From d10fb7e3d1cd308d5af28506a4758300acf1bf69 Mon Sep 17 00:00:00 2001 From: Alexander Nachtmann Date: Tue, 13 Oct 2026 03:19:29 +0200 Subject: [PATCH] Generate security-scan.yml with upload-sarif@v4 Dependabot (#681) bumped the generated security-scan.yml to github/codeql-action/upload-sarif@v4, but the generator still wrote v3, so every local ./build.sh run, even --help, rewrote the file back to v3. Co-Authored-By: Claude Opus 5.5 --- build/Build.CI.GitHubActions.cs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/build/Build.CI.GitHubActions.cs b/build/Build.CI.GitHubActions.cs index b9da7b93c..be01442dc 100644 --- a/build/Build.CI.GitHubActions.cs +++ b/build/Build.CI.GitHubActions.cs @@ -153,7 +153,7 @@ void IConfigureGitHubActions.ConfigureSteps(GitHubActionsStepPipeline pipeline) pipeline.Insert(GitHubActionsStepPosition.PostRun, new GitHubActionsCustomStep { Name = "Upload risk-report SARIF to GitHub code scanning", - Uses = "github/codeql-action/upload-sarif@v3", + Uses = "github/codeql-action/upload-sarif@v4", With = new Dictionary { ["sarif_file"] = "output/packageguard/risk-report.sarif",