chore(security): bump codeql-action/upload-sarif v3 -> v4.35.5#16
Merged
Merged
Conversation
… Node 20 deprecation) SHA 458d36d7 -> 9e0d7b8d in scorecard.yml. Closes the Node 20 deprecation banner firing on every Scorecard run since the workflow first landed. v4 has been stable since 2026-03-27 with 6 patch releases (v4.35.0 -> v4.35.5). GitHub publishes v3 and v4 in parallel during the deprecation window; v3 is the last Node-20 major. Both freshly-shipped pin-discipline rules applied: - Pin to COMMIT SHA (9e0d7b8d), dereferenced from annotated-tag object (f25eda87) via `gh api repos/github/codeql-action/git/tags/<tag-obj-sha> --jq '.object.sha'`. Per feedback_action_sha_pin_commit_not_tag_object.md. - Precise comment `# v4.35.5`, not bare `# v4`, so Dependabot tracks future bumps without falling into the bare-major blind spot. Per feedback_dependabot_precise_version_comment.md. Inline comment in scorecard.yml documents both rules so a future bump author doesn't have to re-derive the lesson. Cross-repo note: ws-scrcpy-web's CodeQL advanced-setup workflow (.github/workflows/codeql.yml) carries the same 458d36d7 pin in 3 places (init + analyze + analyze, across both Rust matrix legs). Coordinated bump worth doing in a separate session; ws-scrcpy-web TODO §27 already flags the deprecation. Closes control-menu TODO item 33 (surfaced 2026-05-19, shipped same day).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes control-menu TODO Item 33 — surfaced 2026-05-19 from the very first OpenSSF Scorecard run; shipping same day.
What
Bump
github/codeql-action/upload-sariffrom v3 SHA `458d36d7d4f47d0dd16ca424c1d3cda0060f1360` to v4.35.5 commit SHA `9e0d7b8d25671d64c341c19c0152d693099fb5ba` in `.github/workflows/scorecard.yml`.Why
Pin discipline applied
Both freshly-shipped repo SOPs applied in the same edit (one PR cycle ago — PRs #14 + #15 surfaced both lessons):
Inline comment in scorecard.yml documents both rules so the next person to touch this pin doesn't re-derive the lesson.
Cross-repo
ws-scrcpy-web's `.github/workflows/codeql.yml` carries the same `458d36d7` pin in 3 places (init + analyze + analyze, across both Rust matrix legs — Linux + Windows). Same bump pending on that side; ws-scrcpy-web TODO §27 already flags the deprecation. Coordinated bump worth doing in a separate session.
Test plan