From 290ce3441a9199edf5586165564d817cbaa709d6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marc-Andr=C3=A9=20Bombeck?= Date: Sun, 16 Aug 2026 17:58:49 +0200 Subject: [PATCH] Bump every codeql-action reference together Dependabot treats `init`, `analyze` and `upload-sarif` as separate dependencies, so it raised `init` to 4.37.7 in one PR and left `analyze` on 4.37.6 in the same workflow. The action refuses that pairing outright: "Loaded a configuration file for version '4.37.7', but running version '4.37.6'", and the CodeQL job failed on the very PR doing the bump. All five pinned references move together here: init and analyze in codeql.yml, and the three upload-sarif steps in scorecard.yml and trivy.yml. The commit SHA is the one the v4.37.7 tag dereferences to, which is also the SHA both Dependabot PRs pin. --- .github/workflows/codeql.yml | 4 ++-- .github/workflows/scorecard.yml | 2 +- .github/workflows/trivy.yml | 4 ++-- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 286f9d079..45428908f 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -53,7 +53,7 @@ jobs: # minutes and can produce nothing actionable, because nobody edits # it and the fix for anything found there is `pnpm prisma generate`. - name: Initialise CodeQL - uses: github/codeql-action/init@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6 + uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7 with: languages: javascript-typescript build-mode: none @@ -68,6 +68,6 @@ jobs: - public - name: Analyse - uses: github/codeql-action/analyze@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6 + uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7 with: category: "/language:javascript-typescript" diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 0fb4bcd82..eca3900e7 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -54,7 +54,7 @@ jobs: publish_results: true - name: Upload results - uses: github/codeql-action/upload-sarif@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6 + uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7 with: sarif_file: scorecard-results.sarif category: scorecard diff --git a/.github/workflows/trivy.yml b/.github/workflows/trivy.yml index 235c8ea63..2053c3c89 100644 --- a/.github/workflows/trivy.yml +++ b/.github/workflows/trivy.yml @@ -88,7 +88,7 @@ jobs: skip-dirs: src/generated - name: Upload results - uses: github/codeql-action/upload-sarif@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6 + uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7 with: sarif_file: trivy-filesystem.sarif category: trivy-filesystem @@ -145,7 +145,7 @@ jobs: exit-code: "0" - name: Upload results - uses: github/codeql-action/upload-sarif@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6 + uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7 with: sarif_file: trivy-published-image.sarif category: trivy-published-image