build(deps): Bump github/codeql-action from 2.20.1 to 2.20.4 by dependabot[bot] · Pull Request #742 · notaryproject/notation

dependabot · 2023-07-17T10:24:33Z

Bumps github/codeql-action from 2.20.1 to 2.20.4.

Changelog

Sourced from github/codeql-action's changelog.

CodeQL Action Changelog

[UNRELEASED]

No user facing changes.

See the releases page for the relevant changes to the CodeQL CLI and language packs.

2.20.4 - 14 Jul 2023

This is the last release of the Action that supports CodeQL CLI versions 2.8.5 to 2.9.3. These versions of the CodeQL CLI were deprecated on June 20, 2023 alongside GitHub Enterprise Server 3.5 and will not be supported by the next release of the CodeQL Action (2.21.0).

If you are using one of these versions, please update to CodeQL CLI version 2.9.4 or later. For instance, if you have specified a custom version of the CLI using the 'tools' input to the 'init' Action, you can remove this input to use the default version.

Alternatively, if you want to continue using a version of the CodeQL CLI between 2.8.5 and 2.9.3, you can replace 'github/codeql-action/@v2' by 'github/codeql-action/@v2.20.4' in your code scanning workflow to ensure you continue using this version of the CodeQL Action.

We are rolling out a feature in July 2023 that will slightly reduce the default amount of RAM used for query execution, in proportion to the runner's total memory. This will help to avoid out-of-memory failures on larger runners. #1760

Update default CodeQL bundle version to 2.14.0. #1762

2.20.3 - 06 Jul 2023

Update default CodeQL bundle version to 2.13.5. #1743

2.20.2 - 03 Jul 2023

No user facing changes.

2.20.1 - 21 Jun 2023

Update default CodeQL bundle version to 2.13.4. #1721

Experimental: add a new resolve-environment action which attempts to infer a configuration for the build environment that is required to build a given project. Do not use this in production as it is part of an internal experiment and subject to change at any time.

2.20.0 - 13 Jun 2023

Bump the version of the Action to 2.20.0. This ensures that users who received a Dependabot upgrade to cdcdbb5, which was mistakenly marked as Action version 2.13.4, continue to receive updates to the CodeQL Action. Full details in #1729

2.3.6 - 01 Jun 2023

Update default CodeQL bundle version to 2.13.3. #1698

2.3.5 - 25 May 2023

Allow invalid URIs to be used as values to artifactLocation.uri properties. This reverses a change from #1668 that inadvertently led to stricter validation of some URI values. #1705

Gracefully handle invalid URIs when fingerprinting. #1694

2.3.4 - 24 May 2023

Updated the SARIF 2.1.0 JSON schema file to the latest from oasis-tcs/sarif-spec. #1668

We are rolling out a feature in May 2023 that will disable Python dependency installation for new users of the CodeQL Action. This improves the speed of analysis while having only a very minor impact on results. #1676

We are improving the way that CodeQL bundles are tagged to make it possible to easily identify bundles by their CodeQL semantic version. #1682

As of CodeQL CLI 2.13.4, CodeQL bundles will be tagged using semantic versions, for example codeql-bundle-v2.13.4, instead of timestamps, like codeql-bundle-20230615.

This change does not affect the majority of workflows, and we will not be changing tags for existing bundle releases.

Some workflows with custom logic that depends on the specific format of the CodeQL bundle tag may need to be updated. For example, if your workflow matches CodeQL bundle tag names against a codeql-bundle-yyyymmdd pattern, you should update it to also recognize codeql-bundle-vx.y.z tags.

... (truncated)

Commits

489225d Merge pull request #1777 from github/update-v2.20.4-a148c5807
1b6383d Update changelog for v2.20.4
a148c58 Merge pull request #1776 from github/aeisenberg/changelog-releases
50527c5 Add link to releases page in changelog
814b2ed Merge pull request #1762 from github/update-bundle/codeql-bundle-v2.14.0
d2baed4 Merge branch 'main' into update-bundle/codeql-bundle-v2.14.0
c552617 Merge pull request #1774 from github/dependabot/npm_and_yarn/npm-a34e423e98
c1f4958 Fix dependency incompatibilities
40a500c Update checked-in dependencies
4fad06f Bump the npm group with 21 updates
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [github/codeql-action](https://github.com/github/codeql-action) from 2.20.1 to 2.20.4. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@v2.20.1...489225d) --- updated-dependencies: - dependency-name: github/codeql-action dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>

codecov-commenter · 2023-07-17T10:27:49Z

Codecov Report

Merging #742 (58e564d) into main (354e74f) will not change coverage.
The diff coverage is n/a.

❗ Your organization is not using the GitHub App Integration. As a result you may experience degraded service beginning May 15th. Please install the Github App Integration for your organization. Read more.

@@           Coverage Diff           @@
##             main     #742   +/-   ##
=======================================
  Coverage   63.66%   63.66%           
=======================================
  Files          40       40           
  Lines        2232     2232           
=======================================
  Hits         1421     1421           
  Misses        690      690           
  Partials      121      121

📣 We’re building smart automated test selection to slash your CI/CD build times. Learn more

priteshbandi

LGTM

shizhMSFT · 2023-07-18T01:02:35Z

.github/workflows/scorecard.yml

          retention-days: 5

      - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@4c8f13758e748234abaa6a831d6f53981844a524 # tag=v2.1.26


This looks malicious that commit is updated but the tag is not.

There are other version comments that are incorrect. I will create a PR to fix them after merge this one.

JeyJeyGao · 2023-07-19T01:08:41Z

According to Dependabot integration testing file:
https://github.com/dependabot/dependabot-core/blob/45b7bc53003e6611f476e97e52fc56a7de920a32/github_actions/spec/fixtures/workflow_files/pinned_sources_version_comments.yml#L1-L19
the # tag=v2.1.26 version comment shoud be supported. However,
github/codeql-action/upload-sarif@4c8f13758e748234abaa6a831d6f53981844a524 # tag=v2.1.26 is incorrect. The SHA digest for v2.1.26 is e0e5ded33cabb451ae0a9768fc7b0410bad9ad44 according to the release, so the Dependabot thinks that the version comment is not relevent to the digest.

Update pinned source version comment Signed-off-by: Junjie Gao <junjiegao@microsoft.com> Signed-off-by: Junjie Gao <junjiegao@microsoft.com>

Signed-off-by: Junjie Gao <junjiegao@microsoft.com> Signed-off-by: Junjie Gao <junjiegao@microsoft.com>

JeyJeyGao · 2023-07-19T01:18:38Z

Manually updated the version comment.

shizhMSFT

LGTM

ghost

LGTM

priteshbandi

LGTM

…roject#742) Bumps [github/codeql-action](https://github.com/github/codeql-action) from 2.20.1 to 2.20.4. Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: Junjie Gao <junjiegao@microsoft.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Junjie Gao <junjiegao@microsoft.com>

dependabot bot requested review from JeyJeyGao, NiazFK, gokarnm, justincormack, priteshbandi, rgnote and shizhMSFT as code owners July 17, 2023 10:24

dependabot bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Jul 17, 2023

dependabot bot requested a review from SteveLasker as a code owner July 17, 2023 10:24

dependabot bot requested a review from a user July 17, 2023 10:24

dependabot bot mentioned this pull request Jul 17, 2023

build(deps): Bump github/codeql-action from 2.20.1 to 2.20.3 #738

Closed

priteshbandi previously approved these changes Jul 17, 2023

View reviewed changes

shizhMSFT requested changes Jul 18, 2023

View reviewed changes

Update scorecard.yml

1508bee

Update pinned source version comment Signed-off-by: Junjie Gao <junjiegao@microsoft.com> Signed-off-by: Junjie Gao <junjiegao@microsoft.com>

JeyJeyGao dismissed priteshbandi’s stale review via 1508bee July 19, 2023 01:16

Update scorecard.yml

58e564d

Signed-off-by: Junjie Gao <junjiegao@microsoft.com> Signed-off-by: Junjie Gao <junjiegao@microsoft.com>

shizhMSFT approved these changes Jul 19, 2023

View reviewed changes

ghost approved these changes Jul 19, 2023

View reviewed changes

priteshbandi reviewed Jul 19, 2023

View reviewed changes

priteshbandi merged commit 50609fd into main Jul 19, 2023

dependabot bot deleted the dependabot/github_actions/github/codeql-action-2.20.4 branch July 19, 2023 22:35

shizhMSFT mentioned this pull request Jul 21, 2023

bump: tag and release v1.0.0 #748

Merged

6 tasks

yizha1 mentioned this pull request Aug 22, 2023

Update github actions version comments #747

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

build(deps): Bump github/codeql-action from 2.20.1 to 2.20.4#742

build(deps): Bump github/codeql-action from 2.20.1 to 2.20.4#742
priteshbandi merged 3 commits intomainfrom
dependabot/github_actions/github/codeql-action-2.20.4

dependabot bot commented on behalf of github Jul 17, 2023

Uh oh!

codecov-commenter commented Jul 17, 2023 •

edited

Loading

Uh oh!

priteshbandi left a comment

Uh oh!

shizhMSFT Jul 18, 2023

Uh oh!

JeyJeyGao Jul 19, 2023

Uh oh!

JeyJeyGao Jul 19, 2023

Uh oh!

JeyJeyGao commented Jul 19, 2023

Uh oh!

JeyJeyGao commented Jul 19, 2023

Uh oh!

shizhMSFT left a comment

Uh oh!

ghost left a comment

Uh oh!

priteshbandi left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Comments

Conversation

dependabot bot commented on behalf of github Jul 17, 2023

CodeQL Action Changelog

[UNRELEASED]

2.20.4 - 14 Jul 2023

2.20.3 - 06 Jul 2023

2.20.2 - 03 Jul 2023

2.20.1 - 21 Jun 2023

2.20.0 - 13 Jun 2023

2.3.6 - 01 Jun 2023

2.3.5 - 25 May 2023

2.3.4 - 24 May 2023

Uh oh!

codecov-commenter commented Jul 17, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

priteshbandi left a comment

Choose a reason for hiding this comment

Uh oh!

shizhMSFT Jul 18, 2023

Choose a reason for hiding this comment

Uh oh!

JeyJeyGao Jul 19, 2023

Choose a reason for hiding this comment

Uh oh!

JeyJeyGao Jul 19, 2023

Choose a reason for hiding this comment

Uh oh!

JeyJeyGao commented Jul 19, 2023

Uh oh!

JeyJeyGao commented Jul 19, 2023

Uh oh!

shizhMSFT left a comment

Choose a reason for hiding this comment

Uh oh!

ghost left a comment

Choose a reason for hiding this comment

Uh oh!

priteshbandi left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Comments

codecov-commenter commented Jul 17, 2023 •

edited

Loading