[ci]: Update CodeQL action to v4#5
Closed
hdwhdw wants to merge 1 commit into
Closed
Conversation
CodeQL action v2 is unsupported and v3 is deprecated. Bump github/codeql-action init/analyze from v2.1.29 to v4 so scans run on the current CodeQL engine and catch more types of issues, matching the newer scans that surfaced sonic-net#694. Also bump the supporting actions/checkout steps from v3 to v4 since v4 runs on Node 24. Fixes sonic-net#695 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: Dawei Huang <dwhuang9@gmail.com>
|
/azp run |
Owner
Author
|
Superseded by upstream PR sonic-net#704. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Update the CodeQL workflow (
.github/workflows/codeql-analysis.yml):github/codeql-action/init@v2.1.29→@v4github/codeql-action/analyze@v2.1.29→@v4actions/checkout@v3→@v4(both checkout steps in the CodeQL job)Why
CodeQL action v2 is unsupported and v3 is deprecated. Pinning to the stale
v2.1.29meant scans ran on an outdated CodeQL engine and missed newer query packs. Bumping to v4 runs analysis on the current engine — the same modern scanning that surfaced the high-severity findings in sonic-net#694 on an updated copy of this repo — so this repo's scans can catch more types of issues.The supporting
actions/checkoutsteps are bumped to v4 as well because CodeQL v4 runs on the Node 24 runtime, and the old Node 16 checkout would otherwise emit deprecation warnings.No other workflow syntax changes are required for the v4 migration; the config in
.github/codeql/codeql-config.yml(security-and-quality,security-extended) is unchanged.Fixes sonic-net#695
Notes
This PR only modernizes the scanner. The actual code vulnerabilities reported in sonic-net#694 are a separate fix effort tracked under that issue.