From dbc67c476060dc34b466bf8b540d55e5add634d4 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Sun, 11 Oct 2026 13:33:55 +0000 Subject: [PATCH] chore(deps): update github/codeql-action action to v4.38.3 --- .github/workflows/betterleaks.yml | 2 +- .github/workflows/build-container-bake.yml | 2 +- .github/workflows/build-container.yml | 2 +- .github/workflows/codeql.yml | 4 ++-- .github/workflows/go-check.yml | 2 +- .github/workflows/release-go-app.yml | 2 +- .github/workflows/scorecard.yml | 2 +- .github/workflows/security-container.yml | 2 +- 8 files changed, 9 insertions(+), 9 deletions(-) diff --git a/.github/workflows/betterleaks.yml b/.github/workflows/betterleaks.yml index 4a74604..b21f283 100644 --- a/.github/workflows/betterleaks.yml +++ b/.github/workflows/betterleaks.yml @@ -82,7 +82,7 @@ jobs: - name: Upload SARIF to code scanning if: always() && hashFiles('betterleaks.sarif') != '' - uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2 + uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3 with: sarif_file: betterleaks.sarif category: betterleaks diff --git a/.github/workflows/build-container-bake.yml b/.github/workflows/build-container-bake.yml index 0a29d5a..1bdf513 100644 --- a/.github/workflows/build-container-bake.yml +++ b/.github/workflows/build-container-bake.yml @@ -620,7 +620,7 @@ jobs: && github.event_name != 'merge_group' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) && steps.trivy.outputs.count != '0' - uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2 + uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3 with: # No `category` here: each SARIF carries its own distinct category # (automationDetails.id set in the scan step) so multi-target scans diff --git a/.github/workflows/build-container.yml b/.github/workflows/build-container.yml index 8614b81..4dc6b40 100644 --- a/.github/workflows/build-container.yml +++ b/.github/workflows/build-container.yml @@ -353,7 +353,7 @@ jobs: && github.event_name != 'merge_group' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) && hashFiles('trivy-results.sarif') != '' - uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2 + uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3 with: sarif_file: "trivy-results.sarif" category: "container-scan" diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 6ffeebc..091fc94 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -190,7 +190,7 @@ jobs: # analysis produced was clear-text logging of a credential in a Playwright # login helper — test code leaks into CI logs like any other code. - name: Initialize CodeQL - uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2 + uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3 with: languages: ${{ matrix.language }} queries: security-and-quality @@ -229,7 +229,7 @@ jobs: run: bash -euo pipefail -c "$PRE_BUILD_CMD" - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2 + uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3 with: category: /language:${{ matrix.language }} # On `merge_group` the analysis runs but its result is not uploaded. diff --git a/.github/workflows/go-check.yml b/.github/workflows/go-check.yml index 70e5be4..2ddae68 100644 --- a/.github/workflows/go-check.yml +++ b/.github/workflows/go-check.yml @@ -547,7 +547,7 @@ jobs: # failure on every successful merge. Push and pull_request events # re-run the same scan with a stable ref, so coverage is not lost. if: always() && github.event_name != 'merge_group' && hashFiles('gosec-results.sarif') != '' - uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2 + uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3 with: sarif_file: gosec-results.sarif diff --git a/.github/workflows/release-go-app.yml b/.github/workflows/release-go-app.yml index dd3fbb5..c4e7948 100644 --- a/.github/workflows/release-go-app.yml +++ b/.github/workflows/release-go-app.yml @@ -637,7 +637,7 @@ jobs: # and producing a guaranteed `ref ... not found` failure. Release/push # events run with stable refs. if: github.event_name != 'merge_group' && hashFiles('trivy-results.sarif') != '' - uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2 + uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3 with: sarif_file: trivy-results.sarif category: container-scan diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index bedce8b..c46c500 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -67,6 +67,6 @@ jobs: # and producing a guaranteed `ref ... not found` failure. Push and # schedule events run with stable refs. if: github.event_name != 'merge_group' - uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2 + uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3 with: sarif_file: results.sarif diff --git a/.github/workflows/security-container.yml b/.github/workflows/security-container.yml index 9542429..5461842 100644 --- a/.github/workflows/security-container.yml +++ b/.github/workflows/security-container.yml @@ -198,7 +198,7 @@ jobs: # the moment the merge completes, racing with codeql-action/upload-sarif # and producing a guaranteed `ref ... not found` failure. if: always() && inputs.upload-sarif && github.event_name != 'merge_group' && hashFiles('trivy-results.sarif') != '' - uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2 + uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3 with: sarif_file: trivy-results.sarif category: ${{ inputs.sarif-category }}