From f4683dc3a5df07ce6aaecbe4264b836d3829a830 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sat, 26 Sep 2026 08:43:29 +0000 Subject: [PATCH 1/2] ci: bump github/codeql-action/upload-sarif in the codeql-action group Bumps the codeql-action group with 1 update: [github/codeql-action/upload-sarif](https://github.com/github/codeql-action). Updates `github/codeql-action/upload-sarif` from 4.38.0 to 4.38.1 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/b96794f015dfd88f77b49b1c93e0fa7110f94c63...1c5b675653bb5c22dbe9b12b556ec555138e09fd) --- updated-dependencies: - dependency-name: github/codeql-action/upload-sarif dependency-version: 4.38.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: codeql-action ... Signed-off-by: dependabot[bot] --- .github/workflows/scorecard.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index a44824c..8cb8927 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -38,6 +38,6 @@ jobs: results_file: results.sarif results_format: sarif publish_results: true - - uses: github/codeql-action/upload-sarif@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4 + - uses: github/codeql-action/upload-sarif@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4 with: sarif_file: results.sarif From f987b4310da1bd879c5d1eb80ac860550f29dc6e Mon Sep 17 00:00:00 2001 From: HetCreep <239326951+HetCreep@users.noreply.github.com> Date: Sat, 26 Sep 2026 17:02:11 +0700 Subject: [PATCH 2/2] ci: carry the upload-sarif pin into the template scorecard.yml (verify parity test) Dependabot bumps only /.github/workflows, and templates/published-code/.github/workflows/scorecard.yml must match the live file byte for byte (scripts/template-workflows.test.mjs:209), so the verify check stayed red and the auto-merge that was already enabled could never complete. This carries the same SHA into the template. Declared UNREVIEWED: an org-level surface whose deputy is held until 2026-10-01; the durable fix to the parity gate goes through INSPECT after the hold (owner 2026-09-26). Co-Authored-By: Claude Opus 5.5 --- templates/published-code/.github/workflows/scorecard.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/templates/published-code/.github/workflows/scorecard.yml b/templates/published-code/.github/workflows/scorecard.yml index a44824c..8cb8927 100644 --- a/templates/published-code/.github/workflows/scorecard.yml +++ b/templates/published-code/.github/workflows/scorecard.yml @@ -38,6 +38,6 @@ jobs: results_file: results.sarif results_format: sarif publish_results: true - - uses: github/codeql-action/upload-sarif@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4 + - uses: github/codeql-action/upload-sarif@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4 with: sarif_file: results.sarif