chore(deps): bump github/codeql-action to v4.38.0 across all four paths - #191
Merged
Merged
Conversation
github/codeql-action publishes one release under four action paths that all resolve to the same SHA. Bumping a single path leaves the siblings at v4.37.9 and Analyze fails on the mismatch, so all four move together here. Supersedes dependabot's per-path PRs in this repository. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015QRxFm1Z1kE9iraPspwr7j
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps every
github/codeql-actionpin tov4.38.0(b96794f015dfd88f77b49b1c93e0fa7110f94c63) in one commit:init,autobuildandanalyzeincodeql.yml, andupload-sarifinscorecard.yml.Why one PR instead of dependabot's four
github/codeql-actionpublishes one release under four action paths, and all four resolve to the same SHA. Dependabot opens a PR per path, and each of those edits the same pinned string, so bumping any one of them leaves its siblings atv4.37.9andAnalyze (python)fails on the version mismatch.upload-sarifis the exception only because it lives inscorecard.ymland the Analyze job does not consume it.Merging them back to back does not work either: the three in
codeql.ymltouch the same lines, so the first merge conflicts the rest.Supersedes the four dependabot PRs in this repository, which are closed against this one.