From 5ae6253f5d831a06d34a29367bec31c02dab4a0d Mon Sep 17 00:00:00 2001 From: Konrad Heimel Date: Thu, 3 Sep 2026 09:00:58 +0200 Subject: [PATCH 1/4] :arrow_up: build(deps): bump all three github/codeql-action refs to v4.37.9 init, analyze and upload-sarif all move together from db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 (v4.37.8) to cdf488f595d80d6e07e03d4674febd5ab45fa938 (v4.37.9). They must move as one change. CodeQL refuses a workflow whose steps mix versions of github/codeql-action: "Not all workflow steps that use github/codeql-action actions use the same version." Dependabot opened init (#104), analyze (#103) and upload-sarif (#102) as three separate PRs, so each branch on its own leaves the tree at mixed versions and fails both Analyze (go) and Analyze (actions). #103 and #104 could therefore never go green alone, no matter how often they were rerun. Bumping all three refs in a single commit is the only state that satisfies the parity check. Both target SHAs were confirmed against the upstream annotated tag before pinning; the "# vX.Y.Z" trailing comment format is preserved for lint-workflow-pins-test. --- .github/workflows/codeql.yaml | 4 ++-- .github/workflows/scorecard.yaml | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/codeql.yaml b/.github/workflows/codeql.yaml index 799dbdfe..98781d84 100644 --- a/.github/workflows/codeql.yaml +++ b/.github/workflows/codeql.yaml @@ -44,7 +44,7 @@ jobs: with: go-version: stable # matches verify.yaml (go.mod minimum, CI on latest stable) - - uses: github/codeql-action/init@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8 + - uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9 with: languages: ${{ matrix.language }} build-mode: ${{ matrix.build-mode }} @@ -53,6 +53,6 @@ jobs: name: Build for CodeQL run: go build -mod=readonly ./... - - uses: github/codeql-action/analyze@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8 + - uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9 with: category: "/language:${{ matrix.language }}" diff --git a/.github/workflows/scorecard.yaml b/.github/workflows/scorecard.yaml index f7a37a95..2cb5d013 100644 --- a/.github/workflows/scorecard.yaml +++ b/.github/workflows/scorecard.yaml @@ -37,7 +37,7 @@ jobs: publish_results: true - name: Upload SARIF to code scanning - uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8 + uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9 with: sarif_file: results.sarif category: scorecard From 9ad4a7aa2bf956f4789e1b3f812d701838793ef2 Mon Sep 17 00:00:00 2001 From: Konrad Heimel Date: Thu, 3 Sep 2026 09:01:36 +0200 Subject: [PATCH 2/4] :arrow_up: build(deps): bump sbom-action to v0.24.2 and action-gh-release to v3.0.3 anchore/sbom-action/download-syft v0.24.0 -> v0.24.2 (3ad7283483fc7af8ff2b4ea19663c2d5ca935e26) and softprops/action-gh-release v3.0.2 -> v3.0.3 (efb35369e0ad2afab669f228072c1b0d510eae64), consolidating dependabot #105 and #106 into the same wave. Both refs are only reachable from the release workflow, so neither carries the cross-step version-parity constraint that forced the codeql-action refs to move as one. Each commit SHA was dereferenced from the upstream annotated tag and confirmed before pinning; the "# vX.Y.Z" trailing comment stays in the shape lint-workflow-pins-test expects. --- .github/workflows/release.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index a232701d..8acd3f96 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -105,7 +105,7 @@ jobs: - uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2 - - uses: anchore/sbom-action/download-syft@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0 + - uses: anchore/sbom-action/download-syft@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2 - name: Build release assets uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3 @@ -149,7 +149,7 @@ jobs: github_token: ${{ secrets.GITHUB_TOKEN }} - name: Publish GitHub Release - uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2 + uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3 with: tag_name: ${{ steps.version.outputs.tag }} name: assent ${{ steps.version.outputs.version }} From 0aab0541bd58071280443302d68852809bf4c6e5 Mon Sep 17 00:00:00 2001 From: Konrad Heimel Date: Thu, 3 Sep 2026 09:02:43 +0200 Subject: [PATCH 3/4] :arrow_up: build(deps): bump fast-uri from 3.1.5 to 3.1.7 in schemas-validator Consolidates dependabot #107. fast-uri is a transitive dependency (ajv -> fast-uri), so only the lockfile moves: version, resolved URL and integrity for node_modules/fast-uri, and nothing else. Hand-edited on purpose. `npm install fast-uri@3.1.7 --package-lock-only` produces the same three fields but additionally promotes fast-uri to a direct dependency in package.json and in the lockfile's root package block, which changes the dependency graph rather than refreshing a pinned transitive resolution. The narrower edit is what dependabot itself would land. Verified with `npm ci`: the new integrity hash (sha512-dOvZVzjdZdz7phd9v6jCbwxrBW3fK6n8Rc0CtdmM4bumzMnxywBYhuph...) resolves against the registry and installs fast-uri 3.1.7. --- hack/schemas-validator/package-lock.json | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/hack/schemas-validator/package-lock.json b/hack/schemas-validator/package-lock.json index e8fd6e23..f79c1699 100644 --- a/hack/schemas-validator/package-lock.json +++ b/hack/schemas-validator/package-lock.json @@ -129,9 +129,9 @@ "license": "MIT" }, "node_modules/fast-uri": { - "version": "3.1.5", - "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.5.tgz", - "integrity": "sha512-gHwA1O9LDIcKunMKhObS/HimwtehO1nPUECKAu5TpKgaO19fcWEl4bliWe1jWxVFvIXztJjjQ4L8XQ1EU9f7Jw==", + "version": "3.1.7", + "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.7.tgz", + "integrity": "sha512-dOvZVzjdZdz7phd9v6jCbwxrBW3fK6n8Rc0CtdmM4bumzMnxywBYhuph6J819RRw/ku+rLbelwfMunktuzVVHg==", "funding": [ { "type": "github", From 066279c1fe0d3aa8a5dba1ebfd3f74f386177455 Mon Sep 17 00:00:00 2001 From: Konrad Heimel Date: Fri, 4 Sep 2026 14:30:55 +0200 Subject: [PATCH 4/4] :memo: chore(release): regenerate CHANGELOG.md after the dependency wave --- CHANGELOG.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index e1173406..51e0da7f 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -84,6 +84,9 @@ repository still gets a decision, never by following the link; no release carrie - build(deps): bump github/codeql-action/init from 4.37.7 to 4.37.8 - build(deps): bump github/codeql-action/analyze from 4.37.7 to 4.37.8 - build(deps): bump github/codeql-action/upload-sarif +- :arrow_up: build(deps): bump all three github/codeql-action refs to v4.37.9 +- :arrow_up: build(deps): bump sbom-action to v0.24.2 and action-gh-release to v3.0.3 +- :arrow_up: build(deps): bump fast-uri from 3.1.5 to 3.1.7 in schemas-validator ### Documentation - :memo: docs(changelog): stamp the v0.3.0 section after tagging