From 7b9c94b7d065e26d0432731c7acf1d2889d3939c Mon Sep 17 00:00:00 2001 From: Nils Lehnen <30603423+iderex@users.noreply.github.com> Date: Thu, 13 Aug 2026 19:12:29 +0200 Subject: [PATCH] Name the release the CodeQL pin carries, so the audit can read it [#19] Two steps pinned a commit with `# v4` beside it. A major line is not a version anybody can compare a pin against, and the workflow audit has started refusing that shape: upstream moved the `v4` tag off the pinned commit, so the comment now names a different commit from the one the step runs, and every pull request on this repository reds on it. The pin does not move. `5595ccaf912efad79be6eef63a5619ff05969be3` is what both steps ran before and after, and only the comment changes, from the line to the release that points at that commit: gh api repos/github/codeql-action/git/ref/tags/v4.37.6 --jq '.object.sha' 9e3211c9a3b9311dfe05da2ed48eea3386f042dd gh api repos/github/codeql-action/git/tags/9e3211c9a3b9311dfe05da2ed48eea3386f042dd --jq '.object.sha' 5595ccaf912efad79be6eef63a5619ff05969be3 The failure this prevents is not the red run, which is a symptom. It is that a pin whose comment names a moving reference cannot be read: the next person comparing the pin against what it claims to be has nothing to compare it with, and an update that silently replaced the commit would look the same as one that did not. Signed-off-by: Nils Lehnen <30603423+iderex@users.noreply.github.com> --- .github/workflows/codeql.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 1e1348e..e822872 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -65,7 +65,7 @@ jobs: cache: false - name: Initialize CodeQL - uses: github/codeql-action/init@5595ccaf912efad79be6eef63a5619ff05969be3 # v4 + uses: github/codeql-action/init@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6 with: languages: go # The extractor needs a build. `autobuild` runs the module's own one, @@ -74,6 +74,6 @@ jobs: build-mode: autobuild - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@5595ccaf912efad79be6eef63a5619ff05969be3 # v4 + uses: github/codeql-action/analyze@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6 with: category: "/language:go"