chore(deps): bump github/codeql-action/init from 4.37.1 to 4.37.3 - #34
chore(deps): bump github/codeql-action/init from 4.37.1 to 4.37.3#34dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [github/codeql-action/init](https://github.com/github/codeql-action) from 4.37.1 to 4.37.3. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@7188fc3...e4fba86) --- updated-dependencies: - dependency-name: github/codeql-action/init dependency-version: 4.37.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
📝 WalkthroughWalkthroughChangesCodeQL workflow update
Estimated code review effort: 1 (Trivial) | ~2 minutes Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/codeql.yml:
- Line 29: Update the CodeQL workflow’s analyze action to use revision
e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81, matching the revision already used by
the init action.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 746a16b6-0066-439b-8de7-84c77770d352
📒 Files selected for processing (1)
.github/workflows/codeql.yml
|
|
||
| - name: Initialize CodeQL | ||
| uses: github/codeql-action/init@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1 | ||
| uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3 |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '--- workflow ---'
cat -n .github/workflows/codeql.yml
printf '%s\n' '--- CodeQL action references ---'
rg -n 'uses:\s*github/codeql-action/' .github/workflows/codeql.yml
printf '%s\n' '--- repository metadata ---'
git remote -v || true
printf '%s\n' '--- tag and commit resolution ---'
python3 - <<'PY'
import json, urllib.request
repo = "github/codeql-action"
for tag in ("v2.37.3", "v4.37.3", "v4.37.1"):
ref_url = f"https://api.github.com/repos/{repo}/git/ref/tags/{tag}"
try:
with urllib.request.urlopen(ref_url) as r:
ref = json.load(r)
obj = ref["object"]
print(tag, "ref_object", obj)
sha = obj["sha"]
if obj["type"] == "tag":
with urllib.request.urlopen(
f"https://api.github.com/repos/{repo}/git/tags/{sha}"
) as r:
tag_obj = json.load(r)
print(tag, "dereferenced", tag_obj.get("object"))
sha = tag_obj["object"]["sha"]
with urllib.request.urlopen(
f"https://api.github.com/repos/{repo}/commits/{sha}"
) as r:
commit = json.load(r)
print(tag, "commit", commit.get("sha"))
except Exception as e:
print(tag, "ERROR", e)
for sha in (
"e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81",
"7188fc363630916deb702c7fdcf4e481b751f97a",
):
try:
with urllib.request.urlopen(
f"https://api.github.com/repos/{repo}/commits/{sha}"
) as r:
commit = json.load(r)
print("pin", sha, "resolves_to", commit.get("sha"))
except Exception as e:
print("pin", sha, "ERROR", e)
PYRepository: Xquik-dev/x-twitter-scraper-ruby
Length of output: 2526
🏁 Script executed:
#!/bin/bash
set -eu
api() {
curl --fail --silent --show-error --location --insecure \
-H 'Accept: application/vnd.github+json' \
-H 'X-GitHub-Api-Version: 2022-11-28' "$1"
}
repo='github/codeql-action'
for tag in v4.37.3 v4.37.1; do
printf '%s\n' "--- $tag ref ---"
ref="$(api "https://api.github.com/repos/$repo/git/ref/tags/$tag")"
printf '%s\n' "$ref" | jq '{ref, object}'
type="$(printf '%s\n' "$ref" | jq -r '.object.type')"
sha="$(printf '%s\n' "$ref" | jq -r '.object.sha')"
if [ "$type" = tag ]; then
printf '%s\n' "--- $tag annotated tag object ---"
tag_obj="$(api "https://api.github.com/repos/$repo/git/tags/$sha")"
printf '%s\n' "$tag_obj" | jq '{sha: .sha, object}'
sha="$(printf '%s\n' "$tag_obj" | jq -r '.object.sha')"
fi
printf '%s\n' "--- $tag commit validation ---"
api "https://api.github.com/repos/$repo/commits/$sha" | jq '{sha, commit: {message: .commit.message}}'
done
for sha in \
e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 \
7188fc363630916deb702c7fdcf4e481b751f97a
do
printf '%s\n' "--- pin $sha ---"
api "https://api.github.com/repos/$repo/commits/$sha" | jq '{sha, commit: {message: .commit.message}}'
doneRepository: Xquik-dev/x-twitter-scraper-ruby
Length of output: 292
🌐 Web query:
github/codeql-action v4.37.3 e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81
💡 Result:
The identifier e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 is the full Git commit SHA for version v4.37.3 of the github/codeql-action repository [1][2]. This version was released on July 22, 2026 [3][4]. According to the official changelog, this release contained no user-facing changes [3][2]. The commit was associated with pull request #4031 in the github/codeql-action repository [1]. Users typically reference this commit SHA in their GitHub Actions workflow files to pin the action to a specific, immutable version, as shown in the following example syntax [5][6][7]: uses: github/codeql-action@e4fba86 By pinning to a specific SHA rather than a major version tag (like v4), users ensure that their workflow behavior remains consistent and is not affected by subsequent updates or changes within that version branch [8].
Citations:
- 1: github/codeql-action@e4fba86
- 2: chore(deps): bump github/codeql-action from 4.37.2 to 4.37.3 nestjs/nest#17395
- 3: https://code.jaenis.ch/actions/codeql-action/raw/branch/releases/v4/CHANGELOG.md
- 4: https://github.com/github/codeql-action/blob/main/CHANGELOG.md
- 5: https://github.com/peaceiris/actions-hugo/blob/b840fac0919ba5dc16302e1db115dfec4b54be86/.github/workflows/codeql-analysis.yml
- 6: https://learn.chatgpt.com/docs/security/cli/ci
- 7: https://www.codefactor.io/repository/github/guibranco/crispywaffle/source/main/.github/workflows/codeql.yml
- 8: https://github.com/github/codeql-action
🌐 Web query:
github/codeql-action v4.37.1 7188fc363630916deb702c7fdcf4e481b751f97a
💡 Result:
The hash 7188fc363630916deb702c7fdcf4e481b751f97a corresponds to the merge commit for version 4.37.1 of the GitHub CodeQL Action, which was released on July 16, 2026 [1][2]. Key details of this release include: - Default CodeQL Bundle Update: The default CodeQL bundle version was updated to 2.26.1 [1][3]. - Deprecation Warning: This release introduced a deprecation warning for users of CodeQL versions 2.20.6 and earlier [1][4]. These specific versions were discontinued on July 1, 2026, alongside GitHub Enterprise Server 3.16, and they will lose support in the next minor release of the CodeQL Action [5][3]. The CodeQL Action is maintained by GitHub and is used to run CodeQL analysis for code scanning [6][7]. Users are generally encouraged to reference the action by a major version tag (such as v4) in their workflow files to automatically receive the latest releases and updates within that version [8][6].
Citations:
- 1: github/codeql-action@7188fc3
- 2: github/codeql-action@v4.37.0...v4.37.1
- 3: https://github.com/github/codeql-action/blob/main/CHANGELOG.md
- 4: https://newreleases.io/project/github/github/codeql-action/release/v4.37.1
- 5: https://code.jaenis.ch/actions/codeql-action/raw/branch/releases/v4/CHANGELOG.md
- 6: https://github.com/github/codeql-action/tree/refs/heads/main
- 7: https://docs.github.com/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning-with-codeql
- 8: https://github.com/github/codeql-action
🌐 Web query:
site:github.com/github/codeql-action CHANGELOG mixed versions init analyze unsupported same version
💡 Result:
In the GitHub CodeQL Action, mixing different versions of the action within the same workflow is considered unsupported and can cause unpredictable results [1][2][3]. To address this, recent versions of the CodeQL Action include validation logic [1][3]: * A warning is emitted from the codeql-action/init step if the workflow is detected to be using different versions of the CodeQL Action [1][3]. * An error is thrown by subsequent CodeQL Action steps (such as analyze) if they attempt to load a configuration file that was generated by a different version of the codeql-action/init step [1][3]. To resolve or prevent these issues, ensure that all steps in your CodeQL workflow (e.g., init, analyze, upload-sarif) use the exact same version of the CodeQL Action [1][3]. If you are referencing the action using a tag like @v3 or @v4, update your workflow to use specific, matching versions across all steps to maintain consistency and avoid these errors [1][4].
Citations:
- 1: https://github.com/github/codeql-action/blob/v4.31.10/CHANGELOG.md
- 2: https://github.com/github/codeql-action/blob/v4.30.9/CHANGELOG.md
- 3: https://github.com/github/codeql-action/blob/main/CHANGELOG.md
- 4: https://github.com/github/codeql-action/blob/v4.31.7/CHANGELOG.md
🌐 Web query:
site:docs.github.com CodeQL Action init analyze same version workflow
💡 Result:
When using the CodeQL Action in a GitHub Actions workflow, you must use the same version for both the init and analyze steps [1][2]. GitHub Actions workflow best practices, as well as the design of the CodeQL Action, require these steps to be part of the same job to ensure the CodeQL database created during the init and build phase is correctly preserved and processed by the analyze phase [3][2]. In a standard CodeQL workflow, the steps are structured within a single job as follows [1][2]: 1. Initialize CodeQL: The github/codeql-action/init action prepares the environment and initializes the CodeQL tools [1]. 2. Build (for compiled languages): The code is built between the init and analyze steps, allowing CodeQL to observe the compiler activity and create the database [3]. 3. Perform CodeQL Analysis: The github/codeql-action/analyze action processes the database and uploads the results [1][2]. If you were to use different versions or split these actions across different jobs without proper artifact management, the analyze step would be unable to locate or correctly interpret the CodeQL database generated by the init step, leading to analysis failures [3][2]. Additionally, ensure that if you are using a containerized environment, all these processes occur within the same container instance [2].
Citations:
- 1: https://docs.github.com/en/code-security/how-tos/find-and-fix-code-vulnerabilities/manage-your-configuration/codeql-for-compiled-languages
- 2: https://docs.github.com/en/code-security/tutorials/customize-code-scanning/run-in-a-container
- 3: https://docs.github.com/en/code-security/reference/code-scanning/troubleshoot-analysis-errors/no-source-code-seen-during-build
Use one CodeQL Action revision in this workflow.
init uses v4.37.3, but analyze uses v4.37.1. Mixed versions are unsupported and can cause analyze to fail when it reads configuration from init. Update analyze to e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/codeql.yml at line 29, Update the CodeQL workflow’s
analyze action to use revision e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81,
matching the revision already used by the init action.
Bumps github/codeql-action/init from 4.37.1 to 4.37.3.
Release notes
Sourced from github/codeql-action/init's releases.
Changelog
Sourced from github/codeql-action/init's changelog.
... (truncated)
Commits
e4fba86Merge pull request #4031 from github/update-v4.37.3-72f6a9da0fb50ab5Update changelog for v4.37.372f6a9dMerge pull request #4030 from github/mbg/fix/no-proxy3b5ee58Use defaultrequestoptions instead ofundefinedbfb6be4Merge pull request #4028 from github/mergeback/v4.37.2-to-main-e0647621526ab84Rebuildd6217b9Update changelog and version after v4.37.2e064762Merge pull request #4027 from github/update-v4.37.2-385bcdc5ae0faed8Add a couple of change notes73aad0eUpdate changelog for v4.37.2Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)Summary by cubic
Update
github/codeql-action/initfrom 4.37.1 to 4.37.3 in.github/workflows/codeql.ymlto keep CodeQL analysis up to date. Includes 4.37.2 improvements (default newconfig-fileaddress format and support for private registries when fetching remote configs); no workflow changes required.Written for commit 31faa1a. Summary will update on new commits.
Summary by CodeRabbit
Note
Bump
github/codeql-action/initfrom v4.37.1 to v4.37.3Updates the pinned commit for
github/codeql-action/initin codeql.yml toe4fba868. Risk: the PR summary indicates theAnalyzestep may have lost its action invocation — theuses: github/codeql-action/analyzeline appears to have been removed, which would cause CodeQL analysis to no longer run.Macroscope summarized 31faa1a.