From 1f98bd26e12075a1a748107a52c1b920a81138db Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Tue, 22 Sep 2026 13:31:46 +0100 Subject: [PATCH] fix(ci): re-pin codeql-action to v4.38.0 SHA Dependabot #977 (68acee77, merged 2026-09-22) bumped codeql-action from 4.38.0 back to 4.38.1 -- the version #973 had just escaped because it fails GitHub's workflow-startup validation estate-wide (nexia-list#100). Measured on hyperpolymath/standards within the hour: codeql.yml red from 12:09Z after four greens, scorecard.yml red from 11:51Z, and the newest run of each reports jobs=0. That is startup death, not a failing job; note GitHub surfaces it here as conclusion=failure, not startup_failure, because the death is in the called reusable. Five refs across three workflows went back to 1c5b675 (v4.38.1): codeql-reusable.yml init, analyze hypatia-scan-reusable.yml upload-sarif scorecard-reusable.yml upload-sarif x2 The first three are the more dangerous shape: #977 replaced the SHA but inherited #973's comment, so each line reads "@1c5b675... # v4.38.0 (4.38.1 blocked estate-wide)" -- an annotation asserting the exact opposite of the value it annotates. A reviewer reading the comment sees the safe version. scorecard-reusable.yml was never swept by #973 at all and kept honest "# v3" / "# v4.38.1" comments. Also widens the dependabot hold, which did not hold. The ignore entry named "github/codeql-action" while the workflows reference the subpath actions, and Dependabot treats github/codeql-action/init as its own dependency name -- #977's own body says "Updates `github/codeql-action/init` from 4.38.0 to 4.38.1". So the ignore matched nothing. The entry is now "github/codeql-action*". Without this the next scheduled run reopens the same PR and re-breaks both workflows. actions.lock is deliberately untouched: it already carried b96794f for all three workflows, so the lockfile was the correct side of the drift and the workflows were the stale side. Regenerating it instead -- the cure the gate's own error text prescribes -- would have written 1c5b675 back into the lock and re-legitimised the blocked version. Verified: zero refs to 1c5b675 remain under .github/; the actions-lock gate reports no error-severity and no stale findings (93 pre-existing sha-as-ref warnings are unchanged); git diff on actions.lock is empty. Refs: #973, #977, nexia-list#100, nexia-list#101, nexia-list#104 Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01WPSJ7fBhVAMcpSffCBWUDo Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com> --- .github/dependabot.yml | 9 ++++++++- .github/workflows/codeql-reusable.yml | 4 ++-- .github/workflows/hypatia-scan-reusable.yml | 2 +- .github/workflows/scorecard-reusable.yml | 4 ++-- 4 files changed, 13 insertions(+), 6 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index a91454d4b..db0dd83cd 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -16,7 +16,14 @@ updates: # SHA-form re-bump attempt bypassed versions-scoped ignores — see # nexia-list#101/#104). Hold until upstream clears 4.38.1 or a newer # release verifies green; revisit deliberately, not weekly. - - dependency-name: "github/codeql-action" + # + # The trailing * is load-bearing. Workflows reference the SUBPATH + # actions (github/codeql-action/init, /analyze, /upload-sarif) and + # Dependabot treats each subpath as its own dependency name -- so a + # bare "github/codeql-action" entry matches NONE of them. That is how + # #977 re-bumped 4.38.0 -> 4.38.1 on 2026-09-22 straight through this + # hold, startup-killing codeql.yml and scorecard.yml (jobs=0). + - dependency-name: "github/codeql-action*" # github-actions major bumps are usually safe — the SHA pin is the real # version. Standards repo is the canonical-template host so we want the # PRs fast (daily) and grouped. If a specific action proves unstable on diff --git a/.github/workflows/codeql-reusable.yml b/.github/workflows/codeql-reusable.yml index 9f0158d41..4e13fa00d 100644 --- a/.github/workflows/codeql-reusable.yml +++ b/.github/workflows/codeql-reusable.yml @@ -94,12 +94,12 @@ jobs: persist-credentials: false - name: Initialize CodeQL - uses: github/codeql-action/init@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.0 (4.38.1 blocked estate-wide; nexia-list#100) + uses: github/codeql-action/init@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0 (4.38.1 blocked estate-wide; nexia-list#100) with: languages: ${{ inputs.language }} build-mode: ${{ inputs.build-mode }} - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.0 (4.38.1 blocked estate-wide; nexia-list#100) + uses: github/codeql-action/analyze@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0 (4.38.1 blocked estate-wide; nexia-list#100) with: category: "/language:${{ inputs.language }}" diff --git a/.github/workflows/hypatia-scan-reusable.yml b/.github/workflows/hypatia-scan-reusable.yml index 313f8679d..e4dc53f84 100644 --- a/.github/workflows/hypatia-scan-reusable.yml +++ b/.github/workflows/hypatia-scan-reusable.yml @@ -242,7 +242,7 @@ jobs: # This flag only tolerates a genuine upload failure (e.g. Advanced # Security disabled on a private repo) once the job is actually running. continue-on-error: true - uses: github/codeql-action/upload-sarif@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.0 (4.38.1 blocked estate-wide; nexia-list#100) + uses: github/codeql-action/upload-sarif@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0 (4.38.1 blocked estate-wide; nexia-list#100) with: sarif_file: hypatia.sarif category: hypatia diff --git a/.github/workflows/scorecard-reusable.yml b/.github/workflows/scorecard-reusable.yml index 1f9da93f6..7fa7240c5 100644 --- a/.github/workflows/scorecard-reusable.yml +++ b/.github/workflows/scorecard-reusable.yml @@ -92,7 +92,7 @@ jobs: printf 'reconciled=false\n' >> "$GITHUB_OUTPUT" fi - name: Upload SARIF to code scanning - uses: github/codeql-action/upload-sarif@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v3 + uses: github/codeql-action/upload-sarif@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0 (4.38.1 blocked estate-wide; nexia-list#100) with: sarif_file: ${{ steps.select-sarif.outputs.file }} @@ -225,7 +225,7 @@ jobs: printf 'reconciled=false\n' >> "$GITHUB_OUTPUT" fi - name: Upload SARIF to code scanning - uses: github/codeql-action/upload-sarif@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1 + uses: github/codeql-action/upload-sarif@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0 (4.38.1 blocked estate-wide; nexia-list#100) with: sarif_file: ${{ steps.select-sarif.outputs.file }} - name: Retain scan evidence