From 5a295154425ab98a8b5b2e6bb61e9e7894cbd547 Mon Sep 17 00:00:00 2001 From: bgard68 <30295154+bgard68@users.noreply.github.com> Date: Mon, 17 Aug 2026 08:02:22 -0500 Subject: [PATCH] build(deps): move every codeql-action to 4.37.7 in one commit MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Supersedes #100 and #103, which cannot pass individually and never could. codeql-action requires init, analyze and upload-sarif to run the same version; mixing them fails with "Loaded a configuration file for version X, but running version Y". Dependabot opens one pull request per sub-action, so each of those pull requests creates exactly that mismatch on its own branch: #100 moves init while analyze stays behind, #103 moves analyze while init stays behind. Both are red for the same reason, and rebasing cannot help — the conflict is between the change and the rest of the file, not between the branch and its base. They also have to land together to be correct, and two pull requests cannot. upload-sarif reached 4.37.7 when #94 and #95 merged, leaving init and analyze on 4.37.4 in codeql.yml. That combination is fine — codeql.yml has no upload-sarif step, so nothing mismatched inside a single workflow and CodeQL has stayed green on main throughout. It is only a problem once one of the two in codeql.yml moves without the other, which is precisely what those pull requests do. So both move here, to the version upload-sarif already runs. Every codeql-action reference in the repository is now the one SHA: init f205ea1c -> ff2f1c62 analyze f205ea1c -> ff2f1c62 upload-sarif ff2f1c62 (unchanged, already 4.37.7) Co-Authored-By: Claude Opus 5 --- .github/workflows/codeql.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index e8f4fe8..f537cf8 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -47,7 +47,7 @@ jobs: dotnet-version: '10.x' - name: Initialize CodeQL - uses: github/codeql-action/init@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4 + uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4 with: languages: csharp # security-and-quality is a superset of the default security queries. cs/log-forging @@ -59,6 +59,6 @@ jobs: run: dotnet build TodoApp.sln --configuration Release - name: Perform CodeQL analysis - uses: github/codeql-action/analyze@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4 + uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4 with: category: '/language:csharp'