Bump github/codeql-action/upload-sarif from 4.36.3 to 4.37.7 in the github-actions group across 1 directory by dependabot[bot] · Pull Request #620 · desrosj/wordpress-develop

dependabot · 2026-07-28T04:16:14Z

Bumps the github-actions group with 1 update in the / directory: github/codeql-action/upload-sarif.

Updates github/codeql-action/upload-sarif from 4.36.3 to 4.37.7

Release notes

Sourced from github/codeql-action/upload-sarif's releases.

v4.37.7

Update default CodeQL bundle version to 2.26.3. #4085

v4.37.6

Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

v4.37.5

Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

v4.37.4

This version of the CodeQL Action adds support for the tools input for the codeql-action/init step to be specified using a github-codeql-tools repository property. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to toolcache to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for tools in the workflow definition always takes precedence unless the value of the repository property starts with !. #4037

Update default CodeQL bundle version to 2.26.2. #4051

v4.37.3

No user facing changes.

v4.37.2

The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023

The CodeQL Action can now make use of configured private registries in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. #4007

v4.37.1

Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #3956

Update default CodeQL bundle version to 2.26.1. #4019

v4.37.0

Update default CodeQL bundle version to 2.26.0. #3995

In addition to the existing input format, the config-file input for the codeql-action/init step will soon support a new [owner/]repo[@ref][:path] format. All components except the repository name are optional. If omitted, owner defaults to the same owner as the repository the analysis is running for, ref to main, and path to .github/codeql-action.yaml. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. #3973

Changelog

Sourced from github/codeql-action/upload-sarif's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.37.8 - 21 Aug 2026

No user facing changes.

4.37.7 - 13 Aug 2026

Update default CodeQL bundle version to 2.26.3. #4085

4.37.6 - 04 Aug 2026

Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

4.37.5 - 03 Aug 2026

Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

4.37.4 - 29 Jul 2026

This version of the CodeQL Action adds support for the tools input for the codeql-action/init step to be specified using a github-codeql-tools repository property. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to toolcache to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for tools in the workflow definition always takes precedence unless the value of the repository property starts with !. #4037

Update default CodeQL bundle version to 2.26.2. #4051

4.37.3 - 22 Jul 2026

No user facing changes.

4.37.2 - 21 Jul 2026

The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023

The CodeQL Action can now make use of configured private registries in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. #4007

4.37.1 - 16 Jul 2026

Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #3956

Update default CodeQL bundle version to 2.26.1. #4019

4.37.0 - 08 Jul 2026

Update default CodeQL bundle version to 2.26.0. #3995

In addition to the existing input format, the config-file input for the codeql-action/init step will soon support a new [owner/]repo[@ref][:path] format. All components except the repository name are optional. If omitted, owner defaults to the same owner as the repository the analysis is running for, ref to main, and path to .github/codeql-action.yaml. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. #3973

4.36.3 - 01 Jul 2026

... (truncated)

Commits

ff2f1c6 Merge pull request #4093 from github/update-v4.37.7-be7a3dbb8
951a133 Update changelog for v4.37.7
be7a3db Merge pull request #4087 from github/dependabot/npm_and_yarn/npm-minor-0aa561...
9310334 Merge pull request #4086 from github/mbg/thread-action-state-to-codeql
b4d8a54 Rebuild
ab5db25 Bump the npm-minor group across 1 directory with 8 updates
38055a3 Drop logger from databaseInitCluster in interface
1f87aed Merge pull request #4085 from github/update-bundle/codeql-bundle-v2.26.3
dc1b98a Make logger available to getCodeQLForCmd
6f0220e Merge pull request #4084 from github/navntoft/bump-undici
Additional commits viewable in compare view

Update dependabot.yml file.

Captures the brainstormed design for a GitHub Actions workflow that opens draft PRs to update package.json gutenberg.sha for trunk (latest public release) and the most recent version branch (daily, from wp/X.Y head). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

…kflow. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

…decouple trunk job. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

…spatch for Gutenberg Sync. - Remove the dry_run input and all DRY_RUN handling. - Replace the auto-detecting setup job with a workflow-level CURRENTLY_SUPPORTED_BRANCH env var (mirrors test-old-branches.yml). - Replace the target choice input with a free-form branch input accepting "trunk" or an X.Y branch name; scheduled runs update trunk plus the currently supported branch, while a manual run targets one branch. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

…ch job. - Remove the schedule trigger; the workflow now runs only on workflow_dispatch. - Make the branch input required with a default of "trunk". - Merge the trunk and version-branch jobs into one "sync" job; trunk- and version-specific work is gated on inputs.branch, and the token, checkout, body-building, PR lookup, and PR create/update steps are shared. - Split steps to be atomic: resolve SHA, build PR body, look up the existing PR, and create/update the PR are now separate steps. - Drop the now-unused CURRENTLY_SUPPORTED_BRANCH env var. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

… env vars. Define BASE_BRANCH and HEAD_BRANCH as workflow-level environment variables derived from the branch input, and remove the explicit determine/validate step. An invalid branch now fails at the checkout step, which is sufficient. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

…upstream. WordPress/wordpress-develop does not accept pushed branches, so the workflow now runs from a fork: - Guard inverted to run only on forks (github.repository != upstream). - Check out the target branch from upstream so the PR is built on current content, push the gutenberg-sync/<branch> branch to the fork, and open the pull request from the fork branch back to upstream. - Drop the canonical-only GitHub App token (its private key cannot live on a fork). Push with the built-in GITHUB_TOKEN; open/label the upstream PR with an optional GUTENBERG_SYNC_TOKEN PAT. Without the PAT, the branch is still pushed and the run prints a link to open the PR manually. - Skip creating a duplicate when an open Gutenberg Sync PR already exists for the target branch from another fork. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

…he wp/X.Y existence check. - Replace the manual git clone of WordPress/gutenberg with an actions/checkout step (fetch-depth: 0 so the changelog's git log range has history), and read the new SHA from the checked-out head. - Remove the custom "wp/<branch> does not exist" guard; if the branch is missing, the Gutenberg checkout fails on its own, which is sufficient. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

…mplate. Move the PR body structure into .github/workflows/gutenberg-sync-pr-body.md with __BRANCH__, __NEW_SHA__, __SOURCE_LINE__, and __CHANGELOG__ placeholders. The resolve steps now only emit the scalar values and write the changelog content to a file; a single awk step renders the template (inserting the changelog file verbatim so untrusted release notes are never re-substituted). The template is sparse-checked-out from the workflow's own ref so it is always available and version-matched. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

…beling. - Render the PR body by writing each placeholder into a working copy of the template as its value is resolved (sed for scalars, awk to insert the changelog verbatim). This removes the SOURCE_LINE environment variable and the separate body-building step. - Stop applying the label in the sync workflow and identify an existing PR by the gutenberg-sync/<branch> head branch name instead of the label. - Add gutenberg-sync-label.yml: on pull_request_target (opened/reopened) it labels any gutenberg-sync/* PR using upstream's token, which (unlike the fork's token) can label PRs on upstream. It never checks out PR code, so the pull_request_target trigger is safe (zizmor ignore documented inline). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

… the template. - Move the body template to .github/template-gutenberg-sync-pr-body.md. - Break each resolve path into one action per step (copy template, fill each placeholder, retrieve release details / determine SHAs, build changelog). - Break the push into create-branch, update-file, stage, commit, add-remote, and push steps. - Split the pull request step into lookup, update-existing, and open-new. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

…n-branch jobs. Gate the branch selection at the job level (inputs.branch == 'trunk' vs != 'trunk') so the per-step branch conditionals are no longer needed. Each job runs end to end: checkout, resolve, push to the fork, and open/update the PR. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

…sable workflow. Add reusable-gutenberg-sync-pr.yml (workflow_call) that pushes the gutenberg-sync/<branch> branch to the fork and opens or updates the upstream pull request. The trunk and version-branch jobs now only resolve the new SHA, title, and body (uploaded as an artifact) and expose them as outputs; the open-pull-request job calls the reusable workflow with those values. This removes the push/PR steps that were duplicated across the two jobs. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

…ranch conditions. Remove the reusable-gutenberg-sync-pr.yml workflow and the resolve/publish job split, returning to one sync job whose trunk- and version-specific steps are gated with inputs.branch conditions. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

…y instead of opening a PR. The compare link cannot carry the generated body, so stop creating/updating the pull request (and drop the GUTENBERG_SYNC_TOKEN PAT). The workflow now pushes the branch to the fork and writes the PR title and body to the job summary, with the body in a fenced block for copy/paste into a manually opened pull request. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

The reorganized workflow split resolve, body-building, and push into separate jobs, but the data did not cross the job boundaries. Fix that: - Expose research's resolved values (new/old SHA, title, tag, release URL, proceed) as job outputs and consume them downstream via needs.research.outputs. - Gate build-pr-body and create-update-branch at the job level on the proceed output instead of the per-step env.PROCEED checks, which were empty in those jobs. - Pass the changelog between jobs as an artifact. - Reorder research so the changelog is built after the SHAs are determined. - Build the PR body template from the fork (sparse checkout) and fix the pr_body.md filename and the missing changelog insertion for version branches. - Correct the create-update-branch permission (contents: write) and scope the read-only jobs to contents: read. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

…a details block, and fix the SHA placeholder. - Add a list of changes (git log --reverse OLD..NEW, linkified) to every PR body, right after the intro line. Trunk now also checks out Gutenberg (at the release tag) so the list can be built, and the new SHA is read uniformly via git rev-parse. - For trunk, extract only the release's "## Changelog" section (which drops the heading and the First-time contributors/Contributors sections) and place it in a collapsed <details> labeled "Changelog"; remove the "## Changes" heading. - Pass the commit list and release changelog between jobs as artifacts. - Fix the __NEW_SHA__ replacement by giving the step its NEW_SHA env value. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

… sections. - Add a step to substitute the new __OLD_SHA__ placeholder. - Rename the first details summary to "Changes" (it holds the commit list and source link); the second remains "Changelog" for the release notes. - For version branches, remove the entire changelog <details> block rather than just the placeholder line, so the body has no empty collapsible. - Insert the release changelog directly now that the template supplies the <details> wrapper. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

…ping. - Update the pull request titles and job-summary headings. - Escape the backticks in the PR titles so the shell treats them as literal text instead of command substitution (which blanked the code references). - Restore the blank lines around __CHANGELOG__ in the template so the release changelog renders as Markdown inside the <details> block. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

…e branch input. - Run the single Gutenberg checkout for both trunk and version branches, after the release details are retrieved (so the trunk ref resolves to the release tag), and target wp/X.Y for version branches. - Make the branch input a choice so only allowed values can be dispatched. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Bumps the github-actions group with 1 update in the / directory: [github/codeql-action/upload-sarif](https://github.com/github/codeql-action). Updates `github/codeql-action/upload-sarif` from 4.36.3 to 4.37.7 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@54f647b...ff2f1c6) --- updated-dependencies: - dependency-name: github/codeql-action/upload-sarif dependency-version: 4.37.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Jul 28, 2026

desrosj force-pushed the trunk branch from bf53dd7 to 1d540aa Compare August 3, 2026 14:34

dependabot Bot changed the title ~~Bump github/codeql-action/upload-sarif from 4.36.3 to 4.37.2 in the github-actions group across 1 directory~~ Bump github/codeql-action/upload-sarif from 4.36.3 to 4.37.3 in the github-actions group across 1 directory Aug 4, 2026

dependabot Bot force-pushed the dependabot/github_actions/github-actions-730870378c branch from 9590d13 to 893bab6 Compare August 4, 2026 04:15

desrosj force-pushed the trunk branch from 1d540aa to 63e105c Compare August 5, 2026 13:19

dependabot Bot force-pushed the dependabot/github_actions/github-actions-730870378c branch from 893bab6 to 4c8ab55 Compare August 5, 2026 13:26

desrosj force-pushed the trunk branch from 63e105c to 8e2b080 Compare August 11, 2026 20:02

dependabot Bot changed the title ~~Bump github/codeql-action/upload-sarif from 4.36.3 to 4.37.3 in the github-actions group across 1 directory~~ Bump github/codeql-action/upload-sarif from 4.36.3 to 4.37.6 in the github-actions group across 1 directory Aug 12, 2026

dependabot Bot force-pushed the dependabot/github_actions/github-actions-730870378c branch from 4c8ab55 to 3d01ba0 Compare August 12, 2026 04:21

desrosj force-pushed the trunk branch from 8e2b080 to 3f1e733 Compare August 16, 2026 17:44

dependabot Bot force-pushed the dependabot/github_actions/github-actions-730870378c branch from 3d01ba0 to e13f314 Compare August 17, 2026 04:35

desrosj and others added 16 commits August 25, 2026 13:50

Reintroduce a Dependabot configuration file.

4241c4a

Add a workflow to create backport PRs.

44e4e73

Add workflow for testing backport PRs.

7756724

Exclude major versions from Dependabot PRs.

c9b64cc

Configure cooldown period in Dependabot.

1bfaef6

Update dependabot.yml file.

Build/Test Tools: Add Gutenberg Sync workflow skeleton and setup job.

df4b217

Build/Test Tools: Harden Gutenberg Sync setup job branch detection.

48549a5

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Build/Test Tools: Add trunk update job to Gutenberg Sync workflow.

ed54afc

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Build/Test Tools: Add strict mode to trunk SHA resolution step.

27d51a3

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Build/Test Tools: Add version branch update job to Gutenberg Sync wor…

edd7fa7

…kflow. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Docs: Add implementation plan for Gutenberg SHA sync workflow.

030decb

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Build/Test Tools: Harden Gutenberg Sync version branch changelog and …

6644beb

…decouple trunk job. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

desrosj and others added 18 commits August 25, 2026 13:50

Reorganize logic into separate jobs.

9a86bc5

Reorganize further.

1dab325

Build/Test Tools: Quote the Gutenberg Sync branch input values.

8adb588

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Update PR template.

8bc359a

desrosj force-pushed the trunk branch from 3f1e733 to 8bc359a Compare August 25, 2026 17:51

dependabot Bot changed the title ~~Bump github/codeql-action/upload-sarif from 4.36.3 to 4.37.6 in the github-actions group across 1 directory~~ Bump github/codeql-action/upload-sarif from 4.36.3 to 4.37.7 in the github-actions group across 1 directory Aug 26, 2026

dependabot Bot force-pushed the dependabot/github_actions/github-actions-730870378c branch from e13f314 to 4160a35 Compare August 26, 2026 04:20

desrosj force-pushed the trunk branch from 8bc359a to 5d7de36 Compare August 28, 2026 12:51

Navigation Menu

Bump github/codeql-action/upload-sarif from 4.36.3 to 4.37.7 in the github-actions group across 1 directory - #620

Bump github/codeql-action/upload-sarif from 4.36.3 to 4.37.7 in the github-actions group across 1 directory#620
dependabot[bot] wants to merge 35 commits into
trunkfrom
dependabot/github_actions/github-actions-730870378c

dependabot Bot commented on behalf of github Jul 28, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Jul 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v4.37.7

v4.37.6

v4.37.5

v4.37.4

v4.37.3

v4.37.2

v4.37.1

v4.37.0

CodeQL Action Changelog

[UNRELEASED]

4.37.8 - 21 Aug 2026

4.37.7 - 13 Aug 2026

4.37.6 - 04 Aug 2026

4.37.5 - 03 Aug 2026

4.37.4 - 29 Jul 2026

4.37.3 - 22 Jul 2026

4.37.2 - 21 Jul 2026

4.37.1 - 16 Jul 2026

4.37.0 - 08 Jul 2026

4.36.3 - 01 Jul 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

dependabot Bot commented on behalf of github Jul 28, 2026 •

edited

Loading