Skip to content

build(deps): bump github/codeql-action/autobuild from 4.37.0 to 4.37.8 #1029

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
dependabot wants to merge 1 commit into from
Closed

build(deps): bump github/codeql-action/autobuild from 4.37.0 to 4.37.8 #1029

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/codeql.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,5 +35,5 @@ jobs:
- uses: github/codeql-action/init@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
with:
languages: ${{ matrix.language }}
- uses: github/codeql-action/autobuild@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
- uses: github/codeql-action/autobuild@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8

@devin-ai-integration devin-ai-integration Bot Aug 25, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 CodeQL action steps left on mismatched versions

The autobuild step is bumped to v4.37.8 while init and analyze stay pinned at v4.37.0. The CodeQL Action requires all three steps to run the same release, so this mix can break the analysis job.

Prompt for agents 
The codeql.yml workflow uses github/codeql-action init, autobuild, and analyze. This PR bumped only autobuild to v4.37.8 (SHA db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28) while init and analyze remain on v4.37.0 (SHA 99df26d4f13ea111d4ec1a7dddef6063f76b97e9). The CodeQL Action expects all of its sub-actions to be from the same release; mismatched versions are unsupported and can cause the analysis to fail. Update init and analyze to the same v4.37.8 SHA so all three steps stay in sync.
Open in Devin Review

Was this helpful? React with 👍 or 👎 to provide feedback.

- uses: github/codeql-action/analyze@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
Loading