ci(deps): group the three CodeQL sub-action bumps into one PR - #22
Open
msalvatti wants to merge 1 commit into
Open
ci(deps): group the three CodeQL sub-action bumps into one PR#22msalvatti wants to merge 1 commit into
msalvatti wants to merge 1 commit into
Conversation
There was a problem hiding this comment.
🟢 Ready to approve
The change is a small, low-risk Dependabot configuration update that aligns with the stated goal of keeping CodeQL sub-action versions in sync.
This review doesn't count toward merge requirements. Sign up for the private preview to control whether Copilot approvals count.
Pull request overview
Groups the github/codeql-action sub-actions into a single Dependabot update group so init, analyze, and upload-sarif are bumped together, avoiding CI breakage caused by mixed CodeQL action versions.
Changes:
- Add a
codeqlDependabot group for thegithub-actionsecosystem. - Match all
github/codeql-action/*action references and allow grouping across major/minor/patch updates.
File summaries
| File | Description |
|---|---|
.github/dependabot.yml |
Adds a Dependabot group to keep all CodeQL sub-action updates in one PR. |
Review details
- Files reviewed: 1/1 changed files
- Comments generated: 1
- Review effort level: Low
We're testing this review assessment. Please use 👍 or 👎 to tell us if it's correct.
Comment on lines
+20
to
+22
| # | ||
| # Loaded a configuration file for version '4.36.2', but running version '4.37.4' | ||
| # |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
github/codeql-action/init,/analyzeand/upload-sarifare separate action references, so Dependabot opens a separate PR for each. They are not separable:initwrites a config thatanalyzereads back, and the reader refuses a config written by a different version.That is why #10 (init) and #12 (analyze) are both red — each moves one half of a pair to 4.37.0 while the other stays at 4.36.2:
Merging one alone would leave
mainbroken until its sibling landed.This groups the three under one
codeqlentry covering all update types, so they move together in a change that is green by construction. The same grouping is going intonest-queue(bymaxone/nest-queue#38);nest-ai-tokens(#15 + #16) has the identical failure and needs it too.Does not fix the two already open. #10 and #12 both target 4.37.0 and are consistent with each other — merging them back to back is what unblocks them now (#11, upload-sarif, is already green and belongs in the same batch); the grouping takes effect on the next scheduled run.