From 107a41c6097f7a5c9a8f325caf125cae368f0e8d Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sat, 12 Sep 2026 03:23:40 +0000 Subject: [PATCH 1/2] build(deps): bump github/codeql-action/upload-sarif Bumps [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) from 4.37.9 to 4.38.0. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/cdf488f595d80d6e07e03d4674febd5ab45fa938...b96794f015dfd88f77b49b1c93e0fa7110f94c63) --- updated-dependencies: - dependency-name: github/codeql-action/upload-sarif dependency-version: 4.38.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] --- .github/workflows/ci.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 013f0ebb..4d5c8118 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -314,7 +314,7 @@ jobs: run: cargo run --locked -- scan .. --core "$(cd ../core && cabal list-bin ce-core)" --format sarif > ../ce-scan.sarif - name: SARIF upload (publish) if: matrix.os == 'ubuntu-latest' && github.event_name == 'push' && github.ref == 'refs/heads/main' - uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9, pinned 2026-09-06 (dependabot #7) + uses: github/codeql-action/upload-sarif@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.37.9, pinned 2026-09-06 (dependabot #7) with: sarif_file: ce-scan.sarif category: ce-scan @@ -329,7 +329,7 @@ jobs: run: cargo run --locked -- dedup .. --core "$(cd ../core && cabal list-bin ce-core)" --format sarif > ../ce-dedup.sarif - name: SARIF upload (dedup publish) if: matrix.os == 'ubuntu-latest' && github.event_name == 'push' && github.ref == 'refs/heads/main' - uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9, pinned 2026-09-06 (dependabot #7) + uses: github/codeql-action/upload-sarif@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.37.9, pinned 2026-09-06 (dependabot #7) with: sarif_file: ce-dedup.sarif category: ce-dedup From 9329c70bb2c61d7be341454d54532cc96edabc56 Mon Sep 17 00:00:00 2001 From: skymanbp <57272723+skymanbp@users.noreply.github.com> Date: Sat, 12 Sep 2026 13:08:59 -0400 Subject: [PATCH 2/2] ci: the two upload-sarif pin comments name v4.38.0, the version the sha now points at Dependabot #12 moved both upload-sarif pins from cdf488f5 (v4.37.9) to b96794f0 and left the trailing comments saying v4.37.9 / 2026-09-06 / dependabot #7. b96794f0 is the commit the annotated tag v4.38.0 dereferences to (GitHub API, 2026-09-12). The comment is the only human-readable record of what a pin is, and .github/ sits outside the measurement universe, so no gate would have named the drift. Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_01ES1xJgjH4z6fV6p7zS4ssX --- .github/workflows/ci.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 4d5c8118..d984de5a 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -314,7 +314,7 @@ jobs: run: cargo run --locked -- scan .. --core "$(cd ../core && cabal list-bin ce-core)" --format sarif > ../ce-scan.sarif - name: SARIF upload (publish) if: matrix.os == 'ubuntu-latest' && github.event_name == 'push' && github.ref == 'refs/heads/main' - uses: github/codeql-action/upload-sarif@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.37.9, pinned 2026-09-06 (dependabot #7) + uses: github/codeql-action/upload-sarif@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0, pinned 2026-09-12 (dependabot #12) with: sarif_file: ce-scan.sarif category: ce-scan @@ -329,7 +329,7 @@ jobs: run: cargo run --locked -- dedup .. --core "$(cd ../core && cabal list-bin ce-core)" --format sarif > ../ce-dedup.sarif - name: SARIF upload (dedup publish) if: matrix.os == 'ubuntu-latest' && github.event_name == 'push' && github.ref == 'refs/heads/main' - uses: github/codeql-action/upload-sarif@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.37.9, pinned 2026-09-06 (dependabot #7) + uses: github/codeql-action/upload-sarif@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0, pinned 2026-09-12 (dependabot #12) with: sarif_file: ce-dedup.sarif category: ce-dedup