fix(ci): keep CodeQL Action versions consistent - #723
Conversation
Bumps [github/codeql-action/analyze](https://github.com/github/codeql-action) from 4.37.0 to 4.37.4. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@99df26d...f205ea1) --- updated-dependencies: - dependency-name: github/codeql-action/analyze dependency-version: 4.37.4 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
…-action/analyze-4.37.4
|
Warning Review limit reached
Next review available in: 47 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
📝 WalkthroughWalkthroughPR 헤드, 병합 미리보기, 예약 보안 스캔 워크플로의 CodeQL ChangesCodeQL 액션 버전 업데이트
Estimated code review effort: 1 (Trivial) | ~2 minutes Possibly related PRs
Suggested labels: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
|
@coderabbitai review |
✅ Action performedReview finished.
|
seonghobae
left a comment
seonghobae
left a comment
There was a problem hiding this comment.
Re-evaluate the exact current head after the workflow-version contract repair and current security checks.
|
@coderabbitai review |
✅ Action performedReview finished.
|
|
@coderabbitai full review |
✅ Action performedFull review finished. |
seonghobae
left a comment
seonghobae
left a comment
There was a problem hiding this comment.
Please re-evaluate the exact current head after the CodeQL action-version consistency repair. The direct current-head security workflows and CodeRabbit check are green, and there are no unresolved review threads.
Pull request was converted to draft
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
|
@coderabbitai review Please review the exact current head |
|
✅ Action performedReview finished.
|
|
Closing in favor of #728, which contains only the two CodeQL workflow files required to restore version consistency. This branch also accumulated unrelated Strix dependency and cryptography lock changes, so merging it would couple an independent supply-chain update to a workflow-contract repair. The dependency changes should remain separately reviewable. |
|
@coderabbitai review Please review exact bootstrap head |
|
✅ Action performedReview finished.
|
|
Closing in favor of #729. This four-file bootstrap now has complete direct security evidence, but it still lacks an independent approval and does not resolve the protected-base stale-pin self-healing failure that blocks |
![opencode-agent[bot]](https://avatars.githubusercontent.com/in/1549082?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.
Findings
1. HIGH Current-head GitHub Checks - Fix failed required checks before approval
- Problem: Failed same-head checks remain for
54aa21b59c6c2cba28c7c2289ced62005b4b5906. - Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
- Fix: Read and fix the failed check logs below, then rerun the current-head checks.
- Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.
Failed checks:
- OSV-Scanner PR/osv-scan / osv-scan: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/30884905044/job/91913852008)
- SAST Semgrep/Semgrep (multi-language SAST): CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/30884904295/job/91913849024)
- SBOM Generation/generate-sbom: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/30884904746/job/91913851026)
- Scorecard PR/Scorecard: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/30884904344/job/91913849242)
- Secret Scan/gitleaks (secret scan): CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/30884904304/job/91913849079)
- Security Scan/osv-scan: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/30884904265/job/91913849601)
- Strix Security Scan/strix: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/30884904678/job/91913850744)
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow (2 files)"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow (2 files)"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file (2 files)"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Changed file (2 files)"]
R2 --> V2["required checks"]
OpenCode Review Overview
Pull request overviewOpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed. Findings1. HIGH Current-head GitHub Checks - Fix failed required checks before approval
Failed checks:
Changed-File Evidence Mapflowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow (2 files)"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow (2 files)"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file (2 files)"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Changed file (2 files)"]
R2 --> V2["required checks"]
|
2 participants
Bootstrap deadlock
Two independent central-base defects form a protected-check cycle:
aiohttp==3.14.1andcryptography==49.0.0, causing Python Security to fail even for a clean two-file workflow PR.A CodeQL-only PR cannot pass Python Security, while a dependency-only or resolver PR cannot obtain the required central coverage/review evidence from the inconsistent base. This PR is the smallest exact-head bootstrap that fixes both base defects without suppressing either gate.
Change
github/codeql-action/init,analyze, andupload-sarifstep incodeql-pr.ymlandscheduled-security-scan.ymlto immutable CodeQL Action v4.37.4;requirements-strix-ci.txtand its generated hash lock toaiohttp==3.14.3,cryptography==50.0.0, and compatibleprotobuf==6.33.6;Exact-head evidence
Head
54aa21b59c6c2cba28c7c2289ced62005b4b5906completed all direct protected checks successfully:The final diff is exactly four governed files. Independent approval and the normal merge rule remain required; no protection is bypassed.
After this bootstrap merges, #728 is superseded and #703 can be reduced to its npm-workspace resolver scope against the corrected base.