Move all three CodeQL action pins to v4.37.4 atomically - #364
Merged
Conversation
Supersedes #348, #350 and #352, which cannot be merged individually. Two independent reasons, and either alone is sufficient. CodeQL refuses to run on a split version. The CI log on #348 says it plainly: "Loaded a configuration file for version '4.37.3', but running version '4.37.4'". Both CodeQL jobs fail on all three PRs, so whichever merged first would leave main's security scanning broken until the other two followed. And test_ci_action_dependency_carrier_uses_exact_atomic_pins asserts the three refs are identical and that each carries the literal version comment. That guard fired on all three PRs. It is worth being precise about what happened, because this repository has been burned by the opposite: a previous dependency backlog retired two mutation guards silently, by moving a value some hardcoded digest depended on. This time the guard did not go quiet. It failed loudly and it caught a real defect. So the constants are updated deliberately here rather than the guard being softened into deriving the pin from the workflow, because the equality-across-three-copies IS the atomicity property that just proved its worth. Digests dereferenced from upstream rather than taken from the PR. Both tags are annotated, so a single-hop read returns the tag object; both were followed to the commit. v4.37.3 is e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 and matches what was committed. v4.37.4 is f205ea1c3313d32999d8d6a48b4f6530d4437b38 and matches what is applied. The guard was re-checked for vacuity after the update: reverting one of the three workflow pins turns it red, restoring turns it green. Two latent instances of the same hardcoded-digest pattern remain and are not touched here. The same test asserts the actions/checkout digest 19 times, and test_phase5_enterprise_handoff_truth.py embeds that digest inside a multi-line string literal, which is the harder one to notice. A future actions/checkout bump hits both. Worth knowing that the repository already solved this correctly twice, in test_single_tenant_deployment.py and test_least_privilege_deployment_workflow.py, which derive the pin from the workflow instead. Verified: 4544 unit passed, 2 skipped.
This was referenced Aug 14, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Supersedes #348, #350, #352. Close those as superseded once this lands.
Why they cannot merge individually
Two independent blockers, either sufficient on its own.
CodeQL refuses a split version. From the CI log on #348:
Loaded a configuration file for version '4.37.3', but running version '4.37.4'. Both CodeQL jobs fail on all three PRs. Whichever merged first would leavemain's security scanning broken.The atomic-pin guard fires.
test_ci_action_dependency_carrier_uses_exact_atomic_pinsasserts the three refs are identical and that each carries the literal version comment.On the guard, because the distinction matters
A previous dependency backlog in this repo retired two mutation guards silently by moving a value a hardcoded digest depended on. That is the same shape as this guard, so it was the first thing checked.
This time it did not go quiet. It failed loudly and caught a real defect.
So the constants are updated deliberately rather than the guard being softened into deriving the pin from the workflow. The equality-across-three-copies is the atomicity property that just proved its worth. Weakening it would delete the thing that worked.
Re-checked for vacuity after updating: reverting one of the three workflow pins turns it red, restoring turns it green.
Digest provenance
Dereferenced from upstream rather than taken from the PR. Both tags are annotated, so a single-hop read returns the tag object; both followed to the commit.
Known, not fixed here
Two latent instances of the same pattern: this test asserts the
actions/checkoutdigest 19 times, andtest_phase5_enterprise_handoff_truth.py:488embeds it inside a multi-line string literal, which is the harder one to spot. A futureactions/checkoutbump hits both. The repo already solved this correctly twice, intest_single_tenant_deployment.py:544andtest_least_privilege_deployment_workflow.py:257, which derive the pin from the workflow.Verification
4544 unit passed, 2 skipped. Do not merge on a green unit suite alone — the unit suite sees the digest mismatch but cannot see the split-version failure. Both
CodeQL (python)andCodeQL (javascript)must be green on this branch.