Skip to content

chore(ci): bump codeql-action to 4.38.3 and setup-node to 7.1.0 - #395

Merged
xavidop merged 2 commits into
mainfrom
chore/bump-gh-actions
Oct 13, 2026
Merged

xavidop merged 2 commits into
mainfrom
chore/bump-gh-actions

Conversation

@xavidop

@xavidop xavidop commented Oct 13, 2026

Copy link
Copy Markdown
Collaborator

Combines #390, #387 and #382.

  • Bumps CodeQL init and analyze together. Bumping only one caused the version-mismatch failure (Loaded a configuration file for version '4.38.3', but running version '4.38.2').
  • Pins every action to a full SHA with the exact version in the comment. This fixes the zizmor "mismatched or missing version comment" finding and the unpinned setup-node@v7 in commitlint.yml.

🤖 Generated with Claude Code

Bump CodeQL init and analyze together so their versions match, and pin
all actions to full SHAs with exact version comments for zizmor.

Supersedes #390, #387, #382.
@gemini-code-assist

Copy link
Copy Markdown

Note

Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported.

Pin actions/checkout in commitlint.yml to a SHA and give it read-only
permissions. Move the pages and id-token write permissions in
publish-docs.yml down to the deploy job.
@xavidop
xavidop merged commit ea37a5a into main Oct 13, 2026
13 checks passed
@xavidop
xavidop deleted the chore/bump-gh-actions branch October 13, 2026 09:33
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant