From 7b3dad48129909ffceda354e65df9c83cba644c6 Mon Sep 17 00:00:00 2001 From: Toni Bergholm Date: Thu, 22 Oct 2026 14:56:21 +0300 Subject: [PATCH] ci(deps): bump github/codeql-action to 4.39.0 as one group init, analyze and upload-sarif must run the same version, so the separate Dependabot PRs (#289, #292, #293) each failed with a version mismatch. Bump all three together and group them in dependabot.yml so they stay together. --- .github/dependabot.yml | 5 +++++ .github/workflows/codeql.yml | 4 ++-- .github/workflows/scorecard_analysis.yml | 2 +- 3 files changed, 8 insertions(+), 3 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index c5b967d0..e2784a7e 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -41,6 +41,11 @@ updates: directory: "/" schedule: interval: weekly + groups: + # init, analyze and upload-sarif must run the same version (the action + # fails the job otherwise), so they are bumped in one PR. + codeql-action: + patterns: ["github/codeql-action/*"] ignore: # dtolnay/rust-toolchain encodes the toolchain in the pinned ref, so ANY # automated ref update can silently change the toolchain a workflow diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index f2ab7762..b9490a00 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -33,13 +33,13 @@ jobs: build-mode: none steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3 + - uses: github/codeql-action/init@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0 with: languages: ${{ matrix.language }} build-mode: ${{ matrix.build-mode }} # Path and rule exclusions, each with its reason, live in the config # file so they are reviewable in one place. config-file: ./.github/codeql/codeql-config.yml - - uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3 + - uses: github/codeql-action/analyze@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0 with: category: "/language:${{ matrix.language }}" diff --git a/.github/workflows/scorecard_analysis.yml b/.github/workflows/scorecard_analysis.yml index f7698a4f..fbe16cfe 100644 --- a/.github/workflows/scorecard_analysis.yml +++ b/.github/workflows/scorecard_analysis.yml @@ -39,6 +39,6 @@ jobs: retention-days: 5 - name: Upload to code scanning - uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3 + uses: github/codeql-action/upload-sarif@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0 with: sarif_file: results.sarif