Bump entur/gha-security/.github/workflows/code-scan.yml from 2 to 2.15.0 - #76
Conversation
Bumps [entur/gha-security/.github/workflows/code-scan.yml](https://github.com/entur/gha-security) from 2 to 2.15.0. - [Release notes](https://github.com/entur/gha-security/releases) - [Changelog](https://github.com/entur/gha-security/blob/main/CHANGELOG.md) - [Commits](entur/gha-security@v2...v2.15.0) --- updated-dependencies: - dependency-name: entur/gha-security/.github/workflows/code-scan.yml dependency-version: 2.15.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
There was a problem hiding this comment.
Pull request overview
Note
Copilot could not run the full agentic suite for this review because it was automatically requested on a bot-authored pull request. Request a review from Copilot under Reviewers to retry with the full agentic suite. Improved support for bot-authored pull requests is coming soon.
Updates the CodeQL (code scanning) GitHub Actions workflow to pin the reused security workflow to a specific version for more deterministic CI behavior.
Changes:
- Pinned
entur/gha-security/.github/workflows/code-scan.ymlfrom the floatingv2tag tov2.15.0.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| code-scan: | ||
| name: Code Scan | ||
| uses: entur/gha-security/.github/workflows/code-scan.yml@v2 | ||
| uses: entur/gha-security/.github/workflows/code-scan.yml@v2.15.0 |
Docker Scan - Alert(s) found with threshold matching severity highResults
Docker Scan Report can be found here AllowlistUse the allowlist if you want to ignore vulnerabilities that do not affect the repository. |
Bumps entur/gha-security/.github/workflows/code-scan.yml from 2 to 2.15.0.
Release notes
Sourced from entur/gha-security/.github/workflows/code-scan.yml's releases.
... (truncated)
Changelog
Sourced from entur/gha-security/.github/workflows/code-scan.yml's changelog.
... (truncated)
Commits
f3ee159chore(deps): bump github/codeql-action from 4 to 4.35.2 (#206)7ff9be7chore(deps-dev): bump the minor-and-patch group (#204)322bdb2chore(deps): bump entur/gha-meta/.github/workflows/release.yml (#203)41208c3chore(main): release 2.12.2 (#205)afb84fefix: Gradle dependency graph not uploading (#202)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)