@ -0,0 +1,24 @@ +"""Regression contracts for CodeQL SARIF uploader provenance comments.""" + +from __future__ import annotations + +from pathlib import Path + + +REPO_ROOT = Path(__file__).resolve().parents[3] +EXPECTED_SHA = "db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28" +EXPECTED_VERSION = "v4.37.8" +UPLOAD_SARIF_REF = ( + f"github/codeql-action/upload-sarif@{EXPECTED_SHA} # {EXPECTED_VERSION} peeled commit;" +) +WORKFLOWS = ( + REPO_ROOT / ".github" / "workflows" / "ossf-scorecard.yml", + REPO_ROOT / ".github" / "workflows" / "trivy.yml", +) + + +def test_upload_sarif_sha_and_version_comment_move_together() -> None: + """Keep each immutable SARIF uploader pin paired with its reviewed release label.""" + for workflow in WORKFLOWS: + contents = workflow.read_text(encoding="utf-8") + assert contents.count(UPLOAD_SARIF_REF) == 1 From b8c1d1d2ba0fc52c8af91951b9915c21078a82d9 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 25 Aug 2026 19:13:53 -0700 Subject: [PATCH 05/10] fix(codeql): align Scorecard SARIF uploader release --- .github/workflows/ossf-scorecard.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ossf-scorecard.yml b/.github/workflows/ossf-scorecard.yml index 2a4b6eaa9..a66720ee9 100644 --- a/.github/workflows/ossf-scorecard.yml +++ b/.github/workflows/ossf-scorecard.yml @@ -79,6 +79,6 @@ jobs: python3 trusted-scorecard-scripts/scripts/checks/normalize_scorecard_sarif.py scorecard-sarif/results.sarif normalized-scorecard-results.sarif - - uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0 peeled commit; SHA pinning retained as supply-chain attack mitigation. + - uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8 peeled commit; SHA pinning retained as supply-chain attack mitigation. with: sarif_file: normalized-scorecard-results.sarif From 871ac355c059c78a2456d4d26e384225f7461ba2 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 25 Aug 2026 19:14:18 -0700 Subject: [PATCH 06/10] fix(codeql): align Trivy SARIF uploader release --- .github/workflows/trivy.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/trivy.yml b/.github/workflows/trivy.yml index d79ec32e1..db6c3db87 100644 --- a/.github/workflows/trivy.yml +++ b/.github/workflows/trivy.yml @@ -48,7 +48,7 @@ jobs: skip-dirs: 'services/analysis-engine/.venv' trivyignores: ./.trivyignore - name: Upload Trivy scan results to GitHub Security tab - uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0 peeled commit; SHA pinning retained as supply-chain attack mitigation. + uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8 peeled commit; SHA pinning retained as supply-chain attack mitigation. if: always() with: sarif_file: trivy-results.sarif From d2b70979dc9dba3e2fe486a09e5151b1a91d6610 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 25 Aug 2026 19:16:37 -0700 Subject: [PATCH 07/10] test(dependabot): require existing CI/CD label --- .../tests/test_dependabot_label_contract.py | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) create mode 100644 services/analysis-engine/tests/test_dependabot_label_contract.py diff --git a/services/analysis-engine/tests/test_dependabot_label_contract.py b/services/analysis-engine/tests/test_dependabot_label_contract.py new file mode 100644 index 000000000..4bec93429 --- /dev/null +++ b/services/analysis-engine/tests/test_dependabot_label_contract.py @@ -0,0 +1,18 @@ +"""Regression contract for Dependabot's configured repository labels.""" + +from __future__ import annotations + +from pathlib import Path + + +REPO_ROOT = Path(__file__).resolve().parents[3] +DEPENDABOT_CONFIG = REPO_ROOT / ".github" / "dependabot.yml" + + +def test_github_actions_updates_use_repository_ci_cd_taxonomy() -> None: + """Keep GitHub Actions updates on an existing CI/CD taxonomy label.""" + config = DEPENDABOT_CONFIG.read_text(encoding="utf-8") + github_actions = config.split('package-ecosystem: "github-actions"', maxsplit=1)[1] + + assert '- "area: ci-cd"' in github_actions + assert '- "github-actions"' not in github_actions From 9fc32ab18ce12a78a558de15af004070a7d01fd6 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 25 Aug 2026 19:16:51 -0700 Subject: [PATCH 08/10] fix(dependabot): use existing CI/CD label --- .github/dependabot.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 2df162d89..8221219aa 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -38,4 +38,4 @@ updates: open-pull-requests-limit: 10 labels: - "dependencies" - - "github-actions" + - "area: ci-cd" From 481766c51f70fc0583bf68462d6ad3ca49e4451c Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 25 Aug 2026 19:39:17 -0700 Subject: [PATCH 09/10] fix(codeql): normalize contract import spacing --- .../analysis-engine/tests/test_codeql_action_version_contract.py | 1 - 1 file changed, 1 deletion(-) diff --git a/services/analysis-engine/tests/test_codeql_action_version_contract.py b/services/analysis-engine/tests/test_codeql_action_version_contract.py index 2f4c69b0e..6e225686d 100644 --- a/services/analysis-engine/tests/test_codeql_action_version_contract.py +++ b/services/analysis-engine/tests/test_codeql_action_version_contract.py @@ -5,7 +5,6 @@ import re from pathlib import Path - REPO_ROOT = Path(__file__).resolve().parents[3] CODEQL_WORKFLOW = REPO_ROOT / ".github" / "workflows" / "codeql.yml" CODEQL_ACTION_PATTERN = re.compile( From 19484ed5f1d444f5aa9d001523c9762976012316 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 25 Aug 2026 19:39:38 -0700 Subject: [PATCH 10/10] fix(codeql): normalize SARIF contract spacing --- .../tests/test_codeql_upload_sarif_version_contract.py | 1 - 1 file changed, 1 deletion(-) diff --git a/services/analysis-engine/tests/test_codeql_upload_sarif_version_contract.py b/services/analysis-engine/tests/test_codeql_upload_sarif_version_contract.py index 17419ea6b..523c548b1 100644 --- a/services/analysis-engine/tests/test_codeql_upload_sarif_version_contract.py +++ b/services/analysis-engine/tests/test_codeql_upload_sarif_version_contract.py @@ -4,7 +4,6 @@ from pathlib import Path - REPO_ROOT = Path(__file__).resolve().parents[3] EXPECTED_SHA = "db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28" EXPECTED_VERSION = "v4.37.8"