Skip to content

chore(deps): bump github/codeql-action from 4.32.6 to 4.35.1 #314

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
dependabot wants to merge 1 commit into
base: main
Choose a base branch
from
Open

chore(deps): bump github/codeql-action from 4.32.6 to 4.35.1 #314

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions .github/workflows/security.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,16 +28,16 @@ jobs:
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
Copy link
Copy Markdown

@claude claude bot Mar 30, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟣 Pre-existing issue: All three actions/checkout steps (lines 28, 51, 69) are pinned to commit de0fac2e4500dabe0009e67214ff5f5447ce83dd with the comment # v6, but actions/checkout has never released a v6 — the latest major version is v4. The incorrect comment undermines the auditability purpose of commit-pinned actions; to fix, update the comment to reflect the actual release tag (e.g., # v4.1.x) that corresponds to the pinned commit.

Extended reasoning...

What the bug is and how it manifests

All three actions/checkout steps in .github/workflows/security.yml (lines 28, 51, and 69) reference the action as actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6. The comment # v6 is factually incorrect — actions/checkout has only released up to major version v4 (the latest as of early 2026 is in the v4.x line). There is no v6 tag or release in the actions/checkout repository.

The specific code path that triggers it

Every job in this workflow (codeql, dependency-review, scorecard) checks out code using this step. The SHA pin itself may be valid for the v4.x line, but the comment annotation misleads anyone trying to audit the pin by claiming it corresponds to a non-existent v6 release.

Why existing code doesn't prevent it

GitHub Actions does not validate that commit-pinning comments are accurate — they are purely informational annotations. There is no lint or CI check enforcing that the comment matches the actual tag associated with the pinned SHA.

Impact

The primary purpose of commit-SHA pinning in security workflows is auditability: reviewers and automated tools should be able to cross-reference the hash against a known release tag. With an incorrect version comment (# v6), an auditor searching for actions/checkout v6 will find no such release, casting doubt on the legitimacy of the pin and undermining the supply-chain security posture this workflow is designed to enforce.

How to fix it

Determine which v4.x release corresponds to the pinned commit de0fac2e4500dabe0009e67214ff5f5447ce83dd and update the comment accordingly (e.g., # v4.1.x). Alternatively, update all three checkout steps to the latest v4 release with its correct commit hash and comment.

Step-by-step proof

  1. Examine line 28: uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
  2. Check the actions/checkout releases: tags go up to v4.x.x — there is no v5 or v6 release.
  3. An auditor trying to verify the pin would search for actions/checkout v6, find nothing, and be unable to confirm the hash is a legitimate official release.
  4. The same incorrect comment appears at lines 51 and 69 for the dependency-review and scorecard jobs respectively.
  5. This PR only modifies github/codeql-action version pins — the actions/checkout lines are unchanged context, confirming this is entirely pre-existing.


- name: Initialize CodeQL
uses: github/codeql-action/init@0d579ffd059c29b07949a3cce3983f0780820c98 # v4.32.6
uses: github/codeql-action/init@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1
with:
languages: javascript-typescript
queries: security-extended,security-and-quality

- name: Autobuild
uses: github/codeql-action/autobuild@0d579ffd059c29b07949a3cce3983f0780820c98 # v4.32.6
uses: github/codeql-action/autobuild@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1

- name: Perform CodeQL Analysis
uses: github/codeql-action/analyze@0d579ffd059c29b07949a3cce3983f0780820c98 # v4.32.6
uses: github/codeql-action/analyze@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1
with:
category: "/language:javascript-typescript"

Expand Down Expand Up @@ -78,6 +78,6 @@ jobs:
publish_results: true

- name: Upload Scorecard results
uses: github/codeql-action/upload-sarif@0d579ffd059c29b07949a3cce3983f0780820c98 # v4.32.6
uses: github/codeql-action/upload-sarif@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1
with:
sarif_file: scorecard-results.sarif
Loading