chore(deps): update CodeQL Action to 4.37.6 - #712
Conversation
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
|
Warning Review limit reached
Next review available in: 17 minutes You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughCodeQL 백필 워크플로의 ChangesCodeQL 분석 워크플로
Estimated code review effort: 1 (Trivial) | ~2 minutes Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
@dependabot rebase |
035d761 to
9e9c201
Compare
seonghobae
changed the title
Pull request was converted to draft
seonghobae
left a comment
seonghobae
left a comment
There was a problem hiding this comment.
Reviewed: routine pinned-version bump, checks green.
|
@dependabot rebase |
|
Looks like this PR has been edited by someone other than Dependabot. That means Dependabot can't rebase it - sorry! If you're happy for Dependabot to recreate it from scratch, overwriting any edits, you can request |
|
@dependabot recreate |
Bumps [github/codeql-action/analyze](https://github.com/github/codeql-action) from 4.36.2 to 4.37.4. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@8aad20d...f205ea1) --- updated-dependencies: - dependency-name: github/codeql-action/analyze dependency-version: 4.37.4 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
changed the title
29652a2 to
52ae59a
Compare
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/codeql-backfill.yml:
- Line 92: Update the CodeQL action references used by the init and autobuild
steps to the same v4.37.4 commit SHA already used by analyze, ensuring all
CodeQL stages in the workflow are pinned consistently.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 440d76a7-e87b-4fdd-ab2c-b56aaa87beb2
📒 Files selected for processing (1)
.github/workflows/codeql-backfill.yml
seonghobae
left a comment
seonghobae
left a comment
There was a problem hiding this comment.
Reviewed: pinned checkout v7.0.1 + CodeQL action digest bumps only.
|
@dependabot rebase |
…on/analyze-4.37.4
|
Looks like this PR has been edited by someone other than Dependabot. That means Dependabot can't rebase it - sorry! If you're happy for Dependabot to recreate it from scratch, overwriting any edits, you can request |
…on/analyze-4.37.4
seonghobae
left a comment
seonghobae
left a comment
There was a problem hiding this comment.
Reviewed current head: all CodeQL init/autobuild/analyze steps are pinned consistently to v4.37.4, the review thread is resolved, and CI, Security Scan, and Semgrep pass.
|
@opencode-agent @cwl-noema-review Please independently review exact current head |
Pull request was converted to draft
|
@opencode-agent Please independently review exact current head @cwl-noema-review Please perform the second independent exact-head review after OpenCode. The current maintainer approval does not substitute for latest-pusher-independent review. |
seonghobae
changed the title
|
@opencode-agent @cwl-noema-review Please independently review exact current head |
|
@opencode-agent Please review exact current head |
|
@cwl-noema-review Please independently review exact current head |
|
Queued @cwl-noema-review for PR #712 at head |
|
A newer version of github/codeql-action/analyze exists, but since this PR has been edited by someone other than Dependabot I haven't updated it. You'll get a PR for the updated version as normal once this PR is merged. |
seonghobae
changed the title
|
@coderabbitai review Please review exact head |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
target='9f61d6892943fc169f095da75f05c98952a30a8e'
repo='ContextualWisdomLab/pg-erd-cloud'
echo '== checked-out commit =='
git rev-parse HEAD
echo '== target commit object =='
git cat-file -t "$target"
echo '== target parent(s) =='
git show -s --format='%H%n%P%n%s' "$target"
echo '== changed files and patch =='
git diff --no-ext-diff --unified=80 "${target}^" "$target" -- .github/workflows/codeql-backfill.yml
echo '== workflow outline =='
ast-grep outline .github/workflows/codeql-backfill.yml --items all || true
echo '== relevant workflow fields =='
rg -n -C 3 '^(name:|on:|permissions:|jobs:)|^\s*(uses: github/codeql-action/|languages:|category:|ref:|upload:|sarif_file:|token:)' \
.github/workflows/codeql-backfill.yml
echo '== action pins in target workflow =='
python3 - <<'PY'
from pathlib import Path
import re
p = Path(".github/workflows/codeql-backfill.yml")
for n, line in enumerate(p.read_text().splitlines(), 1):
if "github/codeql-action/" in line:
print(f"{n}: {line.strip()}")
PY
echo '== GitHub PR head and checks =='
gh pr view 712 --repo "$repo" --json headRefOid,statusCheckRollup \
--jq '{headRefOid, checks: [.statusCheckRollup[] | {name, status, conclusion, detailsUrl, headSha}]}'Length of output: 12462 🏁 Script executed: #!/bin/bash
set -euo pipefail
target='9f61d6892943fc169f095da75f05c98952a30a8e'
expected='5595ccaf912efad79be6eef63a5619ff05969be3'
echo '== all files changed by target commit =='
git diff-tree --no-commit-id --name-status -r "$target"
echo '== CodeQL action references changed by target commit =='
git diff --no-ext-diff -U0 "${target}^" "$target" | \
rg -n '^[+-].*github/codeql-action/(init|autobuild|analyze)@'
echo '== upstream v4.37.6 tag object =='
gh api repos/github/codeql-action/git/ref/tags/v4.37.6 \
--jq '{ref, object_type: .object.type, object_sha: .object.sha}'
tag_object=$(gh api repos/github/codeql-action/git/ref/tags/v4.37.6 --jq '.object')
if [ "$(printf '%s' "$tag_object" | jq -r '.type')" = "tag" ]; then
tag_sha=$(printf '%s' "$tag_object" | jq -r '.sha')
echo '== annotated tag target =='
gh api "repos/github/codeql-action/git/tags/${tag_sha}" \
--jq '{object_type: .object.type, object_sha: .object.sha}'
fi
echo '== expected SHA =='
printf '%s\n' "$expected"Length of output: 2173
I found no blocker in
I did not approve because the exact-head check set is not yet complete:
|
|
Queued @cwl-noema-review for PR #712 at head |
1 participant
What
Updates every
github/codeql-actionstep in the CodeQL backfill workflow from v4.36.2 to v4.37.6, pinned to immutable commit5595ccaf912efad79be6eef63a5619ff05969be3.Why
Keeping
init,autobuild, andanalyzeon one exact upstream commit preserves supply-chain integrity and avoids mixed Action runtimes. This exact head supersedes the separate partial init-only and autobuild-only 4.37.6 updates in #845 and #846.Validation
The workflow text was checked to contain exactly three CodeQL action references and all three resolve to the same 4.37.6 commit. Exact-head repository CI, Security Scan, SAST, and independent review remain authoritative before merge.