Skip to content

chore(dependabot): bump github/codeql-action from 4.38.3 to 4.39.0 - #2256

Open
stekik wants to merge 2 commits into
kyma-project:mainfrom
stekik:chore/bump-codeql-action-4.39.0
Open

stekik wants to merge 2 commits into
kyma-project:mainfrom
stekik:chore/bump-codeql-action-4.39.0

Conversation

@stekik

@stekik stekik commented Oct 19, 2026

Copy link
Copy Markdown
Contributor

Bumps github/codeql-action/init and github/codeql-action/analyze from 4.38.3 to 4.39.0.

Combines dependabot PRs #2252 and #2253.

Changes

  • Breaking change: minimum required CodeQL bundle version bumped to 2.20.7
  • codeql-action/analyze now validates checkout_path input
  • Fixed third-party caching implementations preventing correct cache restores
  • codeql-action/start-proxy now finds CodeQL releases using same logic as init

@stekik
stekik requested a review from a team as a code owner October 19, 2026 07:37
@hyperspace-pr-bot

Copy link
Copy Markdown
Contributor

Control Panel

Hi, I'm an AI-powered Review Bot that helps you with summarizing and reviewing pull requests.
To interact with me, just use the following actions:

  • 📝 Summarize PR
  • 🔍 Review
  • 🗑️ Delete all bot comments and reviews

@stekik

stekik commented Oct 19, 2026

Copy link
Copy Markdown
Contributor Author

@kyma-project/phoenix please review

Combine the init and analyze bumps into a single change so both steps
run on the same CodeQL version. Splitting them (as Dependabot did in
 kyma-project#2226 and kyma-project#2230) fails CI with:
'Loaded a configuration file for version 4.38.3, but running version 4.38.2'
@stekik
stekik force-pushed the chore/bump-codeql-action-4.39.0 branch from dccc58b to eb8f480 Compare October 20, 2026 09:14

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant