From 6487208a3695da6fe4361b166228d121eb0a0408 Mon Sep 17 00:00:00 2001 From: Dan Wolfson Date: Sat, 10 Oct 2026 20:34:03 -0500 Subject: [PATCH] chore(deps): bump github/codeql-action init+analyze to 4.38.2 together; group them in Dependabot Dependabot opened #395 (analyze) and #396 (init) separately, and each failed CodeQL on its own: 'Loaded a configuration file for version 4.38.2, but running version 4.38.1'. This bumps both pins in one change and adds a Dependabot group so future bumps arrive as a single PR. Supersedes #395 and #396. Signed-off-by: Dan Wolfson --- .github/dependabot.yml | 7 +++++++ .github/workflows/codeql.yml | 4 ++-- 2 files changed, 9 insertions(+), 2 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 88ee53ae..75ca701b 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -7,6 +7,13 @@ updates: # Keeps the SHA-pinned `uses:` refs in .github/workflows/*.yml current -- # Dependabot resolves the new tag to its commit SHA itself, so pinning # doesn't mean these go stale silently. + groups: + # codeql-action/init and codeql-action/analyze must run the same version + # ("Loaded a configuration file for version X, but running version Y"), + # so bump them in one PR -- separate PRs each fail CodeQL (#395/#396). + codeql-action: + patterns: + - "github/codeql-action*" - package-ecosystem: "pip" directory: "/" diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 3b27adca..295a0ca4 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -20,7 +20,7 @@ jobs: steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: github/codeql-action/init@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1 + - uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2 with: languages: python # Scoped to real package source -- excludes vendored/generated @@ -40,6 +40,6 @@ jobs: - '**/data/**' - '**/*.json' - - uses: github/codeql-action/analyze@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1 + - uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2 with: category: "/language:python"