chore(deps): Bump github/codeql-action from 4.35.2 to 4.35.3 by dependabot[bot] · Pull Request #122 · combsmith/ContentTwin

dependabot · 2026-05-02T10:12:57Z

Bumps github/codeql-action from 4.35.2 to 4.35.3.

Release notes

Sourced from github/codeql-action's releases.

v4.35.3

Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.19.3 and earlier. These versions of CodeQL were discontinued on 9 April 2026 alongside GitHub Enterprise Server 3.15, and will be unsupported by the next minor release of the CodeQL Action. #3837

Configurations for private registries that use Cloudsmith or GCP OIDC are now accepted. #3850

Best-effort connection tests for private registries now use GET requests instead of HEAD for better compatibility with various registry implementations. For NuGet feeds, the test is now always performed against the service index. #3853

Fixed a bug where two diagnostics produced within the same millisecond could overwrite each other on disk, causing one of them to be lost. #3852

Update default CodeQL bundle version to 2.25.3. #3865

Changelog

Sourced from github/codeql-action's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.35.3 - 01 May 2026

Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.19.3 and earlier. These versions of CodeQL were discontinued on 9 April 2026 alongside GitHub Enterprise Server 3.15, and will be unsupported by the next minor release of the CodeQL Action. #3837

Configurations for private registries that use Cloudsmith or GCP OIDC are now accepted. #3850

Best-effort connection tests for private registries now use GET requests instead of HEAD for better compatibility with various registry implementations. For NuGet feeds, the test is now always performed against the service index. #3853

Fixed a bug where two diagnostics produced within the same millisecond could overwrite each other on disk, causing one of them to be lost. #3852

Update default CodeQL bundle version to 2.25.3. #3865

4.35.2 - 15 Apr 2026

The undocumented TRAP cache cleanup feature that could be enabled using the CODEQL_ACTION_CLEANUP_TRAP_CACHES environment variable is deprecated and will be removed in May 2026. If you are affected by this, we recommend disabling TRAP caching by passing the trap-caching: false input to the init Action. #3795

The Git version 2.36.0 requirement for improved incremental analysis now only applies to repositories that contain submodules. #3789

Python analysis on GHES no longer extracts the standard library, relying instead on models of the standard library. This should result in significantly faster extraction and analysis times, while the effect on alerts should be minimal. #3794

Fixed a bug in the validation of OIDC configurations for private registries that was added in CodeQL Action 4.33.0 / 3.33.0. #3807

Update default CodeQL bundle version to 2.25.2. #3823

4.35.1 - 27 Mar 2026

Fix incorrect minimum required Git version for improved incremental analysis: it should have been 2.36.0, not 2.11.0. #3781

4.35.0 - 27 Mar 2026

Reduced the minimum Git version required for improved incremental analysis from 2.38.0 to 2.11.0. #3767

Update default CodeQL bundle version to 2.25.1. #3773

4.34.1 - 20 Mar 2026

Downgrade default CodeQL bundle version to 2.24.3 due to issues with a small percentage of Actions and JavaScript analyses. #3762

4.34.0 - 20 Mar 2026

Added an experimental change which disables TRAP caching when improved incremental analysis is enabled, since improved incremental analysis supersedes TRAP caching. This will improve performance and reduce Actions cache usage. We expect to roll this change out to everyone in March. #3569

We are rolling out improved incremental analysis to C/C++ analyses that use build mode none. We expect this rollout to be complete by the end of April 2026. #3584

Update default CodeQL bundle version to 2.25.0. #3585

4.33.0 - 16 Mar 2026

Upcoming change: Starting April 2026, the CodeQL Action will skip collecting file coverage information on pull requests to improve analysis performance. File coverage information will still be computed on non-PR analyses. Pull request analyses will log a warning about this upcoming change. #3562

To opt out of this change:

Repositories owned by an organization: Create a custom repository property with the name github-codeql-file-coverage-on-prs and the type "True/false", then set this property to true in the repository's settings. For more information, see Managing custom properties for repositories in your organization. Alternatively, if you are using an advanced setup workflow, you can set the CODEQL_ACTION_FILE_COVERAGE_ON_PRS environment variable to true in your workflow.

User-owned repositories using default setup: Switch to an advanced setup workflow and set the CODEQL_ACTION_FILE_COVERAGE_ON_PRS environment variable to true in your workflow.

... (truncated)

Commits

e46ed2c Merge pull request #3867 from github/update-v4.35.3-8c6e48dbe
b73d1d1 Add changelog entry for #3853
24e0bb0 Reorder changelog entries
ec298da Update changelog for v4.35.3
8c6e48d Merge pull request #3865 from github/update-bundle/codeql-bundle-v2.25.3
7190983 Add changelog note
2bb2095 Update default bundle to codeql-bundle-v2.25.3
7851e55 Merge pull request #3850 from github/mbg/private-registry/cloudsmith-gcp
262a15f Add generic non-printable chars test for OIDC configs
a6109b1 Merge pull request #3853 from github/mbg/start-proxy/improved-checks
Additional commits viewable in compare view

don-petry · 2026-05-04T11:36:54Z

@dependabot rebase

Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.35.2 to 4.35.3. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@95e58e9...e46ed2c) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.35.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>

…on-4.35.3

sonarqubecloud · 2026-05-04T11:44:34Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.35.2 to 4.35.3. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@95e58e9...e46ed2c) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.35.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: don-petry <36422719+don-petry@users.noreply.github.com>

@v1

…deation.yml-permissions (#371) * Add Claude Code GitHub Action (#5) * Add Claude Code GitHub Action for PR reviews * fix: address review feedback on Claude Code workflow - Restrict issue_comment trigger to PR comments only - Add author-association check (OWNER/MEMBER/COLLABORATOR) - Add pull_request_review_comment trigger - Add timeout-minutes to prevent runaway jobs Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: use CLAUDE_CODE_OAUTH_TOKEN org secret Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: add id-token: write permission for OAuth auth Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: address remaining review comments - Pin claude-code-action to commit SHA for supply-chain safety - Add fork PR guard (secrets unavailable for fork PRs) - Scope pull_request trigger to main branch - Use >- folded scalar for if expression Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: address OpenSSF Scorecard findings (#12) * fix: address OpenSSF Scorecard findings - Add SECURITY.md (#8) - Scope workflow token permissions (#9) - Add Dependabot configuration (#10) - Ensure SAST runs on all commits (#11) Closes #8, #9, #10, #11 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: use correct CodeQL action commit SHA The previous SHA was invalid. Updated to the actual v3 commit SHA. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: address PR review comments - Replace permissions: read-all with permissions: {} (deny-by-default) - Add actions: read to CodeQL workflow permissions - Add concrete security contact email to SECURITY.md Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: use claude_code_oauth_token instead of anthropic_api_key The action has separate inputs for API keys vs OAuth tokens. CLAUDE_CODE_OAUTH_TOKEN is an OAuth token, not an API key. --------- Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore(deps): Bump github/codeql-action from 3.35.1 to 4.35.1 (#15) Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.35.1 to 4.35.1. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@5c8a8a6...c10b806) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.35.1 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: don-petry <36422719+don-petry@users.noreply.github.com> * chore(deps): Bump actions/checkout from 4.2.2 to 6.0.2 (#16) Bumps [actions/checkout](https://github.com/actions/checkout) from 4.2.2 to 6.0.2. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@v4.2.2...de0fac2) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 6.0.2 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: don-petry <36422719+don-petry@users.noreply.github.com> * chore(deps): Bump anthropics/claude-code-action from 1.0.80 to 1.0.81 (#13) Bumps [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) from 1.0.80 to 1.0.81. - [Release notes](https://github.com/anthropics/claude-code-action/releases) - [Commits](anthropics/claude-code-action@094bd24...e7b588b) --- updated-dependencies: - dependency-name: anthropics/claude-code-action dependency-version: 1.0.81 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore: enable Claude issue trigger per org CI standard (#30) Add issues:[labeled] event trigger and claude label support so Claude can work issues autonomously — reading the issue, creating a branch, implementing the fix, and opening a PR. Changes: - Add issues:[labeled] trigger to on: block - Add issue label condition to job if: guard - Upgrade contents permission to write (needed for branch creation) - Pin claude-code-action to v1.0.89 (6e2bd528) - Add label_trigger: "claude" input - Add dependabot skip condition on step - Add permission comment for contents: write Matches the standard defined in combsmith/.github#24. Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: add checkout step to Claude workflow for issue-triggered mode (#31) The claude-code-action runs git fetch/checkout internally during branch setup but requires the repository to already be cloned on the runner. Without actions/checkout, issue-triggered runs fail with: fatal: not a git repository Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * feat: split Claude workflow into interactive + issue automation jobs (#39) * feat: split Claude workflow into interactive + issue automation jobs Aligns with the org standard in petry-projects/.github. The claude-issue job runs in automation mode with tools to create PRs, self-review, check CI, and tag code owners when ready. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: add concurrency guard and comment tools to claude-issue job - Add concurrency group keyed on issue number to prevent duplicate runs - Add gh pr comment and gh issue comment to allowedTools for review replies, thread resolution, and code owner tagging - Remove Bash(cat:*) since the Read tool already covers file reads Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * feat: switch to org-level reusable Claude Code workflow (#40) * feat: add workflow to create code-quality repository ruleset Creates the required 'code-quality' branch ruleset with SonarCloud as a required status check on the default branch. This workflow runs on every push to main (idempotent) to ensure the ruleset stays in sync. Closes #28 Co-authored-by: don-petry <don-petry@users.noreply.github.com> * revert: remove workflow approach - cannot push workflow files * chore(workflows): adopt centralized stubs from petry-projects/.github (#52) Replace inline copies of standardized workflows with the canonical thin caller stubs from petry-projects/.github/standards/workflows/. Each stub delegates to a versioned reusable workflow at petry-projects/.github/.github/workflows/<name>-reusable.yml@v1, so future updates to the standard propagate automatically and drift is caught by the org-wide compliance audit. See combsmith/.github#87, #88, #89 for context. Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore(deps): Bump github/codeql-action from 4.35.1 to 4.35.2 (#84) Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.35.1 to 4.35.2. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@c10b806...95e58e9) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.35.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * fix: correct reusable workflow path (remove duplicate .github/) (#114) fix: correct reusable workflow path (remove duplicate .github/ segment) Changed: petry-projects/.github/.github/workflows/... To: petry-projects/.github/workflows/... Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com> * Revert "fix: correct reusable workflow path (remove duplicate .github/) (#114)" This reverts commit d49958d. * ci: add auto-rebase workflow and check_run trigger to claude.yml * add check_run trigger to claude.yml * add auto-rebase.yml workflow * chore(deps): Bump github/codeql-action from 4.35.2 to 4.35.3 (#122) Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.35.2 to 4.35.3. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@95e58e9...e46ed2c) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.35.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: don-petry <36422719+don-petry@users.noreply.github.com> * chore(deps): Bump github/codeql-action from 4.35.3 to 4.35.4 (#138) Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.35.3 to 4.35.4. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@e46ed2c...68bde55) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.35.4 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: dependabot-automerge-petry[bot] <270452309+dependabot-automerge-petry[bot]@users.noreply.github.com> * chore: delete stray codeql.yml workflow (#107) * chore: delete stray codeql.yml workflow The org now uses GitHub-managed CodeQL default setup. Per-repo workflow files are drift and run duplicate analysis alongside the default setup. This file contained no custom query packs, build modes, or path filters that would warrant an exception. Closes #66 Co-authored-by: don-petry <don-petry@users.noreply.github.com> * retrigger: bump workflows to run checks --------- Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: don-petry <don-petry@users.noreply.github.com> Co-authored-by: Claude <claude@anthropic.com> * ci: remove drift codeql.yml — GitHub-managed default setup is active (#98) retrigger: bump workflows to run checks Co-authored-by: Claude <claude@anthropic.com> * chore(dev-lead): remove claude.yml — replaced by dev-lead.yml (#156) * fix(compliance): enable delete_branch_on_merge repository setting (#102) * fix(compliance): enable delete_branch_on_merge repository setting Apply the `delete_branch_on_merge` repository setting required by org standards (standards/github-settings.md#merge-settings). This is a repository-level setting applied via the GitHub API: gh api -X PATCH repos/petry-projects/ContentTwin \ -f delete_branch_on_merge=true # confirmed: true Closes #62 Co-authored-by: don-petry <don-petry@users.noreply.github.com> * retrigger: bump workflows to run checks --------- Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: don-petry <don-petry@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Claude <claude@anthropic.com> * fix: update code-quality ruleset to full required check list (#100) * fix: update code-quality ruleset to full required check list Add all required status checks to scripts/setup-rulesets.sh: - SonarCloud, Analyze (actions), Lint, Format - agent-shield / AgentShield, dependency-audit / Detect ecosystems Explicitly excludes claude-code / claude (see comment) to avoid deadlocking workflow-modifying PRs. Also enables strict_required_status_checks_policy to match the live ruleset. Closes #81 Co-authored-by: don-petry <don-petry@users.noreply.github.com> * retrigger: bump workflows to run checks --------- Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: don-petry <don-petry@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Claude <claude@anthropic.com> * fix(compliance): enable delete_branch_on_merge repository setting (#95) * fix(compliance): enable delete_branch_on_merge repository setting The repository setting `delete_branch_on_merge` must be enabled per org standards (standards/github-settings.md#repository-settings--standard-defaults). Applied via GitHub API: gh api -X PATCH repos/petry-projects/ContentTwin -f delete_branch_on_merge=true This is a repository-level setting, not a file change. The next weekly compliance audit will verify the fix and auto-close this finding. Closes #62 Co-authored-by: don-petry <don-petry@users.noreply.github.com> * retrigger: bump workflows to run checks --------- Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: don-petry <don-petry@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Claude <claude@anthropic.com> * fix: pin dependabot-automerge reusable workflow to SHA (#90) * fix: pin dependabot-automerge reusable workflow to SHA Pins petry-projects/.github reusable workflow from @v1 to commit SHA ee22b427cbce9ecadcf2b436acb57c3adf0cb63d (v1) to satisfy the action-pinning policy. Closes #58. Co-authored-by: don-petry <don-petry@users.noreply.github.com> * retrigger: bump workflows to run checks --------- Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: don-petry <don-petry@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Claude <claude@anthropic.com> * feat: implement issue #146 — Compliance: secret_scanning_non_provider_patterns (#170) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #134 — Compliance: check-suite-auto-trigger-347564 (#167) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #147 — Compliance: dependabot_security_updates (#166) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #132 — Compliance: non-stub-dependabot-rebase.yml (#165) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #143 — Compliance: non-stub-dependabot-automerge.yml (#164) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #133 — Compliance: check-suite-auto-trigger-1236702 (#172) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #142 — Compliance: codeowners-org-leads-not-first (#163) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #174 — [Fleet Monitor] petry-projects/ContentTwin — dev-lead.yml (#175) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #131 — Compliance: codeowners-no-catchall (#162) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #144 — Compliance: non-stub-pr-review-mention.yml (#177) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * rollout: deploy pr-review-mention standard workflow (#211) * rollout: deploy pr-review-mention standard workflow * chore: apply manual instructions [skip ci-relay] --------- Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * fix: correct pr-auto-review reusable workflow reference (#219) * fix: correct pr-auto-review reusable workflow reference * chore: apply manual instructions [skip ci-relay] --------- Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * deploy: add pr-review.yml workflow (#222) Co-authored-by: Claude Code Bot <noreply@anthropic.com> * feat: implement issue #205 — Compliance: gitignore_secrets_block (#230) * feat: implement issue #205 — Compliance: gitignore_secrets_block * chore: apply manual instructions [skip ci-relay] * chore: apply manual instructions [skip ci-relay] * fix(reviews): address review comments [skip ci-relay] * fix(reviews): address review comments [skip ci-relay] --------- Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #286 — Compliance: check-suite-prefs-unreadable (#291) * feat: implement issue #286 — Compliance: check-suite-prefs-unreadable * chore: apply manual instructions [skip ci-relay] --------- Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * chore: sync 6 org-standard workflow stub(s) from petry-projects/.github (#293) * chore: sync 6 org-standard workflow stub(s) from petry-projects/.github * chore: sync 6 org-standard workflow stub(s) from petry-projects/.github * chore: sync 6 org-standard workflow stub(s) from petry-projects/.github * chore: sync 6 org-standard workflow stub(s) from petry-projects/.github * chore: sync 6 org-standard workflow stub(s) from petry-projects/.github * chore: sync 6 org-standard workflow stub(s) from petry-projects/.github * fix(ci): auto-fix for SonarCloud Code Analysis [skip ci-relay] * fix(reviews): address review comments [skip ci-relay] --------- Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * ci: inline NOSONAR(S7637) markers on first-party caller stubs (#549 canonical migration) (#308) * ci: inline NOSONAR(S7637) marker on add-to-project.yml channel ref (#549) * ci: inline NOSONAR(S7637) marker on agent-shield.yml channel ref (#549) * ci: inline NOSONAR(S7637) marker on auto-rebase.yml channel ref (#549) * ci: inline NOSONAR(S7637) marker on dependabot-automerge.yml channel ref (#549) * ci: inline NOSONAR(S7637) marker on dependabot-rebase.yml channel ref (#549) * ci: inline NOSONAR(S7637) marker on dependency-audit.yml channel ref (#549) * ci: inline NOSONAR(S7637) marker on dev-lead.yml channel ref (#549) * ci: inline NOSONAR(S7637) marker on pr-auto-review.yml channel ref (#549) * ci: inline NOSONAR(S7637) marker on pr-review-mention.yml channel ref (#549) * ci: inline NOSONAR(S7637) marker on pr-review.yml channel ref (#549) * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github (#327) * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: dev-lead update (review-changes) [skip ci-relay] --------- Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * fix: re-pin agent_ref inputs to v-form (missed by #657 uses:-only re-pin) (#328) fix: re-pin agent_ref to v-form for add-to-project.yml [#657] * feat: implement issue #342 — Compliance: dev-lead-stub-agent-ref (#349) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * chore: insert org secrets baseline in .gitignore (#366) * chore: insert org secrets baseline in .gitignore * fix(reviews): address review comments [skip ci-relay] --------- Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #346 — Compliance: stub-surface-drift-feature-ideation.yml-permissions * chore: dev-lead update (review-changes) [skip ci-relay] * fix(bot): address bot feedback [skip ci-relay] * fix(bot): address bot feedback [skip ci-relay] * fix: restore secrets-baseline END sentinel and add-to-project trailing newline Reverts two accidental truncation hunks unrelated to issue #346, per the automated review: .gitignore's org-managed secrets-baseline closing sentinel must not be edited, and the add-to-project.yml stub newline removal was pointless drift. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: don-petry <don-petry@users.noreply.github.com> Co-authored-by: dependabot-automerge-petry[bot] <270452309+dependabot-automerge-petry[bot]@users.noreply.github.com> Co-authored-by: Claude <claude@anthropic.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com>

dependabot Bot added dependencies Dependency update PRs security Security-related PRs and issues labels May 2, 2026

dependabot Bot requested a review from don-petry as a code owner May 2, 2026 10:12

dependabot Bot added the security Security-related PRs and issues label May 2, 2026

combsmith-dependabot-automrg Bot approved these changes May 2, 2026

View reviewed changes

combsmith-dependabot-automrg Bot enabled auto-merge (squash) May 2, 2026 10:13

dependabot Bot force-pushed the dependabot/github_actions/github/codeql-action-4.35.3 branch from 3f3f947 to 832a537 Compare May 4, 2026 11:37

combsmith-dependabot-automrg Bot approved these changes May 4, 2026

View reviewed changes

Merge branch 'main' into dependabot/github_actions/github/codeql-acti…

5fae316

…on-4.35.3

combsmith-dependabot-automrg Bot approved these changes May 4, 2026

View reviewed changes

combsmith-dependabot-automrg Bot merged commit 0feb5a7 into main May 4, 2026
18 checks passed

combsmith-dependabot-automrg Bot deleted the dependabot/github_actions/github/codeql-action-4.35.3 branch May 4, 2026 11:44

Navigation Menu

Repository navigation

chore(deps): Bump github/codeql-action from 4.35.2 to 4.35.3 - #122

chore(deps): Bump github/codeql-action from 4.35.2 to 4.35.3#122
combsmith-dependabot-automrg[bot] merged 2 commits into
mainfrom
dependabot/github_actions/github/codeql-action-4.35.3

dependabot Bot commented on behalf of github May 2, 2026 •

edited

Loading

Uh oh!

don-petry commented May 4, 2026

Uh oh!

sonarqubecloud Bot commented May 4, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github May 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v4.35.3

CodeQL Action Changelog

[UNRELEASED]

4.35.3 - 01 May 2026

4.35.2 - 15 Apr 2026

4.35.1 - 27 Mar 2026

4.35.0 - 27 Mar 2026

4.34.1 - 20 Mar 2026

4.34.0 - 20 Mar 2026

4.33.0 - 16 Mar 2026

Uh oh!

don-petry commented May 4, 2026

Uh oh!

sonarqubecloud Bot commented May 4, 2026

Quality Gate passed

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

dependabot Bot commented on behalf of github May 2, 2026 •

edited

Loading