build(deps): bump github/codeql-action from 2.20.0 to 2.20.1 #16146

dependabot · 2023-06-26T18:00:36Z

Bumps github/codeql-action from 2.20.0 to 2.20.1.

Changelog

Sourced from github/codeql-action's changelog.

CodeQL Action Changelog

[UNRELEASED]

No user facing changes.

2.20.1 - 21 Jun 2023

Update default CodeQL bundle version to 2.13.4. #1721

Experimental: add a new resolve-environment action which attempts to infer a configuration for the build environment that is required to build a given project. Do not use this in production as it is part of an internal experiment and subject to change at any time.

2.20.0 - 13 Jun 2023

Bump the version of the Action to 2.20.0. This ensures that users who received a Dependabot upgrade to cdcdbb5, which was mistakenly marked as Action version 2.13.4, continue to receive updates to the CodeQL Action. Full details in #1729

2.3.6 - 01 Jun 2023

Update default CodeQL bundle version to 2.13.3. #1698

2.3.5 - 25 May 2023

Allow invalid URIs to be used as values to artifactLocation.uri properties. This reverses a change from #1668 that inadvertently led to stricter validation of some URI values. #1705

Gracefully handle invalid URIs when fingerprinting. #1694

2.3.4 - 24 May 2023

Updated the SARIF 2.1.0 JSON schema file to the latest from oasis-tcs/sarif-spec. #1668

We are rolling out a feature in May 2023 that will disable Python dependency installation for new users of the CodeQL Action. This improves the speed of analysis while having only a very minor impact on results. #1676

We are improving the way that CodeQL bundles are tagged to make it possible to easily identify bundles by their CodeQL semantic version. #1682

As of CodeQL CLI 2.13.4, CodeQL bundles will be tagged using semantic versions, for example codeql-bundle-v2.13.4, instead of timestamps, like codeql-bundle-20230615.

This change does not affect the majority of workflows, and we will not be changing tags for existing bundle releases.

Some workflows with custom logic that depends on the specific format of the CodeQL bundle tag may need to be updated. For example, if your workflow matches CodeQL bundle tag names against a codeql-bundle-yyyymmdd pattern, you should update it to also recognize codeql-bundle-vx.y.z tags.

Remove the requirement for on.push and on.pull_request to trigger on the same branches. #1675

2.3.3 - 04 May 2023

Update default CodeQL bundle version to 2.13.1. #1664

You can now configure CodeQL within your code scanning workflow by passing a config input to the init Action. See Using a custom configuration file for more information about configuring code scanning. #1590

2.3.2 - 27 Apr 2023

No user facing changes.

2.3.1 - 26 Apr 2023

No user facing changes.

2.3.0 - 21 Apr 2023

Update default CodeQL bundle version to 2.13.0. #1649

... (truncated)

Commits

f6e388e Merge pull request #1736 from github/update-v2.20.1-4385ad556
2874247 Update changelog for v2.20.1
4385ad5 Send job_run_uuid to status report telemetry (#1685)
8ba77ef Bump @octokit/types from 9.0.0 to 10.0.0 (#1734)
82dbde1 Fix setup-swift composite action for versions 5.8, 5.8.1 (#1735)
c6dff34 Merge pull request #1721 from github/update-bundle/codeql-bundle-v2.13.4
3e0c87d Merge branch 'main' into update-bundle/codeql-bundle-v2.13.4
de74ca6 Merge pull request #1732 from github/henrymercer/tolerate-unexpected-processi...
d6201b5 Improve logging messages
0ac1815 Merge pull request #1684 from github/mbg/add-resolve-environment
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

codecov-commenter · 2023-06-26T18:24:38Z

Codecov Report

Merging #16146 (24ecae0) into main (56fc5e6) will decrease coverage by 0.10%.
The diff coverage is n/a.

❗ Your organization is not using the GitHub App Integration. As a result you may experience degraded service beginning May 15th. Please install the Github App Integration for your organization. Read more.

@@            Coverage Diff             @@
##             main   #16146      +/-   ##
==========================================
- Coverage   70.05%   69.96%   -0.10%     
==========================================
  Files         414      414              
  Lines       34824    34824              
==========================================
- Hits        24396    24363      -33     
- Misses       9041     9071      +30     
- Partials     1387     1390       +3

Flag	Coverage Δ
all	`69.96% <ø> (-0.10%)`	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

see 21 files with indirect coverage changes

📣 We’re building smart automated test selection to slash your CI/CD build times. Learn more

jmhbnz · 2023-06-26T22:06:18Z

.github/workflows/scorecards.yml

@@ -50,6 +50,6 @@ jobs:

      # Upload the results to GitHub's code scanning dashboard.
      - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@6c089f53dd51dc3fc7e599c3cb5356453a52ca9e # tag=v1.0.26
+        uses: github/codeql-action/upload-sarif@f6e388ebf0efc915c6c5b165b019ee61a6746a38 # tag=v1.0.26


Note - this tag doesn't seem to be updating as the format seems incorrect. Not a biggie I'll make a good first issue for someone to make the tag use the same format that dependabot understands, i.e. v2.20.1

Edit: Raised #16147

Good news - our theory was correct, after fixing the tag format dependabot is now updating it, thanks @CaojiamingAlan 👍🏻

Good to know

Bumps [github/codeql-action](https://github.com/github/codeql-action) from 2.20.0 to 2.20.1. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@6c089f5...f6e388e) --- updated-dependencies: - dependency-name: github/codeql-action dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>

jmhbnz · 2023-06-27T09:06:00Z

@dependabot rebase

dependabot · 2023-06-27T09:06:02Z

Sorry, only users with push access can use that command.

ahrtr · 2023-06-27T09:07:04Z

@dependabot rebase

dependabot · 2023-06-27T09:08:49Z

Looks like github/codeql-action is up-to-date now, so this is no longer needed.

…ns/github/codeql-action-2.20.1 build(deps): bump github/codeql-action from 2.20.0 to 2.20.1

dependabot bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Jun 26, 2023

jmhbnz approved these changes Jun 26, 2023

View reviewed changes

jmhbnz mentioned this pull request Jun 26, 2023

Tag for codeql-action/upload-sarif action not being updated by dependabot #16147

Closed

4 tasks

dependabot bot force-pushed the dependabot/github_actions/github/codeql-action-2.20.1 branch from b913f4f to 24ecae0 Compare June 27, 2023 08:26

ahrtr approved these changes Jun 27, 2023

View reviewed changes

jmhbnz mentioned this pull request Jun 27, 2023

fix action tag comment pattern to be consistent #16148

Merged

dependabot bot closed this Jun 27, 2023

dependabot bot deleted the dependabot/github_actions/github/codeql-action-2.20.1 branch June 27, 2023 09:09

ArkaSaha30 pushed a commit to ArkaSaha30/etcd that referenced this pull request Jun 27, 2023

Merge pull request etcd-io#16146 from etcd-io/dependabot/github_actio…

ea9112b

…ns/github/codeql-action-2.20.1 build(deps): bump github/codeql-action from 2.20.0 to 2.20.1

serathius mentioned this pull request Jul 13, 2023

Nominating @jmhbnz as etcd reviewer #16233

Closed

4 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

build(deps): bump github/codeql-action from 2.20.0 to 2.20.1 #16146

build(deps): bump github/codeql-action from 2.20.0 to 2.20.1 #16146

dependabot bot commented on behalf of github Jun 26, 2023 •

edited

Loading

codecov-commenter commented Jun 26, 2023 •

edited

Loading

jmhbnz Jun 26, 2023 •

edited

Loading

jmhbnz Jun 27, 2023

ahrtr Jun 27, 2023

jmhbnz commented Jun 27, 2023

dependabot bot commented on behalf of github Jun 27, 2023

ahrtr commented Jun 27, 2023 •

edited

Loading

dependabot bot commented on behalf of github Jun 27, 2023

build(deps): bump github/codeql-action from 2.20.0 to 2.20.1 #16146

build(deps): bump github/codeql-action from 2.20.0 to 2.20.1 #16146

Conversation

dependabot bot commented on behalf of github Jun 26, 2023 • edited Loading

CodeQL Action Changelog

[UNRELEASED]

2.20.1 - 21 Jun 2023

2.20.0 - 13 Jun 2023

2.3.6 - 01 Jun 2023

2.3.5 - 25 May 2023

2.3.4 - 24 May 2023

2.3.3 - 04 May 2023

2.3.2 - 27 Apr 2023

2.3.1 - 26 Apr 2023

2.3.0 - 21 Apr 2023

codecov-commenter commented Jun 26, 2023 • edited Loading

Codecov Report

jmhbnz Jun 26, 2023 • edited Loading

Choose a reason for hiding this comment

jmhbnz Jun 27, 2023

Choose a reason for hiding this comment

ahrtr Jun 27, 2023

Choose a reason for hiding this comment

jmhbnz commented Jun 27, 2023

dependabot bot commented on behalf of github Jun 27, 2023

ahrtr commented Jun 27, 2023 • edited Loading

dependabot bot commented on behalf of github Jun 27, 2023

dependabot bot commented on behalf of github Jun 26, 2023 •

edited

Loading

codecov-commenter commented Jun 26, 2023 •

edited

Loading

jmhbnz Jun 26, 2023 •

edited

Loading

ahrtr commented Jun 27, 2023 •

edited

Loading