chore(deps): bump github/codeql-action/init from 4.37.2 to 4.37.3 - #36
chore(deps): bump github/codeql-action/init from 4.37.2 to 4.37.3#36dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [github/codeql-action/init](https://github.com/github/codeql-action) from 4.37.2 to 4.37.3. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@e064762...e4fba86) --- updated-dependencies: - dependency-name: github/codeql-action/init dependency-version: 4.37.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
|
PR author is in the excluded authors list. |
📝 WalkthroughWalkthroughThe CodeQL workflow updates its initialization action from v4.37.2 to v4.37.3. ChangesCodeQL workflow update
Estimated code review effort: 1 (Trivial) | ~2 minutes Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/codeql.yml:
- Line 44: Update the CodeQL workflow’s analyze action to use commit
e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 (v4.37.3), matching the version already
used by the init action. Leave the init configuration unchanged.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: b55b39f4-a145-4758-842e-a6744bd231c5
📒 Files selected for processing (1)
.github/workflows/codeql.yml
|
|
||
| - name: Initialize CodeQL | ||
| uses: github/codeql-action/init@e0647621c2984b5ed2f768cb892365bf2a616ad1 # v4.37.2 | ||
| uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3 |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
rg -n 'uses:\s*github/codeql-action/(init|analyze|upload-sarif)@' .github/workflowsRepository: Xquik-dev/x-twitter-scraper-java
Length of output: 553
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
printf '%s\n' '--- workflow ---'
sed -n '35,60p' .github/workflows/codeql.yml
printf '%s\n' '--- CodeQL tag refs ---'
for tag in v4.37.2 v4.37.3; do
curl -fsSL "https://api.github.com/repos/github/codeql-action/git/refs/tags/${tag}" |
jq -r '"\(.ref): type=\(.object.type) sha=\(.object.sha)"'
done
printf '%s\n' '--- pinned commit metadata ---'
for sha in \
e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 \
e0647621c2984b5ed2f768cb892365bf2a616ad1
do
curl -fsSL "https://api.github.com/repos/github/codeql-action/commits/${sha}" |
jq -r '"\(.sha) \(.commit.message | split("\n")[0])"'
doneRepository: Xquik-dev/x-twitter-scraper-java
Length of output: 948
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
git ls-remote --refs https://github.com/github/codeql-action.git \
refs/tags/v4.37.2 \
refs/tags/v4.37.3
git ls-remote https://github.com/github/codeql-action.git \
refs/tags/v4.37.2^{} \
refs/tags/v4.37.3^{} \
e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 \
e0647621c2984b5ed2f768cb892365bf2a616ad1Repository: Xquik-dev/x-twitter-scraper-java
Length of output: 412
🌐 Web query:
GitHub CodeQL Action documentation all CodeQL Action steps same version init analyze
💡 Result:
It is required to use the same version of the CodeQL Action across all steps (such as init, analyze, etc.) within a single GitHub Actions workflow [1][2]. Mixing different versions of the CodeQL Action in the same workflow is unsupported and can lead to unpredictable results [1][3]. To ensure consistency and prevent errors: - Validation: The CodeQL Action emits a warning from the init step if it detects that different versions of the CodeQL Action are used within the same workflow [1][4]. - Errors: Other CodeQL Action steps will throw an error if they attempt to load a configuration file that was generated by a different version of the init step [1][5]. - Best Practice: Use a major version tag (e.g., v4) in your workflow file [6][7]. This allows your workflow to automatically receive updates, such as bug fixes, new features, and compatible CodeQL CLI versions, while maintaining the required version consistency across all steps [6][8]. If you find it necessary to pin to a specific version (such as a specific patch version or commit SHA) for advanced setups, you must ensure that every step in the workflow uses the exact same reference to avoid compatibility issues [6][7].
Citations:
- 1: https://github.com/github/codeql-action/blob/main/CHANGELOG.md
- 2: https://github.com/github/codeql-action/blob/fba78720cab61bc9326b24527e56282372bf34d3/CHANGELOG.md
- 3: https://github.com/github/codeql-action/blob/237b03b3c39378f30030532d92d4c6aae2c965d8/CHANGELOG.md
- 4: https://github.com/github/codeql-action/blob/v4.31.7/CHANGELOG.md
- 5: https://github.com/github/codeql-action/blob/817b68489e2171a0ccea4e5ddf8cb8150a443512/CHANGELOG.md
- 6: https://github.com/github/codeql-action
- 7: https://github.com/github/codeql-action/tree/refs/heads/main
- 8: https://pkg.go.dev/github.com/github/codeql-action
Align the CodeQL Action versions.
init and analyze must use the same release. Update analyze to commit e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 (v4.37.3).
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/codeql.yml at line 44, Update the CodeQL workflow’s
analyze action to use commit e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 (v4.37.3),
matching the version already used by the init action. Leave the init
configuration unchanged.
Bumps github/codeql-action/init from 4.37.2 to 4.37.3.
Release notes
Sourced from github/codeql-action/init's releases.
Changelog
Sourced from github/codeql-action/init's changelog.
... (truncated)
Commits
e4fba86Merge pull request #4031 from github/update-v4.37.3-72f6a9da0fb50ab5Update changelog for v4.37.372f6a9dMerge pull request #4030 from github/mbg/fix/no-proxy3b5ee58Use defaultrequestoptions instead ofundefinedbfb6be4Merge pull request #4028 from github/mergeback/v4.37.2-to-main-e0647621526ab84Rebuildd6217b9Update changelog and version after v4.37.2Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)Summary by cubic
Bump
github/codeql-action/initin the CodeQL workflow from v4.37.2 to v4.37.3 to keep security analysis up to date. Patch release with no behavior changes expected.Written for commit 5d17877. Summary will update on new commits.
Note
Bump
github/codeql-action/initfrom v4.37.2 to v4.37.3Updates the CodeQL workflow in codeql.yml to use
github/codeql-action/initat v4.37.3.Macroscope summarized 5d17877.
Summary by CodeRabbit