build(deps): move every codeql-action to 4.37.7 in one commit - #118
Merged
Conversation
Supersedes #100 and #103, which cannot pass individually and never could. codeql-action requires init, analyze and upload-sarif to run the same version; mixing them fails with "Loaded a configuration file for version X, but running version Y". Dependabot opens one pull request per sub-action, so each of those pull requests creates exactly that mismatch on its own branch: #100 moves init while analyze stays behind, #103 moves analyze while init stays behind. Both are red for the same reason, and rebasing cannot help — the conflict is between the change and the rest of the file, not between the branch and its base. They also have to land together to be correct, and two pull requests cannot. upload-sarif reached 4.37.7 when #94 and #95 merged, leaving init and analyze on 4.37.4 in codeql.yml. That combination is fine — codeql.yml has no upload-sarif step, so nothing mismatched inside a single workflow and CodeQL has stayed green on main throughout. It is only a problem once one of the two in codeql.yml moves without the other, which is precisely what those pull requests do. So both move here, to the version upload-sarif already runs. Every codeql-action reference in the repository is now the one SHA: init f205ea1c -> ff2f1c62 analyze f205ea1c -> ff2f1c62 upload-sarif ff2f1c62 (unchanged, already 4.37.7) Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This was referenced Aug 17, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Supersedes #100 and #103. Closes the CodeQL half of the stuck Dependabot queue on
main.Why these cannot be separate pull requests
codeql-actionrequiresinit,analyzeandupload-sarifto run the same version. Mixing them fails with:Dependabot opens one pull request per sub-action, so each one creates exactly that mismatch on its own branch — #100 moves
initwhileanalyzestays behind, #103 movesanalyzewhileinitstays behind. Both are red for the same reason, and rebasing cannot fix either: the conflict is between the change and the rest of the file, not between the branch and its base. I confirmed that by re-running one and watching it fail identically.They also have to land together to be correct, and two pull requests cannot do that.
On the current state of main
upload-sarifreached 4.37.7 when #94 and #95 merged, leavinginitandanalyzeon 4.37.4. That combination is fine andmainis healthy —codeql.ymlhas noupload-sarifstep, so nothing mismatches inside a single workflow, and CodeQL has passed on every run since. It only becomes a problem when one of the two incodeql.ymlmoves without the other, which is precisely what those two pull requests each do.The change
Every
codeql-actionreference in the repository is now the one SHA:initf205ea1c(4.37.4)ff2f1c62(4.37.7)analyzef205ea1c(4.37.4)ff2f1c62(4.37.7)upload-sarifff2f1c62(4.37.7)Tag SHAs verified against
github/codeql-actionrather than taken from the pull request titles — note #103 is titled 4.37.6 but 4.37.7 is current, and4.37.6is5595ccaf, a different commit.dapperhas the same pair stuck (#98, #102) and gets the same treatment separately;frontendhas #96, #99 and #101, which are additionally blocked by unrelated CI breakage on that branch.🤖 Generated with Claude Code