slaguru666/AIPass
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ci(deps): bump codeql-action init+analyze to v4.36.3 together + group future bumps

Browse Source 
The split Dependabot PRs (#init, #analyze) each bumped one path in security.yml,
leaving the sibling at v4.36.2 -> CodeQL fails 'init and analyze must match'.
Bump both to v4.36.3 (SHA 54f647b) in one commit, and add a dependabot groups
block so codeql-action (init/analyze/upload-sarif, one monorepo release) always
lands as a single grouped PR. Fixes the two red Security Scan runs.
This commit is contained in:
AIOSAI
2026-07-05 02:07:18 -07:00
parent 12e54e45f6
commit 3071ea8eac
2 changed files with 10 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/security.yml
+2 -2
View File
@@ -42,7 +42,7 @@ jobs:
security-events: write
steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
- uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
- uses: github/codeql-action/init@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4.36.3
with:
languages: python
- uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
- uses: github/codeql-action/analyze@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4.36.3