ci: move every codeql-action pin to v4.37.6 in one step - #52
Merged
Conversation
Dependabot split this single upgrade into three pull requests, one per action
path, and two of them cannot pass on their own: `codeql.yml` runs both `init`
and `analyze`, and the action refuses a mismatch —
Loaded a configuration file for version '4.37.4', but running version '4.37.6'
so each of those pull requests bumps one half and is red by construction.
Merging them in sequence would leave main with a broken CodeQL job between the
two merges.
All three paths ship from the same commit, so they move as one here. The pin
was verified rather than trusted: the annotated tag v4.37.6 dereferences to
5595ccaf912efad79be6eef63a5619ff05969be3, which is the SHA used below.
Closes the three split pull requests. The grouping that stops this recurring is
a separate change, since it fixes the cause rather than this instance.
This was referenced Aug 8, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Replaces #49, #50 and #51.
Why those three could not just be merged
Dependabot opened one pull request per action path for what is a single upgrade — all three resolve to the same commit. Two of them are red by construction:
codeql.ymlruns bothgithub/codeql-action/initandgithub/codeql-action/analyze, and the action refuses to run when the two halves disagree. #51 bumpsinitand leavesanalyzebehind; #50 does the reverse. Neither can go green alone, and no amount of re-running changes that.Merging them one after the other would also leave
maincarrying a broken CodeQL job in the window between the two merges.#49 (
upload-sarif, inscorecard.yml) was green only because it is the sole codeql-action step in its file.What this does
Moves all three pins to
5595ccaf912efad79be6eef63a5619ff05969be3in one commit — two lines incodeql.yml, one inscorecard.yml.Verifying the pin
A comment saying
# v4.37.6proves nothing on its own, so the SHA was checked against the upstream tag:The annotated tag dereferences to exactly the SHA pinned here.
The real proof is this pull request's own
Analyzecheck: it runsinitandanalyzeat the new version together, which is the exact combination the split pull requests could not produce.Contract impact
None. CI configuration only.
Preventing the recurrence — grouping the
github-actionsecosystem, which currently has nogroupsblock at all — is deliberately a separate pull request: this one fixes the instance, that one fixes the cause.