Skip to content

ci(deps): stop naming a sub-action count in the CodeQL grouping comment - #69

Merged
msalvatti merged 1 commit into
mainfrom
ci/codeql-comment-count-agnostic
Aug 3, 2026
Merged

ci(deps): stop naming a sub-action count in the CodeQL grouping comment#69
msalvatti merged 1 commit into
mainfrom
ci/codeql-comment-count-agnostic

Conversation

@msalvatti

Copy link
Copy Markdown
Member

The grouping comment said "the three CodeQL sub-actions". Repositories in this family use three or fourautobuild only where the analysis needs it, upload-sarif in scorecard.yml:

repo sub-actions
nest-queue, nest-realtime, nest-ai-tokens, nest-storage 3
nest-cache, nest-logger, nest-config, nest-core, nest-notification 4

So the number was already wrong in three of them, and would go stale in the rest the moment a workflow gained autobuild. Copilot caught it on the nest-cache grouping PR.

The patterns entry already covers every sub-action; the prose now says so instead of counting, and explains why the set varies.

The comment said "the three CodeQL sub-actions". Repositories in this family use
three or four — `autobuild` only where the analysis needs it, `upload-sarif` in
scorecard.yml — so the number was already wrong in three of them and would go
stale in the rest. The pattern covers them all; the prose now says so.
Copilot AI review requested due to automatic review settings August 3, 2026 15:55

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟢 Ready to approve

The change is limited to a documentation/comment clarification in Dependabot config with no functional impact and the YAML structure remains valid.

This review doesn't count toward merge requirements. Sign up for the private preview to control whether Copilot approvals count.

Pull request overview

This PR updates the Dependabot grouping comment for CodeQL GitHub Actions updates so it no longer hard-codes a sub-action count that varies across repositories in this org family and could easily go stale.

Changes:

  • Reworded the CodeQL Dependabot group comment to avoid claiming “three” sub-actions.
  • Generalized the illustrative version-mismatch message to placeholders (<older> / <newer>).
  • Clarified why sub-actions vary (e.g., upload-sarif in scorecard.yml, autobuild only when needed) while keeping the broad pattern-based grouping rationale.
File summaries
File Description
.github/dependabot.yml Updates the CodeQL group comment to describe the invariant (single versioned product) without naming an org-dependent sub-action count.
Review details
  • Files reviewed: 1/1 changed files
  • Comments generated: 0
  • Review effort level: Lite

We're testing this review assessment. Please use 👍 or 👎 to tell us if it's correct.

@msalvatti
msalvatti merged commit 0b04776 into main Aug 3, 2026
18 checks passed
@msalvatti
msalvatti deleted the ci/codeql-comment-count-agnostic branch August 3, 2026 15:59
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants