deps(actions): bump github/codeql-action/init from 4.35.5 to 4.36.2#176
deps(actions): bump github/codeql-action/init from 4.35.5 to 4.36.2#176dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [github/codeql-action/init](https://github.com/github/codeql-action) from 4.35.5 to 4.36.2. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@9e0d7b8...8aad20d) --- updated-dependencies: - dependency-name: github/codeql-action/init dependency-version: 4.36.2 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
|
![datadog-official[bot]](https://avatars.githubusercontent.com/in/1358509?s=60&v=4){kind=small}
There was a problem hiding this comment.
PR bumps CodeQL init action from v4.35.5 to v4.36.2 but leaves analyze action at v4.35.5. This creates a version incompatibility: v4.36.2 init uses bundle 2.25.6 (which includes new SHA-256 Git object support added in v4.36.0), while v4.35.5 analyze was released May 15—before SHA-256 support existed. The workflow will fail when analyze cannot parse the database init created.
📊 Validated against 1 scenarios · Open Bits AI session
🤖 Datadog Autotest · Commit 490c488 · What is Autotest? · Any feedback? Reach out in #autotest
|
|
||
| - name: Initialize CodeQL | ||
| uses: github/codeql-action/init@9e0d7b8d25671d64c341c19c0152d693099fb5ba # v4.35.5 | ||
| uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2 |
There was a problem hiding this comment.
CI workflow will fail during the analysis phase when the CodeQL action attempts to process database files with object formats it does not recognize, blocking security scans.
Assertion details
- Input: Workflow uses github/codeql-action/init@v4.36.2 paired with github/codeql-action/analyze@v4.35.5
- Expected:
All CodeQL actions in a workflow should use compatible versions from the same release series - Actual:
init@v4.36.2 uses bundle 2.25.6 (released Jun 4, 2026) with SHA-256 Git object support; analyze@v4.35.5 (released May 15, 2026) predates v4.36.0 and lacks SHA-256 support. When init creates a database with SHA-256 objects, analyze cannot parse it.
Was this helpful? React 👍 or 👎
🤖 Datadog Autotest · What is Autotest? · Any feedback? Reach out in #autotest
|
Superseded by #182. |
Bumps github/codeql-action/init from 4.35.5 to 4.36.2.
Release notes
Sourced from github/codeql-action/init's releases.
Changelog
Sourced from github/codeql-action/init's changelog.
... (truncated)
Commits
8aad20dMerge pull request #3949 from github/update-v4.36.2-dcb947ce1f521b08Add additional changelog notes8aeff0fUpdate changelog for v4.36.2dcb947cMerge pull request #3948 from github/update-bundle/codeql-bundle-v2.25.6c251bceAdd changelog note62953c1Update default bundle to codeql-bundle-v2.25.6423b570Merge pull request #3946 from github/dependabot/npm_and_yarn/npm-minor-5d507a...c35d1b1Merge pull request #3947 from github/dependabot/github_actions/dot-github/wor...cb1a588Merge pull request #3937 from github/robertbrignull/waitForProcessing_backoffba47406Merge pull request #3943 from github/henrymercer/cache-cli-version-infoDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)