Skip to content

chore(ci)(deps): bump github/codeql-action from 3 to 4 - #2999

Merged
gHashTag merged 1 commit into
masterfrom
dependabot/github_actions/github/codeql-action-4
Oct 2, 2026
Merged

gHashTag merged 1 commit into
masterfrom
dependabot/github_actions/github/codeql-action-4

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 1, 2026 •

Copy link
Copy Markdown
Contributor

Bumps github/codeql-action from 3 to 4.

Release notes

Sourced from github/codeql-action's releases.

v3.38.2

  • Update default CodeQL bundle version to 2.27.1. #4160

v3.38.1

  • The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146

v3.38.0

  • On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
  • The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
  • Update default CodeQL bundle version to 2.27.0. #4129

v3.37.9

  • Update default CodeQL bundle version to 2.26.4. #4106

v3.37.8

No user facing changes.

v3.37.7

  • Update default CodeQL bundle version to 2.26.3. #4085

v3.37.6

  • Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

v3.37.5

  • Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

v3.37.4

  • This version of the CodeQL Action adds support for the tools input for the codeql-action/init step to be specified using a github-codeql-tools repository property. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to toolcache to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for tools in the workflow definition always takes precedence unless the value of the repository property starts with !. #4037
  • Update default CodeQL bundle version to 2.26.2. #4051

v3.37.3

No user facing changes.

v3.37.2

  • The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023
  • The CodeQL Action can now make use of configured private registries in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. #4007

v3.37.1

  • Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #3956
  • Update default CodeQL bundle version to 2.26.1. #4019

v3.37.0

  • Update default CodeQL bundle version to 2.26.0. #3995
  • In addition to the existing input format, the config-file input for the codeql-action/init step will soon support a new [owner/]repo[@ref][:path] format. All components except the repository name are optional. If omitted, owner defaults to the same owner as the repository the analysis is running for, ref to main, and path to .github/codeql-action.yaml. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. #3973

v3.36.3

No user facing changes.

v3.36.2

  • Cache CodeQL CLI version information across Actions steps. #3943

... (truncated)

Changelog

Sourced from github/codeql-action's changelog.

4.38.2 - 24 Sept 2026

  • Update default CodeQL bundle version to 2.27.1. #4160

4.38.1 - 18 Sept 2026

  • The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146

4.38.0 - 09 Sept 2026

  • On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
  • The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
  • Update default CodeQL bundle version to 2.27.0. #4129

4.37.9 - 26 Aug 2026

  • Update default CodeQL bundle version to 2.26.4. #4106

4.37.8 - 21 Aug 2026

No user facing changes.

Commits
  • dba87a1 Clarify elapsed-time helper documentation
  • 06344e2 Stub nightly release listing directly
  • 07dc949 Use default state in per-language bundle tests
  • 416ff0d Merge pull request #4157 from github/mbg/refactor/checkout-path
  • 738bd62 Refactor changenotes validate to use helper getChangenotes
  • 6dd161b Merge pull request #4155 from github/mario-campos/merge-changenotes
  • See full diff in compare view

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

@dependabot @github

dependabot Bot commented on behalf of github Sep 1, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@dependabot dependabot Bot added the ci label Sep 1, 2026
@dependabot
dependabot Bot requested a review from gHashTag as a code owner September 1, 2026 09:17
@dependabot dependabot Bot added the ci label Sep 1, 2026
@github-actions

github-actions Bot commented Sep 1, 2026

Copy link
Copy Markdown
Contributor

📓 NotebookLM Notebook linked to this PR

This notebook contains session context, decisions, and artifacts for this work.

@github-actions

github-actions Bot commented Sep 1, 2026

Copy link
Copy Markdown
Contributor

PR Dashboard

Generated at: 2026-09-01 09:17:50 UTC

Summary

Status Count
Total Open PRs 10
PRs with Failing Checks 7
PRs with All Checks Green 3
READY 0
FAILING 7
PENDING 0

Seal Status

  • ⚠️ STALE -- sha256(compiler.rs)=fd84214651ae != manifest seal=87e5cbd3ad94.
    The committed NMSE numbers were certified against an older compiler.rs.
    Run scripts/reseal-check.sh locally for the two-step reseal command (advisory; not a merge gate).

This was referenced Sep 1, 2026
@gHashTag

gHashTag commented Oct 2, 2026

Copy link
Copy Markdown
Owner

Reviewer bee X. Reviewed: a one-line major bump of a pinned action; the inputs this repo passes (subject-path / files / sarif_file) are unchanged across the major, and the job permissions the new major needs (contents / id-token / attestations write where relevant) are already declared. The only red check (compile-proofs) is unrelated to workflows. Labelled bee-reviewed. Not merged by me: the change touches .github/workflows and the reviewer token lacks the workflow scope -- awaiting the owner's merge.

@gHashTag

gHashTag commented Oct 2, 2026

Copy link
Copy Markdown
Owner

@dependabot rebase

(Reviewer bee: the required check parse-ratchet never ran on this head, which dates from 2026-09-14. A rebase gives the current required checks a fresh head to run on. I will re-review the rebased diff before re-applying bee-reviewed.)

Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3 to 4.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@v3...v4)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: '4'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/github_actions/github/codeql-action-4 branch from f79a98f to 73c8f24 Compare October 2, 2026 19:15
@github-actions

github-actions Bot commented Oct 2, 2026

Copy link
Copy Markdown
Contributor

📓 NotebookLM Notebook linked to this PR

This notebook contains session context, decisions, and artifacts for this work.

@github-actions

github-actions Bot commented Oct 2, 2026

Copy link
Copy Markdown
Contributor

PR Dashboard

Generated at: 2026-10-02 19:20:08 UTC

Summary

Status Count
Total Open PRs 39
PRs with Failing Checks 38
PRs with All Checks Green 1
READY 1
FAILING 38
PENDING 0
NO CHECKS YET 0

Seal Status

  • ⚠️ STALE -- sha256(compiler.rs)=b45a356c2eb6 != manifest seal=87e5cbd3ad94.
    The committed NMSE numbers were certified against an older compiler.rs.
    Run scripts/reseal-check.sh locally for the two-step reseal command (advisory; not a merge gate).

@gHashTag gHashTag added bee-reviewed A reviewer bee reviewed and verified this PR at its current head; the only merge signal (#5525) and removed bee-reviewed A reviewer bee reviewed and verified this PR at its current head; the only merge signal (#5525) labels Oct 2, 2026
@gHashTag

gHashTag commented Oct 2, 2026

Copy link
Copy Markdown
Owner

bee review (reviewer, not author) — head 73c8f24517c2de571dcd4ab389762f8fa823862e

Checked:

  • Diff is one line in .github/workflows/scorecard.yml: github/codeql-action/upload-sarif@v3 -> @v4. No other files.
  • codeql-action v4 changelog (4.30.7): the only v3->v4 change is the Node 24 runtime. Job runs on ubuntu-latest (GitHub-hosted, supports node24).
  • upload-sarif@v4 action.yml still declares sarif_file (the only input used). The job permissions still include security-events: write.
  • Required checks at this head: validate, check-linked-issue and parse-ratchet are all success.

Red checks not caused by this PR:

  • untrusted-input is red on master (9be91c7a) and on every open PR ("the corpus size is stated somewhere in the re-takes").
  • coverage (seal coverage) is red on master too.
  • integrity-gate and pack-index-consistency report SHA drift in conformance/vectors/*_conformance_v0.json, files this PR does not touch.
    None of these can be affected by changing a uses: tag in scorecard.yml.

Label bee-reviewed re-applied after this head.

@t27-bees t27-bees Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

bee review: see evidence comment

@gHashTag
gHashTag merged commit 04e7827 into master Oct 2, 2026
40 of 46 checks passed
@dependabot
dependabot Bot deleted the dependabot/github_actions/github/codeql-action-4 branch October 2, 2026 19:25
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bee-reviewed A reviewer bee reviewed and verified this PR at its current head; the only merge signal (#5525) ci

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant