Repository navigation
ci(deps): bump github/codeql-action/analyze from 4.37.1 to 4.37.4 - #83
dependabot[bot] wants to merge 1 commit into
Conversation
dependabot
Bot
added
dependencies
|
Important Review skippedBot user detected. To trigger a single review, invoke the ⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
📝 WalkthroughSummary by CodeRabbit
WalkthroughThe CodeQL GitHub Actions workflow updates the ChangesCodeQL workflow
Estimated code review effort: 1 (Trivial) | ~2 minutes Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Up to standards ✅🟢 Issues
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/codeql.yml:
- Line 50: Update the github/codeql-action/init step in the CodeQL workflow to
use the same v4.37.1 release pin as github/codeql-action/analyze, preserving the
existing commit-hash pinning style and matching version comment.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 98535a14-c7fb-47c4-8ead-5b432b3986f1
📒 Files selected for processing (1)
.github/workflows/codeql.yml
📜 Review details
⏰ Context from checks skipped due to timeout. (15)
- GitHub Check: Build Documentation
- GitHub Check: Codacy Static Code Analysis
- GitHub Check: Test Suite (windows-latest, beta)
- GitHub Check: Test Suite (ubuntu-latest, 1.95.0)
- GitHub Check: Test Suite (macos-latest, beta)
- GitHub Check: Test Suite (ubuntu-latest, beta)
- GitHub Check: Test Suite (ubuntu-latest, stable)
- GitHub Check: Test Suite (macos-latest, stable)
- GitHub Check: Analyze (rust)
- GitHub Check: Examples
- GitHub Check: Test Suite (windows-latest, stable)
- GitHub Check: Feature Combinations
- GitHub Check: Code Coverage
- GitHub Check: Security Audit
- GitHub Check: Cargo Deny
🧰 Additional context used
🧠 Learnings (1)
📚 Learning: 2026-07-19T20:04:20.293Z
Learnt from: wroersma
Repo: ThreatFlux/FluxPrompt PR: 73
File: .github/workflows/ci.yml:25-25
Timestamp: 2026-07-19T20:04:20.293Z
Learning: In FluxPrompt GitHub Actions workflows, any `actions/checkout` step used by a job that is read-only (no `git push`, no tag/release publishing) must set `persist-credentials: false` to avoid persisting credentials in the runner git config. Exception: jobs that intentionally push to the origin to publish (e.g., `auto-release.yml` → `create-release`, which runs `git push origin`) may use the default credentials behavior because pushing requires it; ensure genuinely read-only jobs (e.g., the `version-check` job) still set `persist-credentials: false`.
Applied to files:
.github/workflows/codeql.yml
|
|
||
| - name: Perform CodeQL Analysis | ||
| uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2 | ||
| uses: github/codeql-action/analyze@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1 |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== workflow excerpt =="
nl -ba .github/workflows/codeql.yml | sed -n '1,120p'
echo
echo "== codeql-action version references in workflow =="
rg -n "codeql-action/(init|analyze)@" .github/workflows/codeql.yml
echo
echo "== changelog mentions of mixed versions =="
python3 - <<'PY'
import urllib.request, ssl, re
url = "https://raw.githubusercontent.com/github/codeql-action/main/CHANGELOG.md"
ctx = ssl.create_default_context()
text = urllib.request.urlopen(url, context=ctx, timeout=20).read().decode()
for pat in [r"mixed versions", r"same version", r"init.*analyze", r"unsupported"]:
print(f"\n-- matches for {pat!r} --")
for m in re.finditer(pat, text, re.I):
start = max(0, m.start()-200)
end = min(len(text), m.end()+400)
print(text[start:end].replace("\r",""))
print("\n---")
break
PYRepository: ThreatFlux/FluxPrompt
Length of output: 222
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== workflow excerpt =="
cat -n .github/workflows/codeql.yml | sed -n '1,120p'
echo
echo "== codeql-action version references in workflow =="
rg -n "codeql-action/(init|analyze)@" .github/workflows/codeql.yml
echo
echo "== changelog guidance from github/codeql-action =="
python3 - <<'PY'
import urllib.request, ssl, re
url = "https://raw.githubusercontent.com/github/codeql-action/main/CHANGELOG.md"
ctx = ssl.create_default_context()
text = urllib.request.urlopen(url, context=ctx, timeout=20).read().decode()
patterns = [
r"mixed versions",
r"same version",
r"init.*analyze",
r"unsupported",
]
for pat in patterns:
print(f"\n-- matches for {pat!r} --")
m = re.search(pat, text, re.I | re.S)
if not m:
print("no match")
continue
start = max(0, m.start() - 250)
end = min(len(text), m.end() + 500)
print(text[start:end].replace("\r", ""))
PYRepository: ThreatFlux/FluxPrompt
Length of output: 4648
🌐 Web query:
CodeQL action init analyze same version mixing versions unsupported changelog
💡 Result:
Mixing different versions of the CodeQL Action within the same GitHub Actions workflow is unsupported and can lead to unpredictable results [1][2][3]. The CodeQL Action includes validation logic to detect such inconsistencies [1]. When different versions of the CodeQL Action are used across steps in a single workflow: - The codeql-action/init step will emit a warning if it detects that different versions of the Action are being used in the workflow file [1][3]. - Subsequent CodeQL Action steps (such as analyze) will throw an error if they attempt to load a configuration file generated by a different version of the codeql-action/init step [1][3]. To ensure stable operation, it is recommended to reference the CodeQL Action using a major version tag (e.g., v4) [4][5]. This practice ensures that your workflow automatically receives the latest releases, including necessary bug fixes and CLI updates, while maintaining internal consistency across your steps [4]. If you choose to pin to a specific commit SHA or patch version, you are responsible for keeping those references updated—for example, by using Dependabot—to avoid potential compatibility issues or functionality loss as server-side features evolve [4][5].
Citations:
- 1: https://github.com/github/codeql-action/blob/main/CHANGELOG.md
- 2: https://github.com/github/codeql-action/blob/v4.31.8/CHANGELOG.md
- 3: https://github.com/github/codeql-action/blob/v4.31.9/CHANGELOG.md
- 4: https://github.com/github/codeql-action
- 5: docs: guidance on keeping the CodeQL Action up to date github/codeql-action#3499
Pin github/codeql-action/init to the same release as analyze. init is still on v4.36.2 while analyze is on v4.37.1; mixing CodeQL Action versions in one workflow is unsupported and can produce warnings or analysis errors.
Suggested change
- uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
+ uses: github/codeql-action/init@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/codeql.yml at line 50, Update the
github/codeql-action/init step in the CodeQL workflow to use the same v4.37.1
release pin as github/codeql-action/analyze, preserving the existing commit-hash
pinning style and matching version comment.
Bumps [github/codeql-action/analyze](https://github.com/github/codeql-action) from 4.37.1 to 4.37.4. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@7188fc3...f205ea1) --- updated-dependencies: - dependency-name: github/codeql-action/analyze dependency-version: 4.37.1 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
changed the title
f299a74 to
532cd2c
Compare
|
Superseded by #88. |
Bumps github/codeql-action/analyze from 4.37.1 to 4.37.4.
Release notes
Sourced from github/codeql-action/analyze's releases.
Changelog
Sourced from github/codeql-action/analyze's changelog.
... (truncated)
Commits
f205ea1Merge pull request #4053 from github/update-v4.37.4-9130ce0f7e40d079Update changelog for v4.37.49130ce0Merge pull request #4051 from github/update-bundle/codeql-bundle-v2.26.2c62d824Add changelog noteda0c190Update default bundle to codeql-bundle-v2.26.218420e3Merge pull request #4043 from github/mbg/ts/changelog7e8d897Merge pull request #4046 from github/mbg/repo-prop/code-quality2d4c474Log!analysisKindSupportedcase98c05a1Fix argument validation inrollback-changelog.ts8289a49Ignore repository property for unsupported analysis kinds