build(codeql): coordinate CodeQL Action 4.37.8 lifecycle - #1026
build(codeql): coordinate CodeQL Action 4.37.8 lifecycle#1026dependabot[bot] wants to merge 24 commits into
Conversation
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
dependabot
Bot
added
the
dependencies
dependabot
Bot
added
the
dependencies
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
Bumps [github/codeql-action/init](https://github.com/github/codeql-action) from 4.37.0 to 4.37.8. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@99df26d...db488dd) --- updated-dependencies: - dependency-name: github/codeql-action/init dependency-version: 4.37.8 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
4af856c to
4a3ff13
Compare
seonghobae
changed the title
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
| DEFAULT_BRANCH_GUARD = "github.ref == format('refs/heads/{0}', github.event.repository.default_branch)" | ||
| PR_OR_DEFAULT_BRANCH = f"github.event_name == 'pull_request' || {DEFAULT_BRANCH_GUARD}" |
There was a problem hiding this comment.
📝 Info: Pull requests remain excluded
Pull-request refs cannot satisfy DEFAULT_BRANCH_GUARD. Removing the explicit event-name condition therefore preserves default-branch-only Scorecard publishing.
Was this helpful? React with 👍 or 👎 to provide feedback.
| publish_lines = [ | ||
| line.strip() | ||
| for line in contents.splitlines() | ||
| if line.strip().startswith("publish_results:") | ||
| ] | ||
| assert publish_lines == [f"publish_results: ${{{{ {DEFAULT_BRANCH_GUARD} }}}}"] |
There was a problem hiding this comment.
📝 Info: Publishing assertion covers every occurrence
The exact publish_lines comparison rejects duplicate or additional publishing settings. A matching fragment elsewhere can no longer satisfy the contract.
Was this helpful? React with 👍 or 👎 to provide feedback.
|
@opencode-agent Take the sole-writer lease for existing canonical dependency-security branch This branch now intentionally absorbs PR #1119's unique Trivy PR-head contract to converge the backlog: ordinary Known current-head RED: Use systematic-debugging/TDD and verification-before-completion. Run the focused supply-chain policy test, |
| pull_request: | ||
| branches: | ||
| - develop | ||
| - main |
There was a problem hiding this comment.
🔍 Existing workflow contract test now fails
The existing push-only contract rejects pull_request: in Scorecard and Trivy. These additions make the Python gate fail.
Was this helpful? React with 👍 or 👎 to provide feedback.
|
Extend the existing exact-head sole-writer task before release: PR #780 is an older overlapping CodeQL lifecycle owner and must not remain a parallel writer once its unique executable contract is preserved here. Fresh semantic comparison found one unique #780 requirement not fully covered by this branch's current If your sole-writer lease is still active on exact After the existing Trivy policy-test/CHANGELOG repair plus this CodeQL global-ref regression are present and focused/full GREEN on one successor exact head, report the exact successor SHA and files preserved. Do not close #780 yourself; the maintainer will independently verify semantic succession before closing it unmerged. |
| name: scorecard-sarif-upload | ||
| needs: analysis | ||
| if: github.ref == format('refs/heads/{0}', github.event.repository.default_branch) | ||
| if: github.event_name == 'pull_request' || github.ref == format('refs/heads/{0}', github.event.repository.default_branch) |
There was a problem hiding this comment.
🟡 Forked pull requests fail Scorecard upload
Fork pull requests run scorecard-sarif-upload without the requested write permission. The SARIF upload fails, leaving external contributions with a failed workflow.
Prompt for agents
The scorecard-sarif-upload job now runs for every pull_request, including pull requests from forks. GitHub downgrades GITHUB_TOKEN permissions for fork-triggered pull_request workflows, so security-events: write is unavailable and github/codeql-action/upload-sarif cannot upload the result. Preserve Scorecard analysis or artifact generation for fork PRs if useful, but gate the SARIF upload path to trusted same-repository pull requests (for example by comparing the head repository to github.repository), or provide another non-failing path for forks. Update the workflow contract test to cover the fork condition.
Was this helpful? React with 👍 or 👎 to provide feedback.
|
A newer version of github/codeql-action/init exists, but since this PR has been edited by someone other than Dependabot I haven't updated it. You'll get a PR for the updated version as normal once this PR is merged. |
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
1 participant
Superseded by canonical lifecycle owner #780
This branch is closed unmerged only after its unique behavior was reconstructed on the canonical CodeQL lifecycle branch rather than discarded.
Exact predecessor identity at succession review:
c0d4ebc35d79cef27df7f0c636db23727db24f52develop@749511c3ad4000090048718f685c6bee6b3d2c25Exact successor identity at transfer:
823a66200f7a9c846147d3632cc167c1c8f08c65develop:ahead_by=18,behind_by=0, merge base exactly protecteddevelopTechnical succession evidence
#1026's semantic delta had four responsibilities. Each is now present in #780/current successor:
init,autobuild,analyze, and bothupload-sarifcall sites on v4.37.8. fix(security): keep every CodeQL Action phase on one revision #780 now uses the strictly newer reviewed immutable v4.37.9 execution commitcdf488f595d80d6e07e03d4674febd5ab45fa938across every checked-in phase. Its broadtest_codeql_action_revision_contract.pyscans all workflow YAML, catches malformed/mutable refs, requires one exact SHA plus matching annotation, and separately requires init/autobuild/analyze atomicity.github-actionsconfigured label to repository taxonomyarea: ci-cd. fix(security): keep every CodeQL Action phase on one revision #780 preserves that exact config behavior in.github/dependabot.ymland carriestest_dependabot_label_contract.py.pull_requestexecution for develop/main, PR/default-branch evidence guards, default-branch-onlypublish_results, and trusted normalization-script checkout fromgithub.event.pull_request.base.sha. fix(security): keep every CodeQL Action phase on one revision #780 preserves each behavior and carriestest_scorecard_pr_code_scanning_contract.py; it does not usepull_request_target.test_codeql_action_version_contract.pyandtest_codeql_upload_sarif_version_contract.pyare subsumed by fix(security): keep every CodeQL Action phase on one revision #780's all-workflow revision guard, while its two unique non-version contracts are preserved as separate tests above.#780 also ordinary-merged current protected
developlineage before applying its GREEN repair, so this succession does not rely on stale-base text or predecessor evidence.Fresh exact-head workflows on #780 are still non-terminal and an independent non-author exact-head approval is absent. Therefore #780 remains Draft; queued/pending/skipped-required/cancelled/failed/neutral/stale/predecessor evidence remains non-passing.
Relates to #966.