chore(deps): bump github/codeql-action from 3.28.5 to 3.28.8 #196
Conversation
![dependabot[bot]](https://avatars.githubusercontent.com/in/29110?s=60&v=4){kind=small}
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.28.5 to 3.28.8. - [Release notes](https://github.com/github/codeql-action/releases) - [Commits](github/codeql-action@v3.28.5...v3.28.8) --- updated-dependencies: - dependency-name: github/codeql-action dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
|
/code pr |
There was a problem hiding this comment.
🤖
Reviewing the changes in the GitHub Actions workflows:
.github/workflows/charts.yml
Observations:
- Updated GitHub CodeQL Action versions from
v3.28.5tov3.28.8- Lines 80, 82: CodeQL init and analyse actions
- Line 95: Upload SARIF results action
.github/workflows/scorecard.yml
Observations:
- Updated GitHub CodeQL upload-sarif action reference
- Line 33: Changed commit hash while keeping version at
v2.22.11
- Line 33: Changed commit hash while keeping version at
Code looks clean and follows standard GitHub Actions version update practice. No specific issues or suggestions.
> claude-3-5-haiku-latest [pr | 0]
|
/code pr |
There was a problem hiding this comment.
🤖
.github/workflows/charts.yml:
• The CodeQL actions (init, analyze, upload-sarif) have been updated from v3.28.5 to v3.28.8. Verify that the new version’s behaviour remains compatible with your workflows.
• The continue-on-error settings have been preserved; double-check that this is still the desired approach for error management.
.github/workflows/scorecard.yml:
• The upload-sarif action now uses a different commit hash (0701025a8b1600e416be4f3bb5a830b1aa6af01e) while retaining the label v2.22.11. Confirm that this revision does not introduce any unexpected changes.
> o3-mini [pr | 1]
|
/code pr |
There was a problem hiding this comment.
🤖
Summary of Changes and Suggestions
File: .github/workflows/charts.yml
Changes:
- The CodeQL Action versions have been updated from
v3.28.5tov3.28.8for bothinitializeandanalyzesteps. - The
upload-sarifstep for CodeQL has also been updated to versionv3.28.8.
Suggestions:
- Consistency Check: Ensure that updating the CodeQL Action to
v3.28.8does not introduce any compatibility issues with other dependencies or scripts in your workflows. It's a good practice to test the updated actions for any regressions.
File: .github/workflows/scorecard.yml
Changes:
- The
upload-sarifstep has been updated to a newer commit hash0701025a8b1600e416be4f3bb5a830b1aa6af01einstead of the previous commit hashe7c0c9d71b7bd108fd12e06b56fc58d3d154164d.
Suggestions:
- Pin to Version: If possible, pin the
upload-sarifaction to a specific version number instead of a commit hash for easier version tracking and rollback if necessary. For instance, specifyv2.22.11explicitly if that corresponds with the commit.
Issues Noted
- Switch from Commit to Version: In the
scorecard.yml, the change from a commit hash to a more stable version identifier when available is generally better for maintainability. If the exact versionv2.22.11corresponds to0701025a8b1600e416be4f3bb5a830b1aa6af01e, update the comment to reflect this accurately.
By addressing these suggestions, your workflows should remain stable and maintainable as you update their components.
> microsoft/phi-4 [pr | 0]
saidsef
deleted the
dependabot-github_actions-github-codeql-action-3.28.8
branch
Bumps github/codeql-action from 3.28.5 to 3.28.8.
Release notes
Sourced from github/codeql-action's releases.
Commits
dd74661Merge pull request #2746 from github/update-v3.28.8-a91a3f7673210a3cFix Kotlin version in changelog72f9d02Update changelog for v3.28.8a91a3f7Merge pull request #2744 from github/igfoo/kot2.1.10c520fb5Merge pull request #2745 from github/mergeback/v3.28.7-to-main-6e5455903879c57Add changelog entry0c21937Run "npm run build"5a61bf0Kotlin: The 2.20.3 release supports Kotlin 2.1.10.163d119Update checked-in dependenciesbcf5cecUpdate changelog and version after v3.28.7Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot mergewill merge this PR after your CI passes on it@dependabot squash and mergewill squash and merge this PR after your CI passes on it@dependabot cancel mergewill cancel a previously requested merge and block automerging@dependabot reopenwill reopen this PR if it is closed@dependabot closewill close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)