Repository navigation
chore(deps): bump the actions group with 2 updates - #92
Merged
Merged
Conversation
Bumps the actions group with 2 updates: [github/codeql-action](https://github.com/github/codeql-action) and [dawidd6/action-send-mail](https://github.com/dawidd6/action-send-mail). Updates `github/codeql-action` from 4.37.8 to 4.37.9 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@v4.37.8...v4.37.9) Updates `dawidd6/action-send-mail` from 3.12.0 to 18 - [Release notes](https://github.com/dawidd6/action-send-mail/releases) - [Commits](dawidd6/action-send-mail@v3.12.0...v18) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.37.9 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: dawidd6/action-send-mail dependency-version: '18' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
Up to standards ✅🟢 Issues
|
![codacy-production[bot]](https://avatars.githubusercontent.com/in/56611?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull Request Overview
The PR successfully updates the CodeQL action and the email notification action to their respective target versions. Automated analysis confirms that the changes meet the project's quality standards. No blocking issues or security vulnerabilities were identified in the implementation. Verification should focus on ensuring that the GitHub Actions workflows execute correctly with the updated versions.
Test suggestions
- Verify that the CodeQL analysis workflow completes successfully with version 4.37.9.
- Verify that the push-email-notify workflow successfully sends emails with version 18.
Prompt proposal for missing tests
Consider implementing these tests if applicable:
1. Verify that the CodeQL analysis workflow completes successfully with version 4.37.9.
2. Verify that the push-email-notify workflow successfully sends emails with version 18.
TIP Improve review quality by adding custom instructions
TIP How was this review? Give us feedback
Contributor
Author
|
Dependabot can't parse your workflow-linter.yml. Because of this, Dependabot cannot update this pull request. |
hyperpolymath
approved these changes
Sep 2, 2026
hyperpolymath
deleted the
dependabot/github_actions/actions-f0634a0040
branch
September 2, 2026 11:54
|
hyperpolymath
added a commit
that referenced
this pull request
Sep 2, 2026
…s; standards pins → c59f24f7 (#96) Root cause of the CodeQL outage: Dependabot #92 bumped github/codeql-action to v4.37.9 without regenerating .github/workflows/actions.lock, so every CodeQL run since 2026-09-02 11:54Z died in startup_failure ("Invalid lockfile") and the two required CodeQL contexts could never report on any PR. Nobody could have regenerated the lock either: `gh actions-lock` refuses to run while any workflow is unparseable, and workflow-linter.yml had `permissions: read-all` followed by an indented `actions: read` (invalid YAML). Fixed to a mapping. - actions.lock: codeql-action v4.37.9 (cdf488f) pinned; stale dawidd6/action-send-mail entry pruned. - push-email-notify.yml deleted: disabled_manually, last run skipped 2026-07-20, references a tag the lock could not resolve; replaced estate-wide by smtp-notify-action (standards spec §5.5). - dependabot.yml: `github-actions` ecosystem removed — pin bumps come from the standards lock-refresh workflow, which regenerates the lock in the same PR (spec §6.4). `guix` removed: not a Dependabot ecosystem, and an invalid entry disables the whole config. - standards reusables pinned 84355587 → c59f24f7 (PR #718): the lock check is now its own job that fetches its scripts from standards instead of the consumer cwd, which is why "Workflow security linter" exited 127 here on every run. Verified locally: all 17 workflows parse (yq); `update-actions-lock.sh --verify-local` valid; `check-actions-lock-gate.sh` exit 0. Unblocks #90 (its two required CodeQL contexts). Ruleset replacement follows as a separate settings change (standards spec §7.3).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the actions group with 2 updates: github/codeql-action and dawidd6/action-send-mail.
Updates
github/codeql-actionfrom 4.37.8 to 4.37.9Release notes
Sourced from github/codeql-action's releases.
Changelog
Sourced from github/codeql-action's changelog.
Commits
cdf488fMerge pull request #4107 from github/update-v4.37.9-920ba7cd17243f38Update changelog for v4.37.9920ba7cMerge pull request #4106 from github/update-bundle/codeql-bundle-v2.26.4ecfa6e1Add changelog noteadcdf4aUpdate default bundle to codeql-bundle-v2.26.4486fec2Merge pull request #4099 from github/update-supported-enterprise-server-versions134624cMerge pull request #4101 from github/dependabot/npm_and_yarn/npm-minor-457d82...ff43db8Merge pull request #4103 from github/mergeback/v4.37.8-to-main-db488dde4605e03Rebuild099c869Update changelog and version after v4.37.8Updates
dawidd6/action-send-mailfrom 3.12.0 to 18Release notes
Sourced from dawidd6/action-send-mail's releases.
... (truncated)
Commits
94de994fix: Use extended HELLO with github.com domain (#302)6e50282build(deps): bump actions/checkout from 6 to 7 (#300)1d138f3build(deps): bump nodemailer from 9.0.0 to 9.0.1 (#299)1369c5bnode_modules: update (#297)d86d472build(deps): bump nodemailer from 8.0.11 to 9.0.0 (#296)19dc783build(deps): bump nodemailer from 8.0.10 to 8.0.11 (#295)0dd1be8build(deps): bump nodemailer from 8.0.9 to 8.0.10 (#294)6bf8b9cbuild(deps): bump nodemailer from 8.0.8 to 8.0.9 (#293)51e2c0dbuild(deps): bump nodemailer from 8.0.7 to 8.0.8 (#292)076b075build(deps): bump brace-expansion from 5.0.5 to 5.0.6 (#291)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions