Repository navigation
chore: refresh CodeQL and Dependabot configuration - #37
Merged
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Pin CodeQL to immutable v4.39.1 and correct and group the weekly GitHub Actions Dependabot updates.
Motivation
CodeQL init and analyze were still on v4.38.2. Dependabot's GitHub Actions ecosystem requires
directory: "/"; the existing/.github/workflowsvalue is not the supported configuration and can prevent updates.Changes
init,analyzeandupload-sarifto commit9b3254085494b55a0f7c4c2b3d2d52cc712ce370(v4.39.1)./, keep weekly updates, and groupgithub/codeql-action/*together.Tests performed
Passed:
npm ci --ignore-scripts,npm test,npm run coverage,npm run lint,npm run typecheck,npm run build,npm run audit:fixture,npm run package:smoke,npm run action:check,npm audit --audit-level=high,git diff --check,actionlint, and YAML/Dependabot configuration checks.Compatibility
No CLI, report, Action input/output, permission, trigger, analysis configuration, or SARIF behaviour changed. The Node.js engine floor and CI matrix remain unchanged.
Security and privacy
All external workflow Actions remain pinned to full commit SHAs. No credentials, merchant data, production secrets, or new network behaviour were added.
Shopify source/evidence
N/A.
Release impact
This is an unreleased workflow maintenance change. The package version remains 0.4.0; no tag or npm publish is part of this PR.
Checklist