build(ci): move both codeql-action steps to 4.37.7, and correct the pin comment - #58
Merged
Conversation
…in comment Supersedes #47 and #48. Neither can land alone without breaking main. init and analyze must run the SAME version of github/codeql-action, or analyze fails with "Loaded a configuration file for version X, but running version Y". Dependabot raises one pull request per sub-action, so #47 moves analyze and #48 moves init, and whichever merges first leaves main mismatched until the other follows. Both showed mergeable, which makes this worse rather than better: the breakage would have arrived on main, not on a branch. One commit moves both. c4dd10e -> ff2f1c6, both steps. Also corrects the trailing comment from "# v3" to "# v4". Dependabot's own diff kept "# v3" while bumping to a 4.x release. The comment is the only human readable part of a SHA pin, so a stale one is precisely what makes the next reviewer distrust an otherwise correct SHA. Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
This was referenced Aug 17, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Supersedes #47 and #48. Neither can land alone without breaking
main.initandanalyzemust run the same version ofgithub/codeql-action, or analyze fails with "Loaded a configuration file for version X, but running version Y". Dependabot raises one PR per sub-action — #47 movesanalyze, #48 movesinit— so whichever merges first leavesmainmismatched until the other follows.Both showed
MERGEABLE, which makes this worse, not better: the breakage would have arrived onmainrather than being caught on a branch. LotteryApp is the same story (#105), except there the PRs were already visibly failing.c4dd10e→ff2f1c6, both steps, one commit.Also: the pin comment was wrong
Dependabot's diff kept the trailing
# v3while bumping to a 4.x release. Corrected to# v4. The comment is the only human-readable part of a SHA pin — a stale one is exactly what makes the next reviewer distrust an otherwise correct SHA.🤖 Generated with Claude Code