From 6764788b7f06fa7784471f01412994ee28080809 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?FabioLeit=C3=A3o?= Date: Mon, 24 Aug 2026 22:59:55 -0300 Subject: [PATCH 1/2] chore: annotate CodeQL workflow as sole scanning source post-migration Verifies the workflow analyzes and uploads cleanly now that default-setup is disabled. Ref #1757. --- .github/workflows/codeql.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 44f5c539..19ee4528 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -1,6 +1,7 @@ # CodeQL: security and quality analysis for Python (OWASP, injection, etc.). # Results appear under Security > Code scanning; configure rulesets for merge protection. # https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning +# (verify: default-setup disabled 2026-08-25, this custom workflow is the sole CodeQL source of truth now, badge restored -- issue #1757) # # Actions pinned to full commit SHAs (tag in comment); bump via Dependabot or after upstream review. # From 4bf001c1c004c7262a2ee05973a5bf53ca998d84 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?FabioLeit=C3=A3o?= Date: Mon, 24 Aug 2026 23:02:37 -0300 Subject: [PATCH 2/2] fix(ci): align codeql-action init pin with analyze pin (v4.37.6 -> v4.37.7) Mismatched pins across the two steps caused: Loaded a configuration file for version 4.37.6, but running version 4.37.7. Ref #1757. --- .github/workflows/codeql.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 19ee4528..8a4009f6 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -41,7 +41,7 @@ jobs: persist-credentials: false - name: Initialize CodeQL - uses: github/codeql-action/init@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6 + uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7 with: languages: ${{ matrix.language }} # Keep broad default coverage for "just in case" findings.