From ff431eb4d720a5c11601ea8f78e5cb30183eb979 Mon Sep 17 00:00:00 2001 From: Jos Nienhuis <6952249+joszz@users.noreply.github.com> Date: Sun, 18 Oct 2026 18:19:01 +0200 Subject: [PATCH] fix(ci): group the codeql-action bumps and move CodeQL to 4.39.0 Dependabot opened one PR per github/codeql-action subpath, so #508 (autobuild) and #509 (init) each left the other steps on 4.38.3 and CodeQL failed with a version mismatch. upload-sarif already went to 4.39.0 in #510. Bump init, autobuild and analyze to the v4.39.0 commit and add a codeql-action group so future bumps arrive as one PR. Co-Authored-By: Claude Opus 5.5 --- .github/dependabot.yml | 8 ++++++++ .github/workflows/codeql.yml | 6 +++--- 2 files changed, 11 insertions(+), 3 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index e4069e17..576fccfb 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -262,3 +262,11 @@ updates: github-actions: patterns: - "actions/*" + + # Every github/codeql-action step (init, autobuild, analyze, upload-sarif) must run the + # same version, or CodeQL fails with "Loaded a configuration file for version X, but + # running version Y". Dependabot treats each subpath as its own dependency, so without + # this group it opens one PR per step and each of them breaks the CodeQL run. + codeql-action: + patterns: + - "github/codeql-action*" diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 0b4f392a..87a2695b 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -29,14 +29,14 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Initialize CodeQL - uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3 + uses: github/codeql-action/init@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0 with: languages: ${{ matrix.language }} - name: Autobuild - uses: github/codeql-action/autobuild@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3 + uses: github/codeql-action/autobuild@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0 - name: Analyze - uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3 + uses: github/codeql-action/analyze@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0 with: category: codeql-${{ matrix.language }}