From 9eb2e0b2ef86a3f905e89a716c225aa35ab7a363 Mon Sep 17 00:00:00 2001 From: Imran Siddique Date: Mon, 14 Sep 2026 12:24:19 -0700 Subject: [PATCH] chore(deps): bump github/codeql-action to v4.38.0 and group it All four action paths of one codeql-action release share a SHA, so bumping one path strands the siblings at v4.37.9 and CodeQL fails on the mismatch. The three in codeql.yml edit the same file, so the per-path PRs also conflict with each other. Bump all four together, and group github/codeql-action* so dependabot opens one PR per release. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_015QRxFm1Z1kE9iraPspwr7j --- .github/dependabot.yml | 4 ++++ .github/workflows/codeql.yml | 6 +++--- .github/workflows/scorecard.yml | 2 +- 3 files changed, 8 insertions(+), 4 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index eb38669..9fa93e3 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -17,3 +17,7 @@ updates: interval: "weekly" day: "monday" open-pull-requests-limit: 5 + groups: + codeql-action: + patterns: + - "github/codeql-action*" diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 6ceb403..8b261e5 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -28,15 +28,15 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Initialize CodeQL - uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9 + uses: github/codeql-action/init@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0 with: languages: python queries: +security-extended - name: Autobuild - uses: github/codeql-action/autobuild@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9 + uses: github/codeql-action/autobuild@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0 - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9 + uses: github/codeql-action/analyze@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0 with: category: /language:python diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 4245fdf..11f3c79 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -35,6 +35,6 @@ jobs: publish_results: false - name: Upload SARIF - uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9 + uses: github/codeql-action/upload-sarif@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0 with: sarif_file: scorecard-results.sarif