From e6841bb5d98da88e3007bb6a1acbdc945f2126e1 Mon Sep 17 00:00:00 2001 From: Algis Dumbris Date: Thu, 23 Jul 2026 20:25:06 +0300 Subject: [PATCH] ci: align codeql-action steps on one SHA + dependabot group Dependabot treats github/codeql-action/{init,autobuild,analyze} as separate dependencies, so #895 bumped only init to v4.37.3 while autobuild stayed on v4.37.1 and analyze on v4.37.0. The newer init writes a config file the older binaries refuse to load ("Loaded a configuration file for version '4.37.3', but running version '4.37.0'"), so every CodeQL run on main and PRs has failed in ~20s since #895 merged. Pin all three steps to the v4.37.3 SHA and add a dependabot group so the subpaths are always bumped in one PR. Co-Authored-By: Claude Fable 5 --- .github/dependabot.yml | 8 ++++++++ .github/workflows/codeql.yml | 10 ++++++++-- 2 files changed, 16 insertions(+), 2 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 45108f8e..7015119a 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -17,6 +17,14 @@ updates: interval: weekly commit-message: prefix: "chore(ci)" + groups: + # codeql-action's init/autobuild/analyze subpaths are separate + # dependencies to dependabot but must stay on the same version — + # skew makes analyze reject init's config file (broke CI: #895 + # bumped only init to 4.37.3 while analyze stayed on 4.37.0). + codeql-action: + patterns: + - "github/codeql-action*" - package-ecosystem: npm directory: "/frontend" schedule: diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index f4e41aab..ddef3f9b 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -46,11 +46,17 @@ jobs: languages: ${{ matrix.language }} build-mode: ${{ matrix.build-mode }} + # NOTE: init/autobuild/analyze MUST be pinned to the SAME codeql-action + # SHA. Version skew breaks hard at runtime: init writes a config file + # that older analyze/autobuild binaries refuse to load ("Loaded a + # configuration file for version 'X', but running version 'Y'"). + # Dependabot bumps them together via the codeql-action group in + # .github/dependabot.yml. - name: Autobuild if: matrix.build-mode == 'autobuild' - uses: github/codeql-action/autobuild@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1 + uses: github/codeql-action/autobuild@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3 - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0 + uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3 with: category: /language:${{ matrix.language }}