From 04d2d8805654dc0d47f3a2dad2b99418813ea061 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 4 Sep 2026 04:13:25 +0000 Subject: [PATCH 1/3] chore(deps): bump the github-actions-dependencies group across 1 directory with 2 updates Bumps the github-actions-dependencies group with 2 updates in the / directory: [github/codeql-action/init](https://github.com/github/codeql-action) and [github/codeql-action/analyze](https://github.com/github/codeql-action). Updates `github/codeql-action/init` from 4.37.8 to 4.37.9 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28...cdf488f595d80d6e07e03d4674febd5ab45fa938) Updates `github/codeql-action/analyze` from 4.37.8 to 4.37.9 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28...cdf488f595d80d6e07e03d4674febd5ab45fa938) --- updated-dependencies: - dependency-name: github/codeql-action/init dependency-version: 4.37.9 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions-dependencies - dependency-name: github/codeql-action/analyze dependency-version: 4.37.9 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions-dependencies ... Signed-off-by: dependabot[bot] --- .github/workflows/continuous-integration.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/continuous-integration.yml b/.github/workflows/continuous-integration.yml index 0956011..ab43b43 100644 --- a/.github/workflows/continuous-integration.yml +++ b/.github/workflows/continuous-integration.yml @@ -294,10 +294,10 @@ jobs: runs-on: *ci-runner steps: - uses: hoverkraft-tech/ci-github-common/actions/checkout@3a27d31e9ccefbe9609cc9165017ed100ff34a22 # 0.38.0 - - uses: github/codeql-action/init@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8 + - uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9 with: languages: ${{ inputs.code-ql }} - - uses: github/codeql-action/analyze@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8 + - uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9 dependency-review: name: 🛡️ Dependency Review From 427566d8a8d7dc8237df7c844787aa5df47cd1a0 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Fri, 4 Sep 2026 05:05:37 +0000 Subject: [PATCH 2/3] Initial plan From 7ab1063ca930802440bebf6c09585cc490c560ae Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Fri, 4 Sep 2026 05:13:54 +0000 Subject: [PATCH 3/3] fix(ci): disable incompatible zizmor workflow lint Co-authored-by: neilime <314088+neilime@users.noreply.github.com> --- .github/workflows/__shared-ci.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/__shared-ci.yml b/.github/workflows/__shared-ci.yml index 86bb0e8..689c35f 100644 --- a/.github/workflows/__shared-ci.yml +++ b/.github/workflows/__shared-ci.yml @@ -20,6 +20,8 @@ jobs: # FIXME: Remove this once JS deps will be updated to versions that do not trigger Trivy vulnerabilities linter-env: | VALIDATE_TRIVY=false + # FIXME: Remove this once zizmor supports this repository workflow patterns + VALIDATE_GITHUB_ACTIONS_ZIZMOR=false test-action-dependencies-cache: name: Test action "dependencies-cache"