⬆️ build(deps): consolidate the dependency wave and fix CodeQL ref parity - #109
Merged
Merged
Conversation
init, analyze and upload-sarif all move together from db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 (v4.37.8) to cdf488f595d80d6e07e03d4674febd5ab45fa938 (v4.37.9). They must move as one change. CodeQL refuses a workflow whose steps mix versions of github/codeql-action: "Not all workflow steps that use github/codeql-action actions use the same version." Dependabot opened init (#104), analyze (#103) and upload-sarif (#102) as three separate PRs, so each branch on its own leaves the tree at mixed versions and fails both Analyze (go) and Analyze (actions). #103 and #104 could therefore never go green alone, no matter how often they were rerun. Bumping all three refs in a single commit is the only state that satisfies the parity check. Both target SHAs were confirmed against the upstream annotated tag before pinning; the "# vX.Y.Z" trailing comment format is preserved for lint-workflow-pins-test.
…v3.0.3 anchore/sbom-action/download-syft v0.24.0 -> v0.24.2 (3ad7283483fc7af8ff2b4ea19663c2d5ca935e26) and softprops/action-gh-release v3.0.2 -> v3.0.3 (efb35369e0ad2afab669f228072c1b0d510eae64), consolidating dependabot #105 and #106 into the same wave. Both refs are only reachable from the release workflow, so neither carries the cross-step version-parity constraint that forced the codeql-action refs to move as one. Each commit SHA was dereferenced from the upstream annotated tag and confirmed before pinning; the "# vX.Y.Z" trailing comment stays in the shape lint-workflow-pins-test expects.
Consolidates dependabot #107. fast-uri is a transitive dependency (ajv -> fast-uri), so only the lockfile moves: version, resolved URL and integrity for node_modules/fast-uri, and nothing else. Hand-edited on purpose. `npm install fast-uri@3.1.7 --package-lock-only` produces the same three fields but additionally promotes fast-uri to a direct dependency in package.json and in the lockfile's root package block, which changes the dependency graph rather than refreshing a pinned transitive resolution. The narrower edit is what dependabot itself would land. Verified with `npm ci`: the new integrity hash (sha512-dOvZVzjdZdz7phd9v6jCbwxrBW3fK6n8Rc0CtdmM4bumzMnxywBYhuph...) resolves against the registry and installs fast-uri 3.1.7.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Consolidates the six open dependabot PRs (#102-#107) into one wave, and fixes a
parity defect that makes two of them unmergeable on their own.
The parity defect
Dependabot split
github/codeql-actioninto separate PRs forinitandanalyze. Each PR alone leavescodeql.yamlpinned at two different versions ofthe same action, which the workflow rejects — so neither PR can ever go green
by itself, no matter how many times it is rebased. Bumping all three refs in
one commit is the only shape that passes.
Contents
github/codeql-actionv4.37.8 -> v4.37.9 at all three sites:codeql.yaml:47(init),codeql.yaml:56(analyze),scorecard.yaml:40(upload-sarif). Supersedes build(deps): bump github/codeql-action/upload-sarif from 4.37.8 to 4.37.9 #102, build(deps): bump github/codeql-action/analyze from 4.37.8 to 4.37.9 #103, build(deps): bump github/codeql-action/init from 4.37.8 to 4.37.9 #104.
anchore/sbom-action/download-syft->3ad7283(v0.24.2),release.yaml:108.softprops/action-gh-release->efb3536(v3.0.3),release.yaml:152.fast-uri3.1.5 -> 3.1.7 inhack/schemas-validator/package-lock.json.Every SHA was verified against upstream by dereferencing the annotated tag, not
by trusting the bot's commit message.
fast-uriwas hand-edited (three fields) rather than regenerated:npm install --package-lock-onlyincorrectly promotes it to a directdependency, which would have changed the dependency graph as a side effect of a
patch bump.
Verification
task checkgreen (all 21 stages) on this rebased head.CHANGELOG.mdregenerated with
task changelog-writeafter the rebase, not hand-merged.