mirror of
https://github.com/MBombeck/HealthLog.git
synced 2026-11-07 04:12:04 +00:00
Marc-André Bombeck
290ce3441a
Dependabot treats `init`, `analyze` and `upload-sarif` as separate dependencies, so it raised `init` to 4.37.7 in one PR and left `analyze` on 4.37.6 in the same workflow. The action refuses that pairing outright: "Loaded a configuration file for version '4.37.7', but running version '4.37.6'", and the CodeQL job failed on the very PR doing the bump. All five pinned references move together here: init and analyze in codeql.yml, and the three upload-sarif steps in scorecard.yml and trivy.yml. The commit SHA is the one the v4.37.7 tag dereferences to, which is also the SHA both Dependabot PRs pin.