Skip to content

fix: synchronize CodeQL v4.39.1 actions and group Dependabot updates - #7368

Open
jdotc1 wants to merge 1 commit into
rubyforgood:mainfrom
jdotc1:fix/issue-7275-codeql-grouped-bump
Open

jdotc1 wants to merge 1 commit into
rubyforgood:mainfrom
jdotc1:fix/issue-7275-codeql-grouped-bump

Conversation

@jdotc1

@jdotc1 jdotc1 commented Nov 11, 2026

Copy link
Copy Markdown

What GitHub issue is this PR for?

Closes #7275.

What changed, and why?

  • Pin github/codeql-action/init, autobuild, and analyze to the same v4.39.1 release (9b3254085494b55a0f7c4c2b3d2d52cc712ce370).
  • Group future github/codeql-action* Dependabot updates so all three steps are synchronized.

Maintainers can close the older individual Dependabot PRs (#7253, #7257, #7258) after merging.

How is this tested?

  • Confirmed the pinned commit against the peeled v4.39.1 Git tag.
  • Parsed the workflow and Dependabot YAML and verified all three pins and the grouping pattern.
  • git diff --check passed.
  • Configuration-only change: application-level tests and screenshots are not applicable.

I noticed an earlier offer to work on this issue; it remains unassigned, and I am happy to coordinate with anyone pursuing a parallel change.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Bump CodeQL actions together and group them in Dependabot (#7253, #7257, #7258)

1 participant