build(deps): bump github/codeql-action/init from 4.37.7 to 4.37.8 - #110
Closed
dependabot[bot] wants to merge 1 commit into
Closed
build(deps): bump github/codeql-action/init from 4.37.7 to 4.37.8#110dependabot[bot] wants to merge 1 commit into
dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [github/codeql-action/init](https://github.com/github/codeql-action) from 4.37.7 to 4.37.8. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@ff2f1c6...db488dd) --- updated-dependencies: - dependency-name: github/codeql-action/init dependency-version: 4.37.8 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
bgard68
added a commit
that referenced
this pull request
Aug 25, 2026
… feed bug that 500s /internal/refresh (#117) * build(deps): move both codeql-action steps to 4.37.8 in one commit Dependabot bumps init and analyze in separate PRs (#110, #114), but the two steps must run the same codeql-action version - a mismatched pair ends the Analyze job in a configuration error. Same consolidation #105 did for 4.37.7. Supersedes #110 and #114. * build: add coverlet.collector and Mvc.Testing, register Lottery.Api.Tests Coverage was not measurable at all - no collector was referenced by any test project. Adds coverlet.collector to all four, Microsoft.AspNetCore.Mvc.Testing for the new API integration tests, and the new project to the solution. * test(api): add the host factory and offline feed fakes Boots the real API over a throwaway SQLite file so migrations, seeding, routing and middleware are all exercised for real; only the live feeds and the timer-driven refresh loop are replaced, which keeps a test run offline. * test(api): endpoints, security headers, refresh gate, health check, refresh loop 66 tests over the four API source files that previously had none. * test(api): security headers, refresh key gate, health check, refresh loop * test(api): health check verdicts and the refresh loop on virtual time * ci: scope cleanup-runs' actions:write to its job, document CodeQL's grant GHA002 flagged both as excessive token permissions. cleanup-runs genuinely was - actions:write applied workflow-wide, so any job added later would inherit the ability to delete runs; it now sits on the one job that needs it. CodeQL's security-events:write is the floor rather than a convenience: code scanning has no read-only ingest path, so analyze cannot upload its SARIF without it. It was already job-scoped with the workflow default left read-only; the comment records why so the finding is not re-raised. * build: sync Lottery.Application.Tests lock file for coverlet.collector CI restores with --locked-mode, so the lock file has to carry the new reference or the restore fails NU1004. * build: sync test lock files for coverlet.collector CI restores with --locked-mode, so the lock files have to carry the new reference or the restore fails NU1004. Lottery.Api.Tests is a new project, so this is its initial lock file. * ci: close gate-integrity gaps and tighten workflow permissions Three checks could report success while proving nothing: era-check's live-feed validation exited 0 when the API was unreachable (no set -e, and [ "" -gt 0 ] returns 2, making the if false); gate-probes' third probe did not guard its setup or check that the failure was the planted one; and the Start API wait loops exit 0 whether or not the API came up. Also scopes deploy-api's id-token:write to its job, grants dependency-review the pull-requests:write its comment-summary-in-pr silently needed, passes API_BASE_URL through env instead of interpolating it into a run line, adds concurrency groups to the PR-triggered workflows, and stops gitleaks allowlisting package-lock.json wholesale (npm lock files can carry inline registry credentials in resolved URLs; only integrity hashes are excluded now). Adds coverlet.runsettings so coverage measures our code rather than the thousands of generated OpenAPI lines nothing we write can cover. * ci: close gate-integrity gaps and tighten workflow permissions Three checks could report success while proving nothing: era-check's live-feed validation exited 0 when the API was unreachable (no set -e, and [ "" -gt 0 ] returns 2, making the if false); gate-probes' third probe did not guard its setup or check that the failure was the planted one; and the Start API wait loops exit 0 whether or not the API came up. Also scopes deploy-api's id-token:write to its job, grants dependency-review the pull-requests:write its comment-summary-in-pr silently needed, passes API_BASE_URL through env instead of interpolating it into a run line, adds concurrency groups to the PR-triggered workflows, and stops gitleaks allowlisting package-lock.json wholesale (npm lock files can carry inline registry credentials in resolved URLs; only integrity hashes are excluded now). Adds coverlet.runsettings so coverage measures our code rather than the thousands of generated OpenAPI lines nothing we write can cover. * build(deps): stop Dependabot re-proposing three PRs that cannot merge #116, #111 and #109 each bump a package that a peer or framework constraint caps, so every one fails before its tests run and is re-proposed the next week: * Microsoft.OpenApi 3.x - AspNetCore.OpenApi 10.0.x requires >= 2.7.5 && < 3.0.0, so the restore trips NU1608, which Directory.Build.props promotes to an error. This is the constraint #107 pinned 2.x for. * typescript 7.x - @angular/build 22.x has peer typescript >= 6.0 < 6.1. * jasmine-core 7.x - karma-jasmine-html-reporter 2.2 peers ^4 || ^5 || ^6. Each ignore is scoped to semver-major and carries the condition for lifting it, so minor and patch updates - security ones included - keep flowing. Also adds the missing nuget entry for the frontend branch: that branch carries src/Lottery.Api and its CI builds it, but the existing nuget entry has no target-branch, so those packages were never bumped or scanned. * docs(tests): document Lottery.Api.Tests and the coverage settings The README still said "109 tests across three projects". Adds the API layer's 66 tests and a note on coverlet.runsettings, which excludes the OpenAPI generator's output so the coverage figure measures our own code. * test(domain): cover Draw, RuleEra bounds, PrizeTier and the unknown-Game guards * test(application): cover the jackpot-refresh and result-mapping paths * test(infrastructure): cover the feeds, the import ledger and the DI wiring * test(infrastructure): cover the feeds, the import ledger and the DI wiring * fix(feeds): stop parse failures 500ing /internal/refresh MegaMillionsJackpotFeed's own summary promises "any shape change degrades to null rather than throwing", and both sibling jackpot feeds guard HttpRequestException and JsonException. This one guarded nothing: XDocument.Parse throws XmlException on a non-XML body and Deserialize throws JsonException on a truncated one. Neither type is matched by RefreshGame's catch filter, and CompositeJackpotFeed passes them straight through, so they escape RefreshGame.ExecuteAsync. /internal/refresh - the endpoint the keep-alive workflow calls - has no try/catch, so the request 500s and any game after the failing one is skipped. The trigger is the one this repo has already been bitten by: a bot-challenge HTML page served with a 200, which is what retired powerball.com's API. SocrataWinningNumbersFeed had the same escape by a different route. It still refuses the whole batch - a silently short batch would let gap-repair skip real draws - but now as InvalidOperationException with the cause kept, which is the type the caller already handles. The ten tests that pinned the previous behaviour now assert the corrected contract. 316 tests pass; coverage unchanged. * fix(feeds): restore the real MmPayload/MmJackpot shape The previous commit rewrote these DTOs while adding the exception guard. That was not part of the fix and it was wrong: the JSON property is Winners, not JackpotWinners, so deserialization would have silently produced a null winner count and lost the rollover flag. Restores the file to the tested version - the guard, and nothing else, changed. * fix(feeds): report Socrata parse failures as a handled feed error A malformed payload, or a row whose winning_numbers is short or non-numeric, escaped as JsonException / FormatException / ArgumentOutOfRangeException. None of those match RefreshGame's catch filter, so one bad row 500s /internal/refresh instead of being reported. The batch is still refused - delivering a silently short batch would let gap-repair skip real draws - but as InvalidOperationException with the cause kept, which is the type the caller already handles. * test(feeds): assert the corrected degradation contract These ten tests previously pinned the pre-fix behaviour, deliberately written so a fix would fail them loudly rather than pass silently. MegaMillions now degrades to null on a non-XML body, a truncated payload and a 5xx, matching its class comment and both sibling feeds; Socrata still refuses a batch containing a bad row but reports it as InvalidOperationException with the cause kept. * build: sync Lottery.Api.Tests lock file for OpenApi 2.12.2 #113 bumped Microsoft.OpenApi 2.12.0 -> 2.12.2 and regenerated the lock files that existed at the time. Lottery.Api.Tests is new on this branch, so its lock file still pinned 2.12.0 and locked-mode restore failed NU1004. Regenerated with dotnet restore --force-evaluate; no other lock file changed. Co-Authored-By: Claude <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AWkVh7cyAz1gWapBH1CY8n --------- Co-authored-by: Claude <noreply@anthropic.com>
Contributor
Author
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
dependabot
Bot
deleted the
dependabot/github_actions/github/codeql-action/init-4.37.8
branch
August 25, 2026 03:02
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps github/codeql-action/init from 4.37.7 to 4.37.8.
Release notes
Sourced from github/codeql-action/init's releases.
Changelog
Sourced from github/codeql-action/init's changelog.
... (truncated)
Commits
db488ddMerge pull request #4102 from github/update-v4.37.8-9ee088e131845f5bUpdate changelog for v4.37.89ee088eMerge pull request #4080 from github/henrymercer/studious-giggle1aef003Address review feedback on overlay disk flags508b83bMerge main into overlay minimum disk feature branchd97b342Merge pull request #4098 from github/mbg/permission-error-as-configuration-error47fa622MakeEACCESaConfigurationError45693ccRefactorENOSPCcheck intoisDiskConfigurationErrorfunctionc2fd8f5Merge pull request #4081 from github/mario-campos/version-cache-to-diskc56f48eLog unexpected conditions during caching CLI outputDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)