ci: refresh github/codeql-action pin to current v4 - #986
Merged
Conversation
The pin was 5595ccaf..., but upstream has since moved the v4 tag to ff2f1c62.... The Verify Action Pins workflow flags this drift on every PR that touches any workflow file, regardless of whether that PR changed codeql.yml or defender-for-devops.yml. Verified the new SHA against the GitHub API directly (not just the CI error text) and confirmed .github/scripts/verify-action-pins.sh passes clean locally (40/40 action references OK, exit 0).
|
ⓘ Qodo reviews are paused because the subscription is no longer active. Ask your workspace admin to reactivate the subscription to resume reviews. Manage billing |
PR Summary by QodoCI: refresh pinned github/codeql-action v4 SHA in security workflows
AI Description
Diagram
High-Level Assessment
Files changed (2)
|
Code Review by Qodo🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)
Great, no issues found!Qodo reviewed your code and found no material issues that require reviewTip of the day💡 Did you know, you can describe a rule in plain language on the Rules page and Qodo drafts it for you |
🔒 Security Scan ResultsSafety — dependency vulnerabilities✅ No findings. Bandit — HIGH-severity code issues✅ No findings. Semgrep — static analysis patternsFound 55. Show all findings
This security scan runs automatically on source-code PRs and bi-weekly (skipped for doc/markdown-only changes). 📊 Security Policy: CI fails on Safety vulnerabilities and Bandit HIGH-severity findings. Semgrep findings above are informational and do not block merge. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The
github/codeql-actionSHA incodeql.ymlanddefender-for-devops.ymlwas out of date compared to what thev4tag points to now.Because of that, the
Verify Action Pinsworkflow was failing on PRs that changed workflow files, even when the workflow change was unrelated. This also showed up recently on #945.5595ccaf912efad79be6eef63a5619ff05969be3v4SHA:ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0ddChanges
github/codeql-action/*references to the currentv4SHA.codeql.yml.defender-for-devops.yml.# v4.Test plan
repos/github/codeql-action/git/refs/tags/v4→ tag object →object.sha) instead of only using the SHA from the CI error..github/scripts/verify-action-pins.shlocally.