From 8a76fb1550710c771a591eb16b4c066e1beb84c4 Mon Sep 17 00:00:00 2001 From: Ntege Daniel Date: Wed, 30 Sep 2026 18:57:35 +0300 Subject: [PATCH] fix(ci): run one codeql-action release across init and analyze Dependabot bumped analyze (#491) and upload-sarif (#498) to v4.38.2, but the matching init bump (#497) was closed, so init still ran v4.38.1. CodeQL refuses a config written by another version, which fails every Analyze job on main and on open PRs. Pin init to v4.38.2 as well, correct the stale version comments, and group the codeql-action updates so Dependabot bumps them together. Signed-off-by: Ntege Daniel --- .github/dependabot.yml | 6 ++++++ .github/workflows/codeql.yml | 4 ++-- .github/workflows/scorecard.yml | 2 +- 3 files changed, 9 insertions(+), 3 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 76b299d45..6daec4de1 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -18,6 +18,12 @@ updates: interval: "weekly" reviewers: - exploreriii + groups: + # init, analyze and upload-sarif must run the same release: CodeQL + # refuses a config written by a different version, so bump them together. + codeql-action: + patterns: + - "github/codeql-action*" - package-ecosystem: docker directory: /.clusterfuzzlite diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 9526eae81..43e58337d 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -41,7 +41,7 @@ jobs: - name: Checkout repository uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Initialize CodeQL - uses: github/codeql-action/init@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.3.5 + uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2 with: languages: ${{ matrix.language }} build-mode: ${{ matrix.build-mode }} @@ -65,6 +65,6 @@ jobs: run: uv sync --frozen --all-extras --dev - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.3.5 + uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2 with: category: "/language:${{matrix.language}}" diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 57e598cad..e53220959 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -54,6 +54,6 @@ jobs: retention-days: 14 - name: Upload to code-scanning - uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.3.5 + uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2 with: sarif_file: results.sarif