Downgrade CodeQL action versions to specific commits #351
Conversation
Downgrade codeql as latest version seems to incorrectly classify languages
There was a problem hiding this comment.
Pull request overview
This pull request downgrades the CodeQL action from using semantic version @v4 to a pinned commit hash to address language classification issues in the latest version.
Changes:
- Replaced
@v4with commit hash@cf1bb45a277cb3c205638b2cd5c984db1c46a412for all three CodeQL actions (init, autobuild, and analyze)
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| # Initializes the CodeQL tools for scanning. | ||
| - name: Initialize CodeQL | ||
| uses: github/codeql-action/init@v4 | ||
| uses: github/codeql-action/init@cf1bb45a277cb3c205638b2cd5c984db1c46a412 |
There was a problem hiding this comment.
Consider adding a comment explaining why this specific commit is pinned and what issue it resolves. The PR description mentions "incorrectly classify languages" but this workflow only analyzes Java. This would help future maintainers understand the decision and know when it's safe to upgrade.
| @@ -48,7 +48,7 @@ jobs: | |||
| # If this step fails, then you should remove it and run the build manually (see below) | |||
| - name: Autobuild | |||
| if: ${{ matrix.language != 'java' }} | |||
| uses: github/codeql-action/autobuild@v4 | |||
| uses: github/codeql-action/autobuild@cf1bb45a277cb3c205638b2cd5c984db1c46a412 | |||
|
|
|||
| - name: Setup JDK | |||
| uses: actions/setup-java@v5 | |||
| @@ -73,6 +73,6 @@ jobs: | |||
| # ./location_of_script_within_repo/buildscript.sh | |||
|
|
|||
| - name: Perform CodeQL Analysis | |||
| uses: github/codeql-action/analyze@v4 | |||
| uses: github/codeql-action/analyze@cf1bb45a277cb3c205638b2cd5c984db1c46a412 | |||
There was a problem hiding this comment.
Pinning to a specific commit hash has maintenance implications - this action will not automatically receive security updates or bug fixes. Consider setting up a process to periodically review and update this pinned version, or document when it's expected to be safe to upgrade back to a versioned tag.
|
@johnoliver - CodeQL releases weekly, has a subsequent version resolved this, do we have an open issue? |
2 participants
Downgrade codeql as latest version seems to incorrectly classify languages