[codeql-action/init] running for language `action` fails when referencing in workflow by sha rather than version.

[scottschreckengaust]

When running initialization for the action language, the action fails to run by hash:

Works:

    - name: Initialize CodeQL
      uses: github/codeql-action/init@v3.28.19
      with:
        languages: actions
        build-mode: none

Fails:

    - name: Initialize CodeQL
      uses: github/codeql-action/init@fca7ace96b7d713c7035871441bd52efbe39e27e # v3.28.19
      with:
        languages: actions
        build-mode: none

A Short, Self Contained, Correct (Compilable), Example is coming...
http://sscce.org/

[adityasharad]

action is not a valid language either way - please use actions.

I'd like to see the exact error you're getting from use of the SHA, however, with a link to your workflow run if possible.

[scottschreckengaust]

https://github.com/scottschreckengaust/github-codeql-action-issues-2923

Two workflows with only difference a commit hash versus tag:

• https://github.com/scottschreckengaust/github-codeql-action-issues-2923/blob/main/.github/workflows/works.yml
• https://github.com/scottschreckengaust/github-codeql-action-issues-2923/blob/main/.github/workflows/fails.yml

diff:

% diff works.yml fails.yml
1c1
< name: Works
---
> name: Fails
27c27
<       uses: github/codeql-action/init@v3.28.19 # waiting for https://github.com/github/codeql-action/issues/2923 to pin to commit hash
---
>       uses: github/codeql-action/init@1a7989f3955e0c69f0e0ccc14aee54a387a0fd31 # v3.28.19

Error:
https://github.com/scottschreckengaust/github-codeql-action-issues-2923/actions/runs/15497700037/job/43638227617#step:3:396

Success:
https://github.com/scottschreckengaust/github-codeql-action-issues-2923/actions/runs/15497700033/job/43638227890#step:3:395

[scottschreckengaust]

It seems odd that in the log details the tagged version v3.28.19 still downloads the same hashed action...

[adityasharad]

I think I see the problem. You have two runs here with different versions of the CodeQL Action:

• Failing: 1a7989f is an older commit, present in v3.27.1.
• Succeeding: v3.28.19 is commit fca7ace.

Looking at the changelog, in v3.28.19 we changed the handling of the actions language (the extractor is now included in the CodeQL CLI rather than hardcoded into the CodeQL Action), which I think explains the difference between these two CodeQL Action versions in these runs.

Could you show me a failing run when you pin the commit to fca7ace96b7d713c7035871441bd52efbe39e27e? That should be identical to v3.28.19.

[scottschreckengaust]

Thank you! Looks like I picked a child commit:

https://github.com/github/codeql-action/releases/tag/v3.28.19 -> fca7ace96b7d713c7035871441bd52efbe39e27e