build(deps): bump github/codeql-action from 3.30.0 to 4.31.2 #1892
Conversation
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.30.0 to 4.31.2. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@v3.30.0...v4.31.2) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.31.2 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
bot
added
dependencies
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #1892 +/- ##
=======================================
Coverage 97.14% 97.14%
=======================================
Files 2 2
Lines 35 35
=======================================
Hits 34 34
Misses 1 1
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. |
![sentry[bot]](https://avatars.githubusercontent.com/in/12637?s=60&v=4){kind=small}
|
|
||
| # Initializes the CodeQL tools for scanning. | ||
| - name: Initialize CodeQL | ||
| uses: github/codeql-action/init@v3.30.0 | ||
| uses: github/codeql-action/init@v4.31.2 | ||
| with: | ||
| languages: ${{ matrix.language }} | ||
| # If you wish to specify custom queries, you can do so here or in a config file. |
There was a problem hiding this comment.
Bug: Upgrading codeql-action to v4.31.2 without setting Node.js v24 causes workflow failure due to version incompatibility.
Severity: CRITICAL | Confidence: 1.00
🔍 Detailed Analysis
The github/codeql-action v4.31.2 requires Node.js v24, but the workflow runs on ubuntu-latest which defaults to Node.js 20. The absence of an actions/setup-node step to configure Node.js v24 will prevent the CodeQL analysis and Scorecards upload actions from executing successfully. This will lead to a functional failure of the security scanning workflows.
💡 Suggested Fix
Add an actions/setup-node step to configure Node.js v24 before running github/codeql-action v4.31.2 in the workflow files.
🤖 Prompt for AI Agent
Review the code at the location below. A potential bug has been identified by an AI
agent.
Verify if this is a real issue. If it is, propose a fix; if not, explain why it's not
valid.
Location: .github/workflows/codeql-analysis.yml#L41-L47
Potential issue: The `github/codeql-action` v4.31.2 requires Node.js v24, but the
workflow runs on `ubuntu-latest` which defaults to Node.js 20. The absence of an
`actions/setup-node` step to configure Node.js v24 will prevent the CodeQL analysis and
Scorecards upload actions from executing successfully. This will lead to a functional
failure of the security scanning workflows.
Did we get this right? 👍 / 👎 to inform future reviews.
|
Superseded by #1897. |
dependabot
bot
deleted the
dependabot/github_actions/github/codeql-action-4.31.2
branch
Bumps github/codeql-action from 3.30.0 to 4.31.2.
Release notes
Sourced from github/codeql-action's releases.
... (truncated)
Changelog
Sourced from github/codeql-action's changelog.
... (truncated)
Commits
0499de3Merge pull request #3261 from github/henrymercer/setup-python3b96745Set up Python in mergeback workflow8a06050Merge pull request #3259 from github/update-v4.31.2-9576b5cbe752a642Update changelog for v4.31.29576b5cMerge pull request #3258 from github/mbg/enablement-errors/case-insensitivecc88437Merge pull request #3257 from github/henrymercer/ubuntu-slimf0e9bf0MakeisEnablementErrorcase-insensitive2a3599cRun lightweight workflows onubuntu-slim514ff4dMerge pull request #3256 from github/henrymercer/resolve-bad-mergeaab1c2fMerge pull request #3253 from github/mergeback/v4.31.1-to-main-5fe9434cDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot mergewill merge this PR after your CI passes on it@dependabot squash and mergewill squash and merge this PR after your CI passes on it@dependabot cancel mergewill cancel a previously requested merge and block automerging@dependabot reopenwill reopen this PR if it is closed@dependabot closewill close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)