From 0b81154813a46977eb6d4c568b117a36e0c7dc73 Mon Sep 17 00:00:00 2001 From: Martin Vogel Date: Tue, 20 Oct 2026 19:42:19 +0200 Subject: [PATCH 1/4] ci: bump the CodeQL actions to v4.39.0 together and group their Dependabot updates Dependabot opened one PR per CodeQL action (#2504 init, #2505 analyze, #2506 upload-sarif), each moving to 4.38.2. Merging them one at a time would leave init and analyze on different versions in between. This moves all three to v4.39.0 (6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee, the commit the v4.39.0 tag points to) in one change, and adds a Dependabot group so future CodeQL Action updates arrive as a single PR. Signed-off-by: Martin Vogel --- .github/dependabot.yml | 6 ++++++ .github/workflows/codeql.yml | 4 ++-- .github/workflows/scorecard.yml | 2 +- 3 files changed, 9 insertions(+), 3 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 5ace4600a..c6bbd96e1 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -4,3 +4,9 @@ updates: directory: "/" schedule: interval: "weekly" + groups: + # init and analyze must run the same CodeQL Action version within a job, and + # upload-sarif is kept in step with them, so one PR bumps all three. + codeql-action: + patterns: + - "github/codeql-action*" diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index f5cfb59d6..ae9b5f861 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -113,7 +113,7 @@ jobs: run: scripts/ci/codeql-retrace-vendored.sh "$RUNNER_TEMP/codeql-retrace.txt" - name: Initialize CodeQL - uses: github/codeql-action/init@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1 + uses: github/codeql-action/init@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0 with: languages: ${{ matrix.language }} build-mode: ${{ matrix.build-mode }} @@ -128,7 +128,7 @@ jobs: run: scripts/build.sh --reuse-vendored --retrace-from "$RUNNER_TEMP/codeql-retrace.txt" - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1 + uses: github/codeql-action/analyze@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0 with: category: "/language:${{ matrix.language }}" diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index fb0a52bbc..9f54249ae 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -33,6 +33,6 @@ jobs: publish_results: true - name: Upload SARIF results - uses: github/codeql-action/upload-sarif@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4 + uses: github/codeql-action/upload-sarif@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0 with: sarif_file: results.sarif From 54e079587d36a9833f844d972046d51da6b3bdf9 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sun, 1 Nov 2026 15:09:38 +0000 Subject: [PATCH 2/4] build(deps): bump actions/attest from 4.1.0 to 4.2.2 Bumps [actions/attest](https://github.com/actions/attest) from 4.1.0 to 4.2.2. - [Release notes](https://github.com/actions/attest/releases) - [Changelog](https://github.com/actions/attest/blob/main/RELEASE.md) - [Commits](https://github.com/actions/attest/compare/59d89421af93a897026c735860bf21b6eb4f7b26...1e69f48acb82d1966a394da916b4c1698aa569d6) --- updated-dependencies: - dependency-name: actions/attest dependency-version: 4.2.2 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] --- .github/workflows/release.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 707c69924..e4926260d 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -257,7 +257,7 @@ jobs: # fail if its SBOM cannot be attested. An unattested SBOM is worse than # an absent one, because the artifact still ships looking complete. - name: Attest SBOM - uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4.1.0 + uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2 env: NODE_OPTIONS: '--max-http-header-size=32768' with: From caad969154f19626e0d076091031530fc71a7532 Mon Sep 17 00:00:00 2001 From: Martin Vogel Date: Sun, 1 Nov 2026 16:12:47 +0100 Subject: [PATCH 3/4] ci: pin every CodeQL action to v4.39.1 Main already moved upload-sarif to v4.39.1 (#2779). Move init and analyze to the same commit, 9b3254085494b55a0f7c4c2b3d2d52cc712ce370 (the commit the v4.39.1 tag points to), so all three CodeQL actions run one version again. The pin comment follows the form Dependabot wrote for upload-sarif. The codeql-action Dependabot group added earlier on this branch keeps the three in lockstep from here on. Signed-off-by: Martin Vogel --- .github/workflows/codeql.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 18f9db5db..1a1c8d6fc 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -114,7 +114,7 @@ jobs: run: scripts/ci/codeql-retrace-vendored.sh "$RUNNER_TEMP/codeql-retrace.txt" - name: Initialize CodeQL - uses: github/codeql-action/init@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0 + uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4 with: languages: ${{ matrix.language }} build-mode: ${{ matrix.build-mode }} @@ -129,7 +129,7 @@ jobs: run: scripts/build.sh --reuse-vendored --retrace-from "$RUNNER_TEMP/codeql-retrace.txt" - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0 + uses: github/codeql-action/analyze@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4 with: category: "/language:${{ matrix.language }}" From 1f56c7d6bb1f1ad10cece78d1da901709fa422a4 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sun, 1 Nov 2026 16:06:58 +0000 Subject: [PATCH 4/4] build(deps): bump msys2/setup-msys2 from 2.32.0 to 2.33.0 Bumps [msys2/setup-msys2](https://github.com/msys2/setup-msys2) from 2.32.0 to 2.33.0. - [Release notes](https://github.com/msys2/setup-msys2/releases) - [Changelog](https://github.com/msys2/setup-msys2/blob/main/CHANGELOG.md) - [Commits](https://github.com/msys2/setup-msys2/compare/66cd2cce69caa17b53920067426061ca1de3a884...ec48f7c5447b3140e2b088413ae3a55687bccb6e) --- updated-dependencies: - dependency-name: msys2/setup-msys2 dependency-version: 2.33.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] --- .github/workflows/_build.yml | 4 ++-- .github/workflows/_memwaste.yml | 2 +- .github/workflows/_smoke.yml | 2 +- .github/workflows/_soak.yml | 6 +++--- .github/workflows/_test.yml | 4 ++-- .github/workflows/bug-repro.yml | 2 +- .github/workflows/cache-warm.yml | 2 +- .github/workflows/pr.yml | 2 +- .github/workflows/smoke.yml | 4 ++-- 9 files changed, 14 insertions(+), 14 deletions(-) diff --git a/.github/workflows/_build.yml b/.github/workflows/_build.yml index 152cca737..163376ab0 100644 --- a/.github/workflows/_build.yml +++ b/.github/workflows/_build.yml @@ -120,7 +120,7 @@ jobs: steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: msys2/setup-msys2@66cd2cce69caa17b53920067426061ca1de3a884 # v2 + - uses: msys2/setup-msys2@ec48f7c5447b3140e2b088413ae3a55687bccb6e # v2 with: msystem: CLANG64 path-type: inherit @@ -182,7 +182,7 @@ jobs: steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: msys2/setup-msys2@66cd2cce69caa17b53920067426061ca1de3a884 # v2 + - uses: msys2/setup-msys2@ec48f7c5447b3140e2b088413ae3a55687bccb6e # v2 with: msystem: CLANGARM64 path-type: inherit diff --git a/.github/workflows/_memwaste.yml b/.github/workflows/_memwaste.yml index 72701ca7a..52ae8a8fb 100644 --- a/.github/workflows/_memwaste.yml +++ b/.github/workflows/_memwaste.yml @@ -149,7 +149,7 @@ jobs: timeout-minutes: 90 steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: msys2/setup-msys2@66cd2cce69caa17b53920067426061ca1de3a884 # v2 + - uses: msys2/setup-msys2@ec48f7c5447b3140e2b088413ae3a55687bccb6e # v2 with: msystem: CLANG64 path-type: inherit diff --git a/.github/workflows/_smoke.yml b/.github/workflows/_smoke.yml index ed1022b71..ac4ca595d 100644 --- a/.github/workflows/_smoke.yml +++ b/.github/workflows/_smoke.yml @@ -192,7 +192,7 @@ jobs: go-version-file: pkg/go/go.mod cache: false - - uses: msys2/setup-msys2@66cd2cce69caa17b53920067426061ca1de3a884 # v2 + - uses: msys2/setup-msys2@ec48f7c5447b3140e2b088413ae3a55687bccb6e # v2 with: msystem: ${{ matrix.arch == 'arm64' && 'CLANGARM64' || 'CLANG64' }} path-type: inherit diff --git a/.github/workflows/_soak.yml b/.github/workflows/_soak.yml index 39f9e76b1..c25a1988d 100644 --- a/.github/workflows/_soak.yml +++ b/.github/workflows/_soak.yml @@ -119,7 +119,7 @@ jobs: steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: msys2/setup-msys2@66cd2cce69caa17b53920067426061ca1de3a884 # v2 + - uses: msys2/setup-msys2@ec48f7c5447b3140e2b088413ae3a55687bccb6e # v2 with: msystem: CLANG64 path-type: inherit @@ -197,7 +197,7 @@ jobs: steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: msys2/setup-msys2@66cd2cce69caa17b53920067426061ca1de3a884 # v2 + - uses: msys2/setup-msys2@ec48f7c5447b3140e2b088413ae3a55687bccb6e # v2 with: msystem: CLANGARM64 path-type: inherit @@ -389,7 +389,7 @@ jobs: steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: msys2/setup-msys2@66cd2cce69caa17b53920067426061ca1de3a884 # v2 + - uses: msys2/setup-msys2@ec48f7c5447b3140e2b088413ae3a55687bccb6e # v2 with: msystem: CLANG64 path-type: inherit diff --git a/.github/workflows/_test.yml b/.github/workflows/_test.yml index 501a82b20..da7e0aab0 100644 --- a/.github/workflows/_test.yml +++ b/.github/workflows/_test.yml @@ -594,7 +594,7 @@ jobs: # preflight script, so AV-interaction coverage lives there; runners run # without RTP by platform constraint. - - uses: msys2/setup-msys2@66cd2cce69caa17b53920067426061ca1de3a884 # v2 + - uses: msys2/setup-msys2@ec48f7c5447b3140e2b088413ae3a55687bccb6e # v2 with: msystem: ${{ matrix.msystem }} path-type: inherit @@ -746,7 +746,7 @@ jobs: steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: msys2/setup-msys2@66cd2cce69caa17b53920067426061ca1de3a884 # v2 + - uses: msys2/setup-msys2@ec48f7c5447b3140e2b088413ae3a55687bccb6e # v2 with: msystem: CLANG64 path-type: inherit diff --git a/.github/workflows/bug-repro.yml b/.github/workflows/bug-repro.yml index 3d10e42ab..357aec5b2 100644 --- a/.github/workflows/bug-repro.yml +++ b/.github/workflows/bug-repro.yml @@ -69,7 +69,7 @@ jobs: steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: msys2/setup-msys2@66cd2cce69caa17b53920067426061ca1de3a884 # v2 + - uses: msys2/setup-msys2@ec48f7c5447b3140e2b088413ae3a55687bccb6e # v2 with: msystem: CLANG64 path-type: inherit diff --git a/.github/workflows/cache-warm.yml b/.github/workflows/cache-warm.yml index 9951cd49e..661533238 100644 --- a/.github/workflows/cache-warm.yml +++ b/.github/workflows/cache-warm.yml @@ -82,7 +82,7 @@ jobs: steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: msys2/setup-msys2@66cd2cce69caa17b53920067426061ca1de3a884 # v2 + - uses: msys2/setup-msys2@ec48f7c5447b3140e2b088413ae3a55687bccb6e # v2 with: msystem: CLANG64 path-type: inherit diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml index e20ac274a..3b4ea807c 100644 --- a/.github/workflows/pr.yml +++ b/.github/workflows/pr.yml @@ -219,7 +219,7 @@ jobs: if: matrix.os == 'macos-15' run: command -v ccache >/dev/null 2>&1 || brew install ccache - - uses: msys2/setup-msys2@66cd2cce69caa17b53920067426061ca1de3a884 # v2 + - uses: msys2/setup-msys2@ec48f7c5447b3140e2b088413ae3a55687bccb6e # v2 if: matrix.os == 'windows-latest' with: msystem: CLANG64 diff --git a/.github/workflows/smoke.yml b/.github/workflows/smoke.yml index 66e62ff54..62193d060 100644 --- a/.github/workflows/smoke.yml +++ b/.github/workflows/smoke.yml @@ -70,7 +70,7 @@ jobs: timeout-minutes: 240 steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: msys2/setup-msys2@66cd2cce69caa17b53920067426061ca1de3a884 # v2 + - uses: msys2/setup-msys2@ec48f7c5447b3140e2b088413ae3a55687bccb6e # v2 with: msystem: CLANG64 path-type: inherit @@ -100,7 +100,7 @@ jobs: continue-on-error: true steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: msys2/setup-msys2@66cd2cce69caa17b53920067426061ca1de3a884 # v2 + - uses: msys2/setup-msys2@ec48f7c5447b3140e2b088413ae3a55687bccb6e # v2 with: msystem: CLANGARM64 path-type: inherit