From 314f35b2ee6115485876e8493196d0c7172def87 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marc-Andr=C3=A9=20Bombeck?= Date: Sun, 30 Aug 2026 20:20:31 +0200 Subject: [PATCH] ci: move every codeql-action pin to v4.37.9 in one commit init, analyze and upload-sarif are the same release pinned in three workflows. Dependabot opened them as three separate pull requests, so each run mixed two versions and analyze rejected the config init had written: "Loaded a configuration file for version 4.37.7, but running version 4.37.9". None of the three could go green alone, and the code-scanning analysis stayed red while they waited on each other. Bump all five references together and group the action in dependabot.yml so the next release arrives as one pull request. --- .github/dependabot.yml | 9 +++++++++ .github/workflows/codeql.yml | 4 ++-- .github/workflows/scorecard.yml | 2 +- .github/workflows/trivy.yml | 4 ++-- 4 files changed, 14 insertions(+), 5 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index c91a1d454..f8a01fce5 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -15,6 +15,15 @@ updates: schedule: interval: "weekly" open-pull-requests-limit: 3 + groups: + # init, analyze and upload-sarif are one release pinned in three places. + # Bumped separately, a run mixes two versions and analyze refuses the + # config init wrote ("Loaded a configuration file for version 4.37.7, but + # running version 4.37.9"), so none of the single-action pull requests can + # reach green on its own. They travel together. + codeql-action: + patterns: + - "github/codeql-action*" - package-ecosystem: "docker" directory: "/" schedule: diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 45428908f..21dbe0800 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -53,7 +53,7 @@ jobs: # minutes and can produce nothing actionable, because nobody edits # it and the fix for anything found there is `pnpm prisma generate`. - name: Initialise CodeQL - uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7 + uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9 with: languages: javascript-typescript build-mode: none @@ -68,6 +68,6 @@ jobs: - public - name: Analyse - uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7 + uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9 with: category: "/language:javascript-typescript" diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index eca3900e7..5256657e8 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -54,7 +54,7 @@ jobs: publish_results: true - name: Upload results - uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7 + uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9 with: sarif_file: scorecard-results.sarif category: scorecard diff --git a/.github/workflows/trivy.yml b/.github/workflows/trivy.yml index 2053c3c89..dcc54336d 100644 --- a/.github/workflows/trivy.yml +++ b/.github/workflows/trivy.yml @@ -88,7 +88,7 @@ jobs: skip-dirs: src/generated - name: Upload results - uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7 + uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9 with: sarif_file: trivy-filesystem.sarif category: trivy-filesystem @@ -145,7 +145,7 @@ jobs: exit-code: "0" - name: Upload results - uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7 + uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9 with: sarif_file: trivy-published-image.sarif category: trivy-published-image