From 44da3c6ef8cd136f1a7cfaff39597004008851c2 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 15 Sep 2026 20:40:44 +0000 Subject: [PATCH 1/7] build(deps): bump github/codeql-action/upload-sarif Bumps [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) from 4.37.0 to 4.38.0. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/99df26d4f13ea111d4ec1a7dddef6063f76b97e9...b96794f015dfd88f77b49b1c93e0fa7110f94c63) --- updated-dependencies: - dependency-name: github/codeql-action/upload-sarif dependency-version: 4.38.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] --- .github/workflows/ossf-scorecard.yml | 2 +- .github/workflows/security-audit.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ossf-scorecard.yml b/.github/workflows/ossf-scorecard.yml index 8f5b1bc25..1eef909d5 100644 --- a/.github/workflows/ossf-scorecard.yml +++ b/.github/workflows/ossf-scorecard.yml @@ -83,6 +83,6 @@ jobs: python3 trusted-scorecard-scripts/scripts/checks/normalize_scorecard_sarif.py scorecard-sarif/results.sarif normalized-scorecard-results.sarif - - uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0 peeled commit; SHA pinning retained as supply-chain attack mitigation. + - uses: github/codeql-action/upload-sarif@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.37.0 peeled commit; SHA pinning retained as supply-chain attack mitigation. with: sarif_file: normalized-scorecard-results.sarif diff --git a/.github/workflows/security-audit.yml b/.github/workflows/security-audit.yml index 07754a782..dd2547fe7 100644 --- a/.github/workflows/security-audit.yml +++ b/.github/workflows/security-audit.yml @@ -92,6 +92,6 @@ jobs: trivyignores: ./.trivyignore - name: Upload Trivy scan results to GitHub Security tab if: always() - uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0 + uses: github/codeql-action/upload-sarif@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0 with: sarif_file: trivy-results.sarif From 26d303c106a405a84001abb0e283c66c48835bd4 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 16 Sep 2026 17:03:12 +0900 Subject: [PATCH 2/7] test(ci): reject stale upload-sarif version annotations --- .../test_workflow_action_annotation_policy.py | 47 +++++++++++++++++++ 1 file changed, 47 insertions(+) create mode 100644 services/analysis-engine/tests/test_workflow_action_annotation_policy.py diff --git a/services/analysis-engine/tests/test_workflow_action_annotation_policy.py b/services/analysis-engine/tests/test_workflow_action_annotation_policy.py new file mode 100644 index 000000000..63b2a47fd --- /dev/null +++ b/services/analysis-engine/tests/test_workflow_action_annotation_policy.py @@ -0,0 +1,47 @@ +"""Regression tests for human-readable GitHub Action pin annotations.""" + +from __future__ import annotations + +import re +from pathlib import Path + + +UPLOAD_SARIF_REFERENCE_RE = re.compile( + r"^\s*-\s+uses:\s+github/codeql-action/upload-sarif@" + r"(?P[0-9a-fA-F]{40})\s+#\s+v(?P\d+\.\d+\.\d+)(?:\s|$)" +) + + +def test_upload_sarif_sha_annotations_are_complete_and_consistent() -> None: + """Keep upload-sarif SHA pins and their review annotations in one identity.""" + repo_root = Path(__file__).resolve().parents[3] + workflow_dir = repo_root / ".github" / "workflows" + references: list[tuple[str, str, str]] = [] + incomplete: list[str] = [] + + for workflow_path in sorted(workflow_dir.glob("*.yml")): + for line_number, line in enumerate( + workflow_path.read_text(encoding="utf-8").splitlines(), start=1 + ): + if "github/codeql-action/upload-sarif@" not in line or line.lstrip().startswith("#"): + continue + match = UPLOAD_SARIF_REFERENCE_RE.match(line) + location = f"{workflow_path.relative_to(repo_root)}:{line_number}" + if match is None: + incomplete.append(location) + continue + references.append((match.group("sha").lower(), match.group("version"), location)) + + assert not incomplete, ( + "upload-sarif pins must carry an adjacent semantic-version annotation: " + + ", ".join(incomplete) + ) + assert references, "repository workflows must contain a reviewed upload-sarif pin" + + identities = {(sha, version) for sha, version, _ in references} + assert len(identities) == 1, ( + "upload-sarif workflows disagree on the reviewed SHA/version identity: " + + ", ".join( + f"{location}={sha}@v{version}" for sha, version, location in references + ) + ) From 353ed079212fbc019df9886452d4cea90e455cc0 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 16 Sep 2026 17:03:39 +0900 Subject: [PATCH 3/7] fix(ci): align upload-sarif pin annotation with v4.38.0 --- .github/workflows/ossf-scorecard.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ossf-scorecard.yml b/.github/workflows/ossf-scorecard.yml index 1eef909d5..b68ffd2b3 100644 --- a/.github/workflows/ossf-scorecard.yml +++ b/.github/workflows/ossf-scorecard.yml @@ -83,6 +83,6 @@ jobs: python3 trusted-scorecard-scripts/scripts/checks/normalize_scorecard_sarif.py scorecard-sarif/results.sarif normalized-scorecard-results.sarif - - uses: github/codeql-action/upload-sarif@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.37.0 peeled commit; SHA pinning retained as supply-chain attack mitigation. + - uses: github/codeql-action/upload-sarif@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0 peeled commit; SHA pinning retained as supply-chain attack mitigation. with: sarif_file: normalized-scorecard-results.sarif From 13ddc9cad0cb4687aa03c12f1c4615df78129c64 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 16 Sep 2026 17:04:30 +0900 Subject: [PATCH 4/7] style(ci): format upload-sarif annotation regression --- .../tests/test_workflow_action_annotation_policy.py | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/services/analysis-engine/tests/test_workflow_action_annotation_policy.py b/services/analysis-engine/tests/test_workflow_action_annotation_policy.py index 63b2a47fd..12f47c033 100644 --- a/services/analysis-engine/tests/test_workflow_action_annotation_policy.py +++ b/services/analysis-engine/tests/test_workflow_action_annotation_policy.py @@ -23,14 +23,19 @@ def test_upload_sarif_sha_annotations_are_complete_and_consistent() -> None: for line_number, line in enumerate( workflow_path.read_text(encoding="utf-8").splitlines(), start=1 ): - if "github/codeql-action/upload-sarif@" not in line or line.lstrip().startswith("#"): + if ( + "github/codeql-action/upload-sarif@" not in line + or line.lstrip().startswith("#") + ): continue match = UPLOAD_SARIF_REFERENCE_RE.match(line) location = f"{workflow_path.relative_to(repo_root)}:{line_number}" if match is None: incomplete.append(location) continue - references.append((match.group("sha").lower(), match.group("version"), location)) + references.append( + (match.group("sha").lower(), match.group("version"), location) + ) assert not incomplete, ( "upload-sarif pins must carry an adjacent semantic-version annotation: " From 9df8e042948a9a2909283caece2d8c877cbff085 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 16 Sep 2026 17:07:05 +0900 Subject: [PATCH 5/7] test(ci): cover yaml workflow pin annotations --- .../tests/test_workflow_action_annotation_policy.py | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/services/analysis-engine/tests/test_workflow_action_annotation_policy.py b/services/analysis-engine/tests/test_workflow_action_annotation_policy.py index 12f47c033..e951811df 100644 --- a/services/analysis-engine/tests/test_workflow_action_annotation_policy.py +++ b/services/analysis-engine/tests/test_workflow_action_annotation_policy.py @@ -16,10 +16,13 @@ def test_upload_sarif_sha_annotations_are_complete_and_consistent() -> None: """Keep upload-sarif SHA pins and their review annotations in one identity.""" repo_root = Path(__file__).resolve().parents[3] workflow_dir = repo_root / ".github" / "workflows" + workflow_paths = sorted( + set(workflow_dir.glob("*.yml")) | set(workflow_dir.glob("*.yaml")) + ) references: list[tuple[str, str, str]] = [] incomplete: list[str] = [] - for workflow_path in sorted(workflow_dir.glob("*.yml")): + for workflow_path in workflow_paths: for line_number, line in enumerate( workflow_path.read_text(encoding="utf-8").splitlines(), start=1 ): From 1f4c500e11f821f640cb3ed4f80f737d1091c861 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 16 Sep 2026 18:07:47 +0900 Subject: [PATCH 6/7] fix(dependabot): remove missing github-actions label --- .github/dependabot.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 2df162d89..ed4826406 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -38,4 +38,3 @@ updates: open-pull-requests-limit: 10 labels: - "dependencies" - - "github-actions" From 46afa8cbba955c758ecd3e80010a4e9d91a5e07d Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 17 Sep 2026 07:10:01 +0900 Subject: [PATCH 7/7] fix(ci): satisfy Ruff import organization for action pin policy --- .../tests/test_workflow_action_annotation_policy.py | 2 -- 1 file changed, 2 deletions(-) diff --git a/services/analysis-engine/tests/test_workflow_action_annotation_policy.py b/services/analysis-engine/tests/test_workflow_action_annotation_policy.py index e951811df..a3064cfaf 100644 --- a/services/analysis-engine/tests/test_workflow_action_annotation_policy.py +++ b/services/analysis-engine/tests/test_workflow_action_annotation_policy.py @@ -1,7 +1,5 @@ """Regression tests for human-readable GitHub Action pin annotations.""" -from __future__ import annotations - import re from pathlib import Path