GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — [release/v7.6.7] Bump CodeQL init and analyze actions to 4.38.2 by SeeminglyScience · Pull Request #28156 · PowerShell/PowerShell

Conversation

@SeeminglyScience

@SeeminglyScience Patrick Meinecke (SeeminglyScience) commented Oct 7, 2026

Copy link
Copy Markdown
Contributor

Backport of #28123 to release/v7.6.7

Triggered by Patrick Meinecke (@SeeminglyScience) on behalf of @app/dependabot

Original CL Label: CL-BuildPackaging

/cc @PowerShell/powershell-maintainers

Impact

REQUIRED: Choose either Tooling Impact or Customer Impact (or both). At least one checkbox must be selected.

Tooling Impact

  • Required tooling change
  • Optional tooling change (include reasoning)

Updates the GitHub CodeQL init and analyze workflow action pins used by release-branch static analysis.

Customer Impact

  • Customer reported
  • Found internally

Regression

REQUIRED: Check exactly one box.

  • Yes
  • No

This is not a regression.

Testing

Both CodeQL action references were updated to the original PR's v4.38.2 SHA. git diff --check passed. No local tests were run; CI must pass on the backport PR before merge.

Risk

REQUIRED: Check exactly one box.

  • High
  • Medium
  • Low

This changes CodeQL scanning actions used in the release branch and adapts action pins from v3 to v4. CI must validate the workflow before merge.

Merge Conflicts

Conflicts in .github/workflows/analyze-reusable.yml were resolved by updating both release-branch v3.29.5 action pins to the original PR's v4.38.2 SHA while preserving workflow structure.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@dependabot @SeeminglyScience
Bump CodeQL init and analyze actions to 4.38.2 (PowerShell#28123)
264f144 
Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: copilot-swe-agent[bot] <[email protected]>
Co-authored-by: SeeminglyScience <[email protected]>
Copilot AI balanced review requested due to automatic review settings October 7, 2026 18:10
@SeeminglyScience Patrick Meinecke (SeeminglyScience) added the CL-BuildPackaging Indicates that a PR should be marked as a build or packaging change in the Change Log label Oct 7, 2026
@SeeminglyScience
Patrick Meinecke (SeeminglyScience) requested review from a team and Justin Chung (jshigetomi) as code owners October 7, 2026 18:10
@azure-pipelines

azure-pipelines Bot commented Oct 7, 2026

Copy link
Copy Markdown
Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
Copilot started reviewing on behalf of Patrick Meinecke (SeeminglyScience) October 7, 2026 18:11
View session
Copilot AI reviewed Oct 7, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔵 Needs a closer look

The v3-to-v4 release-branch scanning upgrade still needs successful CI validation and final human review.

2 open findings
  • Low severity Restore release-version comment on action pin · New
  • Low severity Restore release-version comment on analysis action pin · New
What changed in this PR

Backports #28123 to update release/v7.6.7’s CodeQL static-analysis actions.

Changes:

  • Updates both init and analyze pins from v3.29.5 to the v4.38.2 SHA.
  • Preserves workflow structure but removes the version comments.
File Description
.github/​workflows/​analyze-reusable.yml Updates both CodeQL action pins.

🧠 Review effort: Balanced

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
Comment thread .github/workflows/analyze-reusable.yml
# Initializes the CodeQL tools for scanning.
- name: Initialize CodeQL
uses: github/codeql-action/init@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v3.29.5
uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2
Comment thread .github/workflows/analyze-reusable.yml Outdated

- name: Perform CodeQL Analysis
uses: github/codeql-action/analyze@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v3.29.5
uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2
adityapatwardhan
Aditya Patwardhan (adityapatwardhan) approved these changes Oct 7, 2026
View reviewed changes
@SeeminglyScience
Merge branch 'release/v7.6.7' into backport/release/v7.6.7/28123-6116…
abd969e 
…e1462
@SeeminglyScience Patrick Meinecke (SeeminglyScience) changed the title [release/v7.6.7] Bump CodeQL init and analyze actions to 4.38.2 WIP: [release/v7.6.7] Bump CodeQL init and analyze actions to 4.38.2 Oct 7, 2026
@SeeminglyScience Patrick Meinecke (SeeminglyScience) changed the title WIP: [release/v7.6.7] Bump CodeQL init and analyze actions to 4.38.2 [release/v7.6.7] Bump CodeQL init and analyze actions to 4.38.2 Oct 7, 2026
@SeeminglyScience
Patrick Meinecke (SeeminglyScience) enabled auto-merge (squash) October 7, 2026 20:50
@SeeminglyScience
Patrick Meinecke (SeeminglyScience) merged commit fd2c3bc into PowerShell:release/v7.6.7 Oct 7, 2026
37 checks passed

Uh oh!

There was an error while loading. Please reload this page.
@SeeminglyScience
Patrick Meinecke (SeeminglyScience) deleted the backport/release/v7.6.7/28123-6116e1462 branch October 7, 2026 20:51
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot
Copilot review effort
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments
@adityapatwardhan Aditya Patwardhan (adityapatwardhan) adityapatwardhan approved these changes
@jshigetomi Justin Chung (jshigetomi) Awaiting requested review from jshigetomi

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

CL-BuildPackaging Indicates that a PR should be marked as a build or packaging change in the Change Log

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

3 participants

@SeeminglyScience @adityapatwardhan
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402520 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.