chore(deps): bump github/codeql-action from 3 to 4#38
Open
dependabot[bot] wants to merge 1 commit into
Open
Conversation
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3 to 4. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@v3...v4) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: '4' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
Contributor
📝 WalkthroughWalkthroughThis PR upgrades the CodeQL workflow configuration to use GitHub's ChangesCodeQL workflow version upgrade
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~2 minutes Possibly related PRs
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/codeql.yml:
- Line 32: Update the workflow to pin the CodeQL actions to the immutable SHA
instead of the floating tag: replace the uses references to
github/codeql-action/init@v4 and github/codeql-action/analyze@v4 with the exact
commit SHA a6fd1787519fd23e68309fad43738e41a6ff2a9d so the init and analyze
steps always run the pinned v4 commit; ensure both occurrences are updated
consistently.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 00d81d3a-e92e-47e8-976f-33882e18c5d6
📒 Files selected for processing (1)
.github/workflows/codeql.yml
|
|
||
| - name: Initialize CodeQL | ||
| uses: github/codeql-action/init@v3 | ||
| uses: github/codeql-action/init@v4 |
Contributor
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "Current workflow refs:"
rg -n 'uses:\s*(github/codeql-action/init@|github/codeql-action/analyze@)' .github/workflows/codeql.yml
echo
echo "Resolve current commit behind codeql-action v4 tag:"
git ls-remote https://github.com/github/codeql-action refs/tags/v4 | awk '{print "codeql-action v4 sha: "$1}'
echo
echo "After updating, verify refs are SHA-pinned (40 hex chars):"
rg -nP 'uses:\s*github/codeql-action/(init|analyze)@[a-f0-9]{40}\b' .github/workflows/codeql.ymlRepository: OpenDevFlow/md-latex
Length of output: 354
🏁 Script executed:
#!/bin/bash
set -euo pipefail
FILE=".github/workflows/codeql.yml"
echo "---- Relevant snippet ----"
nl -ba "$FILE" | sed -n '20,60p'
echo
echo "---- All github/codeql-action uses in this workflow ----"
rg -n 'uses:\s*github/codeql-action/' "$FILE"
echo
echo "---- Any unpinned uses for github/codeql-action/ (tags or branches) ----"
rg -n 'uses:\s*github/codeql-action/(init|analyze)@([^a-f0-9]{7,}|v4|V4|main|master|release|tags)' "$FILE" || trueRepository: OpenDevFlow/md-latex
Length of output: 152
🏁 Script executed:
#!/bin/bash
set -euo pipefail
FILE=".github/workflows/codeql.yml"
echo "File exists?"; test -f "$FILE" && echo "yes" || (echo "no"; exit 1)
echo
echo "---- Relevant snippet (around lines 25-45) ----"
cat -n "$FILE" | sed -n '25,45p'
echo
echo "---- All github/codeql-action uses in this workflow ----"
rg -n 'uses:\s*github/codeql-action/' "$FILE"
echo
echo "---- Any unpinned init/analyze uses (non-40hex) ----"
rg -nP 'uses:\s*github/codeql-action/(init|analyze)@[A-Za-z0-9_.-]+' "$FILE" || trueRepository: OpenDevFlow/md-latex
Length of output: 963
Pin CodeQL action refs to immutable SHAs.
.github/workflows/codeql.yml uses github/codeql-action/init@v4 (Line 32) and github/codeql-action/analyze@v4 (Line 37). Pin both to the v4 tag’s commit SHA a6fd1787519fd23e68309fad43738e41a6ff2a9d.
🔒 Suggested hardening
- uses: github/codeql-action/init@v4
+ uses: github/codeql-action/init@a6fd1787519fd23e68309fad43738e41a6ff2a9d # v4
...
- uses: github/codeql-action/analyze@v4
+ uses: github/codeql-action/analyze@a6fd1787519fd23e68309fad43738e41a6ff2a9d # v4🧰 Tools
🪛 zizmor (1.25.2)
[error] 32-32: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/codeql.yml at line 32, Update the workflow to pin the
CodeQL actions to the immutable SHA instead of the floating tag: replace the
uses references to github/codeql-action/init@v4 and
github/codeql-action/analyze@v4 with the exact commit SHA
a6fd1787519fd23e68309fad43738e41a6ff2a9d so the init and analyze steps always
run the pinned v4 commit; ensure both occurrences are updated consistently.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps github/codeql-action from 3 to 4.
Release notes
Sourced from github/codeql-action's releases.
... (truncated)
Changelog
Sourced from github/codeql-action's changelog.
... (truncated)
Commits
7211b7cMerge pull request #3927 from github/update-v4.36.0-ebc2d9e2b7740f2fUpdate changelog for v4.36.0ebc2d9eMerge pull request #3926 from github/update-bundle/codeql-bundle-v2.25.5d1f74b7Add changelog note2dc40ceUpdate default bundle to codeql-bundle-v2.25.58449852Merge pull request #3910 from github/henrymercer/repo-size-diff-check72ac23cUpdate excluded required check list14c1509Rebuild89c58e6Rebuilda0a8d16Bump ruby/setup-rubyDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)Summary by CodeRabbit