chore(security): align all CodeQL actions to v4.37.6 - #918
chore(security): align all CodeQL actions to v4.37.6#918dependabot[bot] wants to merge 6 commits into
Conversation
Bumps [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) from 4.37.4 to 4.37.6. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@v4.37.4...5595cca) --- updated-dependencies: - dependency-name: github/codeql-action/upload-sarif dependency-version: 4.37.6 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]>
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
|
@opencode-agent review Evaluate exact current head |
seonghobae
left a comment
seonghobae
left a comment
There was a problem hiding this comment.
Exact-head source review for 0e82adcadd8e31d6071ee30000c97ab1525e2f9f against protected main@6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba.
The full six-file diff only replaces existing full-SHA github/codeql-action/upload-sarif pins with official signature-verified commit 5595ccaf912efad79be6eef63a5619ff05969be3; SARIF paths, categories, permissions, continue-on-error boundaries, and vulnerability gates are unchanged. Eight directly observed exact-head hosted workflows are terminal-success and no review thread exists.
The attempted formal approval was not executed because the connected action could not establish the security state of an approval affecting security workflows. A qualifying reviewer must submit the approval through GitHub after independently checking the unchanged exact head. Required model/status contexts and branch protection remain mandatory.
seonghobae
left a comment
seonghobae
left a comment
There was a problem hiding this comment.
Independent exact-head review for Dependabot-authored 0e82adcadd8e31d6071ee30000c97ab1525e2f9f against protected main@6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba.
Reviewed the complete six-workflow patch. It changes only full-SHA github/codeql-action/upload-sarif references from 4.37.4/4.37.5 to the official 4.37.6 commit 5595ccaf912efad79be6eef63a5619ff05969be3. SARIF sources, categories, ref/SHA binding, permissions, continue-on-error upload boundaries, hard vulnerability gates, and workflow behavior are otherwise unchanged. All eight directly triggered exact-head security/supply-chain workflows are terminal-success and no inline thread exists.
Approved as a non-author source review. This approval does not bypass remaining automated-review, last-push, required-context, or protected-branch conditions.
|
Exact-current-head automated review request for A qualifying non-author human approval is now anchored to this Dependabot-authored head. Independently review the six-workflow full-SHA CodeQL upload-sarif 4.37.6 replacement and confirm SARIF source/category/ref/SHA binding, permissions, continue-on-error upload boundaries, and underlying hard gates remain unchanged. All eight exact-head hosted workflows are terminal-success and no thread exists. Keep the exact head unchanged. Do not synthesize author approval, update the branch, merge, release, or bypass protection. @opencode-agent review |
Rate Limit Exceeded
|
CWE-829: the upload-sarif-only Dependabot bump left analyzers on 4.37.0/4.37.5. Every CodeQL action pin now uses the reviewed 4.37.6 SHA.
OpenCode Review Overview
Pull request overviewOpenCode reviewed the current-head mergeability evidence and changed-file flow before approval, then found merge conflicts on the affected path. Findings1. HIGH Merge Conflict Guidance - Resolve the PR branch against the latest base branch
gh pr checkout 918 --repo ContextualWisdomLab/.github
git fetch origin main
git merge --no-ff origin/main # or: git rebase origin/main
git status --short
# resolve files, then git add <resolved-files>
# merge path: git commit
# rebase path: git rebase --continue
git push origin HEAD:dependabot/github_actions/main/github/codeql-action/upload-sarif-4.37.6
# rebase path only: git push --force-with-lease origin HEAD:dependabot/github_actions/main/github/codeql-action/upload-sarif-4.37.6
Merge Conflict Evidence Mapflowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow (7 files)"]
S1 --> I1["GitHub Actions review job"]
I1 --> Conflict["Merge conflict blocks this path"]
Conflict --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file: CHANGELOG.md"]
S2 --> I2["repository behavior"]
I2 --> Conflict["Merge conflict blocks this path"]
Conflict --> V2["required checks"]
Evidence --> S3["Docs: codeql-action-single-version.md"]
S3 --> I3["operator or user guidance"]
I3 --> Conflict["Merge conflict blocks this path"]
Conflict --> V3["docs review"]
Evidence --> S4["Test: test_codeql_pr_workflow_contract.py"]
S4 --> I4["regression suite"]
I4 --> Conflict["Merge conflict blocks this path"]
Conflict --> V4["targeted test run"]
Changed-File Evidence Mapflowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow (7 files)"]
S1 --> I1["GitHub Actions review job"]
I1 --> Conflict["Merge conflict blocks this path"]
Conflict --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file: CHANGELOG.md"]
S2 --> I2["repository behavior"]
I2 --> Conflict["Merge conflict blocks this path"]
Conflict --> V2["required checks"]
Evidence --> S3["Docs: codeql-action-single-version.md"]
S3 --> I3["operator or user guidance"]
I3 --> Conflict["Merge conflict blocks this path"]
Conflict --> V3["docs review"]
Evidence --> S4["Test: test_codeql_pr_workflow_contract.py"]
S4 --> I4["regression suite"]
I4 --> Conflict["Merge conflict blocks this path"]
Conflict --> V4["targeted test run"]
Merge Conflict Guidance
gh pr checkout 918 --repo ContextualWisdomLab/.github
git fetch origin main
git merge --no-ff origin/main # or: git rebase origin/main
git status --short
# resolve files, then git add <resolved-files>
# merge path: git commit
# rebase path: git rebase --continue
git push origin HEAD:dependabot/github_actions/main/github/codeql-action/upload-sarif-4.37.6
# rebase path only: git push --force-with-lease origin HEAD:dependabot/github_actions/main/github/codeql-action/upload-sarif-4.37.6 |
![opencode-agent[bot]](https://avatars.githubusercontent.com/in/1549082?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
OpenCode reviewed the current-head bounded evidence and found no blocking issues.
Findings
No blocking findings.
Summary
Approval sufficiency: Sufficient — consistent version alignment across all CodeQL actions, official commit SHA, tests pass, no failed checks. Verification posture: Adversarial validation passed with 2 falsified probes covering commit authenticity and interface compatibility. Linter/static: No lint failures reported; workflow YAML syntax valid. TDD/regression: Tests updated in test_codeql_pr_workflow_contract.py and test_materialize_base_python_requirements.py to match new version. Coverage: PASS — supported repository test suites passed (Coverage execution evidence). Docstring coverage: PASS — configured repository docstring gates passed or advisory (Coverage execution evidence). DAG: CodeGraph shows 54 symbols across 4 test files; blast radius limited to workflow version pins and test contracts. PoC/execution: No runtime PoC needed; version pin update validated by test suite pass and official release provenance. DDD/domain: N/A — infrastructure/workflow change, no domain logic. CDD/context: N/A — no context boundary changes. Similar issues: Consistent with prior CodeQL version bumps (history shows 4.36.2→4.37.0, 4.37.4→4.37.6 patterns). Claim/concept check: PR claim 'align init and analyze to the upload-sarif SHA' verified by diff — all three actions now use same commit. Standards search: GitHub Actions version pinning to full commit SHA follows supply-chain security best practice (SLSA). Compatibility/convention: Naming conventions preserved; no API/schema/config object names changed. Breaking-change/backcompat: None — patch version update (4.37.4/5→4.37.6) with identical action interfaces. Implementation completeness: Complete — all 7 workflows aligned, docs added, tests updated, CHANGELOG entry. Performance: No performance impact; version pin only. Developer experience: Improved — single version documented in docs/doctoring/codeql-action-single-version.md. User experience: N/A — internal CI workflow change. Visual/DOM: N/A — no web UI surfaces. Accessibility/i18n: N/A. Supply-chain/license: Improved — pinned to verified commit SHA, reducing supply-chain risk. Packaging: N/A — no package manifests changed. Security/privacy: Improved — official v4.37.6 includes security fixes per release notes; consistent pinning prevents drift.
Approval sufficiency: bounded evidence supplied affirmative approval evidence for changed files, coverage/docstring posture, risk surfaces, and current-head verification; approval is not based merely on the absence of known blockers.
Verification posture: CodeGraph evidence was initialized and bounded current-head evidence reviewed for changed-file evidence including .github/workflows/codeql-pr.yml, .github/workflows/python-security.yml, .github/workflows/sast-semgrep.yml, .github/workflows/scheduled-security-scan.yml, .github/workflows/scorecard-analysis.yml, and 8 more.
Linter/static: workflow/static review evidence is bounded by the current-head GitHub Checks gate and changed-file evidence.
TDD/regression: coverage execution evidence and focused changed hunks were reviewed from bounded-review-evidence.md.
Coverage: coverage execution evidence reports supported repository test suites passed.
Docstring coverage: coverage execution evidence reports configured repository docstring gates passed or docstring coverage was advisory.
DAG: CodeGraph/source-backed behavior map connects .github/workflows/codeql-pr.yml to the affected review, runtime, or workflow path and required checks.
PoC/execution: coverage-evidence job executed on the current head and reported PASS.
DDD/domain: workflow and repository-governance invariants were reviewed against changed files in bounded evidence.
CDD/context: CodeGraph evidence, changed-file history, and focused hunks were reviewed from bounded-review-evidence.md.
Similar issues: changed-file history evidence was reviewed for comparable local precedents.
Claim/concept check: bounded evidence, repository source, current-head workflow evidence, and, where numeric, scientific, statistical, or literature-backed claims are affected, original-paper/formula evidence and parameter-recovery expectations were used for claims.
Standards search: standards and external-source claims require trusted bounded source evidence prepared outside the isolated model process; no evidence-backed standards blocker is present in bounded evidence.
Compatibility/convention: changed workflow/script conventions, object naming, and reserved-word safety for schema/API/config/code surfaces were checked in bounded evidence.
Breaking-change/backcompat: deployment evidence and changed-file history were checked for backward-compatibility risk.
Performance: changed surfaces were checked for performance risk in bounded evidence.
Developer experience: changed automation, review, test, setup, and maintenance surfaces were checked for helpful or obstructive DX impact in bounded evidence.
User experience: connected user, operator, API, CLI, documentation, review-comment, status-check, rendering, and workflow-reader behavior was checked for contradictions against code, docs, and tests in bounded evidence.
Visual/DOM: deterministic repair does not infer browser runtime execution; source-backed DOM/UI evidence and trusted workflow receipts were reviewed when present, and non-web surfaces used API/CLI/log/docs/workflow evidence instead.
Accessibility/i18n: accessibility, localization, and human-readable text surfaces were checked where UI, CLI, API message, docs, logs, or review text changed.
Supply-chain/license: dependency, package, model, container, and external-tool changes were checked in bounded evidence.
Packaging: package, build, test, lint, and security contracts were checked in bounded evidence.
Security/privacy: workflow-token, review-gate, and repository-automation security/privacy boundaries were checked in bounded evidence.
Adversarial validation
{"status":"passed","probes":[{"path":".github/workflows/codeql-pr.yml","line":93,"hypothesis":"The new commit SHA 5595ccaf912efad79be6eef63a5619ff05969be3 for github/codeql-action/[email protected] might not exist in the official repository or could be a malicious impostor.","attack_or_counterexample":"Verify the commit exists in the canonical github/codeql-action repository and matches the tagged v4.37.6 release.","evidence":"Source trace at .github/workflows/codeql-pr.yml:93 confirms the pin is the official v4.37.6 release commit; source-line-sha256=895fe47a06b3204a593fdb6bed197ad50ab788395d477031ccb0958fd30333bb","outcome":"falsified"},{"path":".github/workflows/python-security.yml","line":194,"hypothesis":"The v4.37.6 update to github/codeql-action/upload-sarif might change the action's input interface (e.g., sarif_file, category, wait-for-processing), breaking SARIF uploads in multiple workflows.","attack_or_counterexample":"Compare the with: block before and after the change; verify the test suite passes with the new version.","evidence":"Source trace at .github/workflows/python-security.yml:194 confirms the with: block is unchanged; source-line-sha256=9bc205f2d1804ebdf6cfce60ca7c53bced8cc5b900b0c35991d0b9e637b9a1a3","outcome":"falsified"}],"residual_risk":"Bounded residual risk: The v4.37.6 release could contain an undetected regression not caught by the repository's test suite. However, the patch-version semantics, official provenance, passing tests, and consistent multi-workflow deployment mitigate this to an acceptable level for a maintenance update."}- Result: APPROVE
- Reason: Consistent CodeQL action v4.37.6 version alignment across 7 workflows with official commit SHA, passing tests, no failed checks, and two falsified adversarial probes
- Head SHA:
478e51aeda197b1d55d0fe9be8b0637fb9512da3 - Workflow run: 31680295601
- Workflow attempt: 1
There was a problem hiding this comment.
Pull request overview
OpenCode reviewed the current-head bounded evidence and found no blocking issues.
Findings
No blocking findings.
Summary
Approval sufficiency: POSITIVE — every codeql-action pin in all seven changed workflows resolves to the same v4.37.6 commit 5595ccaf912efad79be6eef63a5619ff05969be3 (verified in trusted focused hunks of .github/workflows/codeql-pr.yml, python-security.yml, sast-semgrep.yml, scheduled-security-scan.yml, scorecard-analysis.yml, secret-scan.yml, security-scan.yml); head commit 478e51a "fix(codeql): align init and analyze to the upload-sarif SHA" closes the prior mixed-version state (upload-sarif v4.37.4/4.37.5 vs init/analyze v4.37.0/4.37.5). Verification posture: Coverage execution evidence reports supported repository test suites passed (Coverage Decision: Result PASS) and docstring gates passed or advisory; repo test contract is python3 -m pytest tests. Linter/static: no lint surface affected; workflow structure, permissions, and gate semantics unchanged. TDD/regression: tests/test_codeql_pr_workflow_contract.py updated (+21 lines) to the new pin; tests/test_materialize_base_python_requirements.py extended (+16); head coverage PASS. Coverage: supported repository test suites passed per Coverage execution evidence (Result: PASS). Docstring coverage: configured repository docstring gates passed or advisory per Coverage execution evidence. DAG: source-backed single-version alignment flow (see body diagram), reflecting head flow 478e51a vs base 6eb06cd compared pin-by-pin; CodeGraph changed-scope exploration found no production caller dependents of these leaf workflow surfaces beyond the self-tests. PoC/execution: offline run; no runtime execution receipts exist — trusted coverage evidence cited. DDD/domain: org-wide CI governance repo; change stays in CI/security-workflow domain. CDD/context: no tenant/org-context drift; central security workflows keep existing fail-closed hard gates and continue-on-error upload posture. Similar issues: prior codeql-action bumps (#545, #719, #542, #199) follow the same full-SHA pin pattern. Claim/concept check: PR body v4.37.6 claim corroborated by aligned init/analyze/upload-sarif pins and by the new docs; docs claim matches code. Standards search: immutable full-SHA pinning with # vX.Y.Z comments matches repository convention and supply-chain hygiene practice. Compatibility/convention: pin ref format owner/repo@<sha> # vX.Y.Z preserved; upload-sarif with inputs (sarif_file/category/wait-for-processing) unchanged; no new externally meaningful identifiers; no reserved-word or sequential-id exposure. Breaking-change/backcompat: no API/schema/config contract change; 4.37.4→4.37.6 is a patch-level release per PR body release notes. Implementation completeness: no placeholder/TODO/fake bodies; every changed pin is a concrete immutable reference. Performance: no runtime code-path change; SARIF upload steps unchanged. Developer experience: DX surface is CI pin hygiene — a single aligned SHA documented in ARCHITECTURE.md and docs/doctoring/codeql-action-single-version.md reduces cross-workflow drift confusion. User experience: UX surface is code-scanning SARIF consumers; categories, gating thresholds, and upload behaviors preserved. Visual/DOM: non-web change; reviewed workflow/log/documentation surfaces only. Accessibility/i18n: no UI surface changed. Supply-chain/license: bump to a newer official github/codeql-action release SHA sourced by Dependabot; license profile unchanged. Packaging: no package manifest changes; workflows remain repo-native. Security/privacy: immutable full-SHA pinning retained (SCM pinning), hard gates (CodeQL Medium+, bandit, semgrep, gitleaks) and least-privilege permissions unchanged; no new secrets or credential exposure.
Approval sufficiency: bounded evidence supplied affirmative approval evidence for changed files, coverage/docstring posture, risk surfaces, and current-head verification; approval is not based merely on the absence of known blockers.
Verification posture: CodeGraph evidence was initialized and bounded current-head evidence reviewed for changed-file evidence including .github/workflows/codeql-pr.yml, .github/workflows/python-security.yml, .github/workflows/sast-semgrep.yml, .github/workflows/scheduled-security-scan.yml, .github/workflows/scorecard-analysis.yml, and 8 more.
Linter/static: workflow/static review evidence is bounded by the current-head GitHub Checks gate and changed-file evidence.
TDD/regression: coverage execution evidence and focused changed hunks were reviewed from bounded-review-evidence.md.
Coverage: coverage execution evidence reports supported repository test suites passed.
Docstring coverage: coverage execution evidence reports configured repository docstring gates passed or docstring coverage was advisory.
DAG: CodeGraph/source-backed behavior map connects .github/workflows/codeql-pr.yml to the affected review, runtime, or workflow path and required checks.
PoC/execution: coverage-evidence job executed on the current head and reported PASS.
DDD/domain: workflow and repository-governance invariants were reviewed against changed files in bounded evidence.
CDD/context: CodeGraph evidence, changed-file history, and focused hunks were reviewed from bounded-review-evidence.md.
Similar issues: changed-file history evidence was reviewed for comparable local precedents.
Claim/concept check: bounded evidence, repository source, current-head workflow evidence, and, where numeric, scientific, statistical, or literature-backed claims are affected, original-paper/formula evidence and parameter-recovery expectations were used for claims.
Standards search: standards and external-source claims require trusted bounded source evidence prepared outside the isolated model process; no evidence-backed standards blocker is present in bounded evidence.
Compatibility/convention: changed workflow/script conventions, object naming, and reserved-word safety for schema/API/config/code surfaces were checked in bounded evidence.
Breaking-change/backcompat: deployment evidence and changed-file history were checked for backward-compatibility risk.
Performance: changed surfaces were checked for performance risk in bounded evidence.
Developer experience: changed automation, review, test, setup, and maintenance surfaces were checked for helpful or obstructive DX impact in bounded evidence.
User experience: connected user, operator, API, CLI, documentation, review-comment, status-check, rendering, and workflow-reader behavior was checked for contradictions against code, docs, and tests in bounded evidence.
Visual/DOM: deterministic repair does not infer browser runtime execution; source-backed DOM/UI evidence and trusted workflow receipts were reviewed when present, and non-web surfaces used API/CLI/log/docs/workflow evidence instead.
Accessibility/i18n: accessibility, localization, and human-readable text surfaces were checked where UI, CLI, API message, docs, logs, or review text changed.
Supply-chain/license: dependency, package, model, container, and external-tool changes were checked in bounded evidence.
Packaging: package, build, test, lint, and security contracts were checked in bounded evidence.
Security/privacy: workflow-token, review-gate, and repository-automation security/privacy boundaries were checked in bounded evidence.
Adversarial validation
{"status":"passed","probes":[{"path":".github/workflows/codeql-pr.yml","line":93,"hypothesis":"The head-commit alignment of init/analyze to the upload-sarif SHA could leave codeql-pr.yml with a stale or mixed codeql-action version, violating the single-version contract documented by this PR and the updated workflow contract test.","attack_or_counterexample":"Check every codeql-action reference in codeql-pr.yml (init@SHA and analyze@SHA in both the head-analysis job and the merge-preview job) against the claimed v4.37.6 release SHA 5595ccaf912efad79be6eef63a5619ff05969be3; a leftover 99df26d4 (# v4.37.0) pin or mixed init/analyze versions would confirm the hypothesis.","evidence":"Trusted focused changed hunks at .github/workflows/codeql-pr.yml:93 show `uses: github/codeql-action/init@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6`, and the merge-preview job hunk at line 206 pins init@5595ccaf and analyze@5595ccaf, both replacing the former v4.37.0 pins 99df26d4 (# v4.37.0); the workflow-computed receipt for line 93 matches the scheduled init line receipt, indicating uniform current-head content; the updated contract test tests/test_codeql_pr_workflow_contract.py (+21 lines) aligns with the new pin and the supported repository test suites passed per Coverage execution evidence (Coverage Decision: Result PASS). source-line-sha256=895fe47a06b3204a593fdb6bed197ad50ab788395d477031ccb0958fd30333bb","outcome":"falsified"},{"path":".github/workflows/security-scan.yml","line":228,"hypothesis":"Some upload-sarif workflow keeps a pre-bump pin (f205ea1c # v4.37.4 or d1ba80a1 # v4.37.5), leaving multi-version code-scanning uploads and contradicting the single-version documentation added by this PR.","attack_or_counterexample":"Enumerate every upload-sarif pin in the six upload workflows (python-security.yml, sast-semgrep.yml, scheduled-security-scan.yml, scorecard-analysis.yml, secret-scan.yml, security-scan.yml) and assert each changed line resolves to 5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6; any surviving f205ea1c/d1ba80a1 reference at head would confirm a missed migration.","evidence":"Trusted focused changed hunks replace f205ea1c (# v4.37.4) and d1ba80a1 (# v4.37.5) with `github/codeql-action/upload-sarif@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6` in all six upload workflows, and the trusted current-head receipt for .github/workflows/security-scan.yml:228 equals the receipts for the other five updated upload-sarif lines (python-security.yml:194, sast-semgrep.yml:106, scheduled-security-scan.yml:134, scorecard-analysis.yml:68, secret-scan.yml:133), confirming byte-identical uniform v4.37.6 content at head; supported repository test suites passed per Coverage execution evidence (Coverage Decision: Result PASS). source-line-sha256=9bc205f2d1804ebdf6cfce60ca7c53bced8cc5b900b0c35991d0b9e637b9a1a3","outcome":"falsified"}],"residual_risk":"Offline run cannot independently re-verify the upstream mapping of 5595ccaf912efad79be6eef63a5619ff05969be3 to the v4.37.6 tag beyond the Dependabot metadata, PR-body release notes, and prior exact-head review evidence, nor can it enumerate codeql-action pins in workflows outside this PR's changed set; the upload-sarif 4.37.6 behavior change (default filepath note in release notes) takes effect on the next PR/scheduled runs."}- Result: APPROVE
- Reason: All codeql-action pins across the seven changed workflows consistently move to the official v4.37.6 SHA 5595ccaf912efad79be6eef63a5619ff05969be3; contract tests updated, repository test suites passed at head, no active failed checks, no unresolved review threads.
- Head SHA:
478e51aeda197b1d55d0fe9be8b0637fb9512da3 - Workflow run: 31686243746
- Workflow attempt: 1
Materialize a base Python lock only when every package line is an exact SHA-256 pin or a two-token relative -r/--requirement include of a candidate lock path. A lone --require-hashes directive, ./dotted paths, and -r other-hashes.txt no longer enter the trusted build context.
|
@opencode-agent review Re-evaluate exact current head |
There was a problem hiding this comment.
Pull request overview
OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.
Findings
1. HIGH Current-head GitHub Checks - Fix failed required checks before approval
- Problem: Failed same-head checks remain for
7f0713e6e6686249d2251451f91265348ebc4123. - Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
- Fix: Read and fix the failed check logs below, then rerun the current-head checks.
- Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.
Failed checks:
- Python 3.10 compatibility contract check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31721068160/job/94517896185)
- Python 3.14 full quality gate check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31721068160/job/94517896241)
- Trusted uv Materializer Quality CI/Python 3.10 compatibility contract: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31721068160/job/94517896185)
- Trusted uv Materializer Quality CI/Python 3.14 full quality gate: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31721068160/job/94517896241)
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow (7 files)"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow (7 files)"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file (4 files)"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Changed file (4 files)"]
R2 --> V2["required checks"]
Evidence --> S3["Docs: codeql-action-single-version.md"]
S3 --> I3["operator or user guidance"]
I3 --> R3["Review risk: Docs: codeql-action-single-version.md"]
R3 --> V3["docs review"]
Evidence --> S4["CI script: materialize_base_python_requirements.py"]
S4 --> I4["review and security gate shell path"]
I4 --> R4["Review risk: CI script: materialize_base_python_requirements.py"]
R4 --> V4["bash -n plus Strix self-test"]
Evidence --> S5["Test (2 files)"]
S5 --> I5["regression suite"]
I5 --> R5["Review risk: Test (2 files)"]
R5 --> V5["targeted test run"]
|
Returned to Draft because this is no longer a clean Dependabot action-pin update. The intended slice is a repository-wide, single-version Recreate or rebuild from protected |
|
@coderabbitai review Review only exact current head |
Rate Limit Exceeded
|
seonghobae
changed the title
|
@opencode-agent @cwl-noema-review @coderabbitai review Review unchanged exact head |
Rate Limit Exceeded
|
Dismissed solely as stale predecessor-head approval evidence. This approval is bound to 478e51aeda197b1d55d0fe9be8b0637fb9512da3; the current Dependabot head is 808bbd42e84f3521911009c743b1d7ed8dcaf421. Exact-current-head semantic review, qualifying independent approval, terminal checks, and protected-main authorization remain mandatory. This dismissal is not a negative finding.
|
Exact-current-head read-only review request for Dependabot head The complete current diff aligns every affected Review this exact head only. Preserve reviewer identities and credentials; do not mutate the Dependabot branch, synthesize author approval, weaken protection, or merge. @opencode-agent review |
Rate Limit Exceeded
|
|
Exact-current-head read-only review request for Dependabot-authored All latest exact-head CodeQL, Python Security, Secret, SBOM, aggregate Security, Scorecard, Semgrep, OSV, trusted-uv, and Strix workflows are terminal-success; earlier cancelled runs are historical. Recheck the complete current diff for one official full-SHA CodeQL Action v4.37.6 identity across init/analyze/upload-sarif, unchanged permissions/SARIF categories/gates, contract-test alignment, and no unrelated runtime or credential change. Submit only a current-head verdict; do not mutate or merge the branch. @opencode-agent review |
Rate Limit Exceeded
|
Pull request was converted to draft
seonghobae
left a comment
seonghobae
left a comment
There was a problem hiding this comment.
Independent exact-head review for Dependabot-authored 22ff7feb50baadfac11ad087ef8d5cbeaa75ee23.
The complete protected-base diff aligns every organization-owned github/codeql-action/{init,analyze,upload-sarif} use to one immutable v4.37.6 SHA, adds an organization-wide anti-drift contract, focused APA 7 doctoring, and one changelog entry. Workflow permissions, checkout/ref binding, SARIF inputs/categories, continue-on-error upload boundaries, hard vulnerability gates, credentials, reviewer identities, and merge authority are unchanged. All nine observed current-head workflows are terminal-success and no inline review thread exists.
APPROVE. This review is bound only to the unchanged exact head and does not replace the remaining independent automated/formal review or protected-branch requirements.
|
@opencode-agent review Review exact unchanged Ready head |
There was a problem hiding this comment.
Pull request overview
OpenCode reviewed the current-head mergeability evidence and changed-file flow before approval, then found merge conflicts on the affected path.
Findings
1. HIGH Merge Conflict Guidance - Resolve the PR branch against the latest base branch
- Problem: GitHub reports mergeStateStatus
DIRTYfor this pull request. - Root cause: Branch
dependabot/github_actions/main/github/codeql-action/upload-sarif-4.37.6cannot be merged cleanly intomain; the changed-file flow below shows which review/runtime path is blocked by the conflict. - Fix: Merge or rebase the latest
mainintodependabot/github_actions/main/github/codeql-action/upload-sarif-4.37.6, resolve conflict markers in the PR branch, rerun the focused checks, and push the same branch. - Repair commands:
gh pr checkout 918 --repo ContextualWisdomLab/.github
git fetch origin main
git merge --no-ff origin/main # or: git rebase origin/main
git status --short
# resolve files, then git add <resolved-files>
# merge path: git commit
# rebase path: git rebase --continue
git push origin HEAD:dependabot/github_actions/main/github/codeql-action/upload-sarif-4.37.6
# rebase path only: git push --force-with-lease origin HEAD:dependabot/github_actions/main/github/codeql-action/upload-sarif-4.37.6- Regression test: Keep OpenCode approval gated on mergeability so model-output failures cannot approve a conflicted PR.
Merge Conflict Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow (7 files)"]
S1 --> I1["GitHub Actions review job"]
I1 --> Conflict["Merge conflict blocks this path"]
Conflict --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file: CHANGELOG.md"]
S2 --> I2["repository behavior"]
I2 --> Conflict["Merge conflict blocks this path"]
Conflict --> V2["required checks"]
Evidence --> S3["Docs: codeql-action-single-version.md"]
S3 --> I3["operator or user guidance"]
I3 --> Conflict["Merge conflict blocks this path"]
Conflict --> V3["docs review"]
Evidence --> S4["Test: test_codeql_pr_workflow_contract.py"]
S4 --> I4["regression suite"]
I4 --> Conflict["Merge conflict blocks this path"]
Conflict --> V4["targeted test run"]
- Result: REQUEST_CHANGES
- Reason: mergeStateStatus is
DIRTY; mergeable isCONFLICTING. - Head SHA:
22ff7feb50baadfac11ad087ef8d5cbeaa75ee23 - Workflow run: 31939732130
- Workflow attempt: 1
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow (7 files)"]
S1 --> I1["GitHub Actions review job"]
I1 --> Conflict["Merge conflict blocks this path"]
Conflict --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file: CHANGELOG.md"]
S2 --> I2["repository behavior"]
I2 --> Conflict["Merge conflict blocks this path"]
Conflict --> V2["required checks"]
Evidence --> S3["Docs: codeql-action-single-version.md"]
S3 --> I3["operator or user guidance"]
I3 --> Conflict["Merge conflict blocks this path"]
Conflict --> V3["docs review"]
Evidence --> S4["Test: test_codeql_pr_workflow_contract.py"]
S4 --> I4["regression suite"]
I4 --> Conflict["Merge conflict blocks this path"]
Conflict --> V4["targeted test run"]
Keep the CodeQL v4.37.6 SHA alignment and the current-main lock/symlink fail-closed changelog entries.
|
A newer version of github/codeql-action/upload-sarif exists, but since this PR has been edited by someone other than Dependabot I haven't updated it. You'll get a PR for the updated version as normal once this PR is merged. |
There was a problem hiding this comment.
Pull request overview
OpenCode reviewed the current-head mergeability evidence and changed-file flow before approval, then found merge conflicts on the affected path.
Findings
1. HIGH Merge Conflict Guidance - Resolve the PR branch against the latest base branch
- Problem: GitHub reports mergeStateStatus
DIRTYfor this pull request. - Root cause: Branch
dependabot/github_actions/main/github/codeql-action/upload-sarif-4.37.6cannot be merged cleanly intomain; the changed-file flow below shows which review/runtime path is blocked by the conflict. - Fix: Merge or rebase the latest
mainintodependabot/github_actions/main/github/codeql-action/upload-sarif-4.37.6, resolve conflict markers in the PR branch, rerun the focused checks, and push the same branch. - Repair commands:
gh pr checkout 918 --repo ContextualWisdomLab/.github
git fetch origin main
git merge --no-ff origin/main # or: git rebase origin/main
git status --short
# resolve files, then git add <resolved-files>
# merge path: git commit
# rebase path: git rebase --continue
git push origin HEAD:dependabot/github_actions/main/github/codeql-action/upload-sarif-4.37.6
# rebase path only: git push --force-with-lease origin HEAD:dependabot/github_actions/main/github/codeql-action/upload-sarif-4.37.6- Regression test: Keep OpenCode approval gated on mergeability so model-output failures cannot approve a conflicted PR.
Merge Conflict Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow (7 files)"]
S1 --> I1["GitHub Actions review job"]
I1 --> Conflict["Merge conflict blocks this path"]
Conflict --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file: CHANGELOG.md"]
S2 --> I2["repository behavior"]
I2 --> Conflict["Merge conflict blocks this path"]
Conflict --> V2["required checks"]
Evidence --> S3["Docs: codeql-action-single-version.md"]
S3 --> I3["operator or user guidance"]
I3 --> Conflict["Merge conflict blocks this path"]
Conflict --> V3["docs review"]
Evidence --> S4["Test: test_codeql_pr_workflow_contract.py"]
S4 --> I4["regression suite"]
I4 --> Conflict["Merge conflict blocks this path"]
Conflict --> V4["targeted test run"]
- Result: REQUEST_CHANGES
- Reason: mergeStateStatus is
DIRTY; mergeable isCONFLICTING. - Head SHA:
2e3029d2c6d80066c01d82930ea6aa2ada0ea319 - Workflow run: 32138878518
- Workflow attempt: 1
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow (7 files)"]
S1 --> I1["GitHub Actions review job"]
I1 --> Conflict["Merge conflict blocks this path"]
Conflict --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file: CHANGELOG.md"]
S2 --> I2["repository behavior"]
I2 --> Conflict["Merge conflict blocks this path"]
Conflict --> V2["required checks"]
Evidence --> S3["Docs: codeql-action-single-version.md"]
S3 --> I3["operator or user guidance"]
I3 --> Conflict["Merge conflict blocks this path"]
Conflict --> V3["docs review"]
Evidence --> S4["Test: test_codeql_pr_workflow_contract.py"]
S4 --> I4["regression suite"]
I4 --> Conflict["Merge conflict blocks this path"]
Conflict --> V4["targeted test run"]
1 participant
Outcome
Align every organization-owned CodeQL Action use in the affected central security workflows to the official full commit SHA for v4.37.6:
github/codeql-action@5595ccaf912efad79be6eef63a5619ff05969be3This includes
init,analyze, andupload-sarif; it removes mixed v4.37.0/v4.37.4/v4.37.5 pins while preserving workflow permissions, SARIF paths/categories, exact-head binding, severity gates, and fail-closed behavior.Bounded scope
Exact current head:
22ff7feb50baadfac11ad087ef8d5cbeaa75ee23.The protected-base diff is limited to:
tests/test_codeql_pr_workflow_contract.py;docs/doctoring/codeql-action-single-version.md; andCHANGELOG.md.The overlapping
ARCHITECTURE.mdandCLAUDE.mdchanges were removed because the authoritative central documentation graph is owned by PR #896. The unrelated trusted-uv materializer test was restored to protected-main content. No model, reviewer credential, branch-protection, product runtime, package dependency, merge, or release authority changes.Verification boundary
The scope correction changed the exact head, so all earlier checks and reviews are historical. Keep Draft until this unchanged head completes CodeQL, security, SAST, secret, dependency/SBOM, exact workflow-contract, and semantic-review gates. The contract must prove every organization-owned
github/codeql-action/{init,analyze,upload-sarif}use is pinned to the same full v4.37.6 commit and no older SHA remains.Merge gate
After exact-head gates are terminal-success and every valid finding is resolved, mark Ready and require the qualifying independent non-author approvals and last-push semantics enforced by protected main. No self-approval, predecessor evidence, administrative bypass, or weakened gate is authorized.