Repository navigation
chore(deps): bump github/codeql-action/upload-sarif from 4.39.0 to 4.39.1 - #469
Conversation
Bumps [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) from 4.39.0 to 4.39.1. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@6f2ac81...9b32540) --- updated-dependencies: - dependency-name: github/codeql-action/upload-sarif dependency-version: 4.39.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
❌ Deploy Preview for hivecommons-docs failed. Why did it fail? →
|
hivecommons-hive
Bot
added
dco
![hivecommons-hive[bot]](https://avatars.githubusercontent.com/in/3568013?s=60&v=4){kind=small}
There was a problem hiding this comment.
Decision needed: @clubanderson should confirm this dependabot pin bump of github/codeql-action/upload-sarif (v4.39.0 → v4.39.1) in .github/workflows/scorecard.yml can merge; it is a CODEOWNERS-restricted workflow path.
Verified pin bump, no defect found — routing only because .github/workflows/ is a CODEOWNERS-restricted trust surface.
.github/workflows/scorecard.yml:37: the only change isupload-sarif@6f2ac81… # v4.39.0→upload-sarif@9b32540… # v4.39.1.- Checked against upstream: annotated tag
github/codeql-actionv4.39.1dereferences to commit9b3254085494b55a0f7c4c2b3d2d52cc712ce370, andv4.39.0to6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee, so both the new pin and its comment are consistent. - Workflow permissions are unchanged: top-level
permissions: read-alland the job-scopedsecurity-events: write/id-token: write(scorecard.yml:10,:21-23) are not in the diff. - Repo CI (Lint and build, TypeScript & ESLint, Vitest, npm audit) is green on
b70a381; the failing checks are only the Netlify deploy-preview set, which per #419 is the exhausted Netlify Free quota and unrelated to this change.
Looks correct to me. I have not approved or merged anything.
— hive: agent=reviewer-2 backend=copilot model=claude-fable-5.1 copilot=1.0.88
There was a problem hiding this comment.
Decision needed: @clubanderson should confirm the new upload-sarif pin in .github/workflows/scorecard.yml:37 resolves to github/codeql-action v4.39.1 before this merges.
Routing to a CODEOWNER because this touches a workflow file, not because I found a defect.
What I verified:
- The diff is one line,
.github/workflows/scorecard.yml:37: thegithub/codeql-action/upload-sarifpin moves from thev4.39.0SHA to thev4.39.1SHA with the version comment updated. - The permissions block is unchanged — top-level
permissions: read-all(line 10) and job-levelsecurity-events: write(lines 21–22) are exactly as onmain. - Build, TypeScript & ESLint, Vitest and npm audit are all green on this head. The four Netlify failures are the quota exhaustion already ruled non-blocking in #419.
What I did not do: independently resolve the new SHA against the upstream tag. /.github/workflows/ is a CODEOWNERS-gated path here, so that confirmation belongs with you.
— hive: agent=reviewer backend=copilot model=claude-fable-5.1 copilot=1.0.88
hivecommons-hive
Bot
added
stage/085-needs-decision
|
Needs a decision, not a merge:
Head: verdict requires_human @b70a381, 4/4 checks green, DCO yes, soak 0s of 30m0s. What to do: approve this head ( How to release it:
Clear the cause and the hive re-evaluates on its next pass; the stage moves to |
b70a381
ℹ️ Sentinel notice — informational; author is trusted (allow-listed bot), merge is not blockedHive flagged this PR (author @dependabot[bot], head
Hive did not add the |
|
Note for the merging maintainer: the four red Netlify checks (deploy-preview, Header rules, Redirect rules, Pages changed) are the known Netlify Free-tier quota exhaustion ruled on in #419 (closed), not something this bump introduced. The remaining gate is the 🐝 Hive Agent: — hive: agent=scanner backend=copilot model=claude-fable-5.1 copilot=1.0.88 |
clubanderson
left a comment
clubanderson
left a comment
There was a problem hiding this comment.
Verified: 9b3254085494b55a0f7c4c2b3d2d52cc712ce370 is the commit that tag github/codeql-action@v4.39.1 dereferences to. Netlify reds are the known free-tier quota issue (#419), unrelated.
|
/hive decision approve — upload-sarif pin confirmed to resolve to codeql-action v4.39.1 (annotated tag 8498dc4 → commit 9b32540). Netlify failures are the pre-existing quota exhaustion from #419, not blocking. /lgtm |
clubanderson
added
triage/accepted
|
LGTM label has been added. DetailsGit tree hash: b11c9d598337566a1ab8e3c03af95a873b49000e |
1 similar comment
|
LGTM label has been added. DetailsGit tree hash: b11c9d598337566a1ab8e3c03af95a873b49000e |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: clubanderson The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
hivecommons-hive
Bot
removed
the
role/trusted
…hot at once (#14421) Every hive merge path (sweep, queue, relay, forge) ends in RecordPRMergedAudit, but nothing removed the PR from the dashboard status or the governor's cached ActionableResult: the row left only when the pull_request closed webhook came back round through the hub, when the closed-row sweep ran on the next status publish, or when a full enumeration replaced the snapshot. hivecommons/docs#469 was merged by the sweep at 18:25Z and still showed as Sentinel alert - needs human an hour later while the governor re-evaluated it as merge-eligible seven times. The attribution audit sink now applies the same closed snapshot a webhook delivery would for pr_merged and pr_closed records, patching both stores and remembering the patch for replay. Refs #14420 Signed-off-by: Andy Anderson <andy@clubanderson.com>
Bumps github/codeql-action/upload-sarif from 4.39.0 to 4.39.1.
Release notes
Sourced from github/codeql-action/upload-sarif's releases.
Changelog
Sourced from github/codeql-action/upload-sarif's changelog.
... (truncated)
Commits
9b32540Merge pull request #4257 from github/update-v4.39.1-c5a2f4b0fb5e1ed9Trigger workflows20f5ec3Update changelog for v4.39.1c5a2f4bMerge pull request #4245 from github/henrymercer/graduate-overlay-trap-caching61a5a80Merge pull request #4256 from github/update-bundle/codeql-bundle-v2.27.33dd33f8Merge pull request #4249 from github/mbg/upload-improvements-for-4223b96e339Change comment forgetConfigcall inupload-sarif7fa4518UseshouldSkipSarifUploadinanalyze-action.tsa69c7cbDocument that setting the env vars tofalsetakes precedence74ddcd9Fix typo in commentDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)