Repository navigation
ci: bump the CodeQL actions to v4.39.1 together and group their Dependabot updates - #2727
Merged
Merged
Conversation
This was referenced Oct 20, 2026
…dabot updates Dependabot opened one PR per CodeQL action (#2504 init, #2505 analyze, #2506 upload-sarif), each moving to 4.38.2. Merging them one at a time would leave init and analyze on different versions in between. This moves all three to v4.39.0 (6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee, the commit the v4.39.0 tag points to) in one change, and adds a Dependabot group so future CodeQL Action updates arrive as a single PR. Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
DeusData
force-pushed
the
chore/codeql-action-v4.39.0
branch
from
October 20, 2026 22:34
54c1bfa to
0b81154
Compare
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
Owner
Author
|
Refreshed this branch with current main to pick up the shared CI repairs. The merge was conflict-free, and the action-pin/Dependabot patch is unchanged (verified with a stable patch ID). Fresh required GitHub checks are running. Thanks for reviewing! |
Conflict in .github/workflows/scorecard.yml resolved to the main version: main already pins upload-sarif to 9b3254085494b55a0f7c4c2b3d2d52cc712ce370 (v4.39.1, #2779), which supersedes this branch's v4.39.0 pin. Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
Main already moved upload-sarif to v4.39.1 (#2779). Move init and analyze to the same commit, 9b3254085494b55a0f7c4c2b3d2d52cc712ce370 (the commit the v4.39.1 tag points to), so all three CodeQL actions run one version again. The pin comment follows the form Dependabot wrote for upload-sarif. The codeql-action Dependabot group added earlier on this branch keeps the three in lockstep from here on. Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps all three CodeQL Action steps to v4.39.1 and groups future CodeQL Action updates in Dependabot.
.github/workflows/codeql.yml:initandanalyze->9b3254085494b55a0f7c4c2b3d2d52cc712ce370(v4.39.1, resolved from the v4.39.1 tag object; was1c5b675v4.38.1)..github/workflows/scorecard.yml:upload-sarifis already on that commit on main (build(deps): Bump github/codeql-action/upload-sarif from 4.38.1 to 4.39.1 #2779), so this PR no longer changes the file..github/dependabot.yml: acodeql-actiongroup (github/codeql-action*), soinit,analyzeandupload-sarifarrive as one PR and stay in lockstep.Why:
initandanalyzemust run the same CodeQL Action version within a job. Dependabot opens one PR per action, and merged one at a time they leave the actions on different versions in between. That already happened for v4.39.1:upload-sariflanded alone in #2779, and #2780 would move onlyinit. This change puts all three on v4.39.1 together, and the group keeps them together from here on.Supersedes #2780 (init-only bump to 4.39.1) and, as before, the split bumps #2504, #2505 and #2506.
Notes:
6f2ac81was replaced before merge).scorecard.yml, resolved to main's v4.39.1 pin.test-uifailure came from the old base: the Galaxy reader-focus test caught a stale focus note shown while the layout was still arranging, which main fixed in fix(ui): hide stale focus warning while arranging graph #2753. This PR does not touchgraph-ui.Checks run locally: YAML parse of the touched files, the Dependabot group matches exactly the three CodeQL actions, every remote
uses:is pinned to a full commit SHA (scripts/security-audit.shpasses), and the workflow contract tests (venue parity, lane wiring, lane selection, release gate chain, smoke fixture, security gate fail-closed, Windows bundle, coverage map) pass.