Repository navigation
chore(actions): bump scorecard-action to v2.4.4 and codeql-action to v4.37.9 - #20
Merged
Merged
Conversation
…v4.37.9 Bumps the two security-scanning actions and keeps every codeql-action subpath on one version. - ossf/scorecard-action v2.4.0 -> v2.4.4 - github/codeql-action init, analyze, upload-sarif v3.37.9 -> v4.37.9 The codeql-action subpaths must move together: init and analyze negotiate over a shared state directory, so a split version pair fails at the analyze step. Dependabot proposes each subpath separately (#6 bumps only analyze), which is why they are bundled here instead. codeql-action v4 differs from v3 only in running on Node.js 24. Both workflows use ubuntu-latest, which provides it. The v3 and v4 lines ship in parallel at matching patch levels. scorecard-action v2.4.4 publishes results to api.scorecard.dev rather than api.securityscorecards.dev. Updates the workflow comment and the README badge host to match; the old host still redirects, so the badge change is for accuracy rather than repair. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014Z8F6zDFV8KeU3G8JrCGko
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
hamza-u
approved these changes
Sep 23, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the two security-scanning actions and keeps every
codeql-actionsubpath on one version.ossf/scorecard-action62b2cac)2d11466)github/codeql-action/init6f5948d)cdf488f)github/codeql-action/analyze6f5948d)cdf488f)github/codeql-action/upload-sarif6f5948d)cdf488f)Why the codeql subpaths move together
initandanalyzenegotiate over a shared state directory, so a split version pair fails at the analyze step.Dependabot proposes each subpath separately — #6 bumps only
analyze, which would have leftinitandupload-sarifon v3. That is why they are bundled here. #6 can be closed once this lands; it targets the same SHA (cdf488f) for one of the three call sites.codeql-action v3 -> v4
The major bump carries one change:
Both workflows are
ubuntu-latest, which provides Node 24. The v3 and v4 lines ship in parallel at matching patch levels (3.37.9 and 4.37.9 released together), so this is a runtime bump rather than a feature break.scorecard-action v2.4.0 -> v2.4.4
Inputs are unchanged —
results_file,results_formatandpublish_resultsall still exist inaction.yamlat v4.37.9's tag, and the job's permission block is still what the action needs.What did change is the publish endpoint: v2.4.4 defaults
internal_publish_base_urltohttps://api.scorecard.dev, notapi.securityscorecards.dev. The workflow comment and the README badge host are updated to match.The old badge host still redirects — both resolve to the identical shields.io URL — so the README change is for accuracy, not repair.