From 1272372b696b398aa2ddd86f9feb6fdb1d8cd2c7 Mon Sep 17 00:00:00 2001 From: Imran Siddique Date: Mon, 14 Sep 2026 12:13:56 -0700 Subject: [PATCH] chore(deps): bump github/codeql-action to v4.38.0 and group it All four action paths of one codeql-action release share a SHA, so bumping one path strands the siblings at v4.37.9 and CodeQL fails on the mismatch. The three in codeql.yml edit the same file, so the per-path PRs also conflict with each other. Bump all four together, and group github/codeql-action* so dependabot opens one PR per release. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_015QRxFm1Z1kE9iraPspwr7j --- .github/dependabot.yml | 4 ++++ .github/workflows/codeql.yml | 6 +++--- .github/workflows/scorecard.yml | 2 +- 3 files changed, 8 insertions(+), 4 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index eb38669..9fa93e3 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -17,3 +17,7 @@ updates: interval: "weekly" day: "monday" open-pull-requests-limit: 5 + groups: + codeql-action: + patterns: + - "github/codeql-action*" diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 69dd098..e55731a 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -28,16 +28,16 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Initialize CodeQL - uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9 + uses: github/codeql-action/init@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0 with: languages: python queries: +security-extended - name: Autobuild - uses: github/codeql-action/autobuild@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9 + uses: github/codeql-action/autobuild@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0 - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9 + uses: github/codeql-action/analyze@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0 continue-on-error: true with: category: /language:python diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 4821fc7..d9d16b6 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -38,6 +38,6 @@ jobs: publish_results: true - name: Upload SARIF - uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9 + uses: github/codeql-action/upload-sarif@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0 with: sarif_file: scorecard-results.sarif