GeezerVison

The World Wide Web, restored to 800 pixels of glory.

GeezerVison is showing github.com — [release/v7.6.7] Bump github/codeql-action/upload-sarif from 4.36.0 to 4.38.2 by SeeminglyScience · Pull Request #28158 · PowerShell/PowerShell

Conversation

Patrick Meinecke (SeeminglyScience) commented Oct 7, 2026

Copy link

Copy Markdown

Contributor

Backport of #28126 to release/v7.6.7

Triggered by Patrick Meinecke (@SeeminglyScience) on behalf of @app/dependabot

Original CL Label: CL-BuildPackaging

/cc @PowerShell/powershell-maintainers

Impact

REQUIRED: Choose either Tooling Impact or Customer Impact (or both). At least one checkbox must be selected.

Tooling Impact

Required tooling change
Optional tooling change (include reasoning)

Updates the pinned github/codeql-action/upload-sarif reference used in the release branch's Scorecard workflow.

Customer Impact

Customer reported
Found internally

Regression

REQUIRED: Check exactly one box.

This is not a regression.

Testing

Cherry-pick completed without conflicts. This is a single action-pin update; no local tests were run. CI must pass on the backport PR before merge.

Risk

REQUIRED: Check exactly one box.

High
Medium
Low

This updates a release-branch security-scanning workflow and moves the CodeQL action pin from v3 to v4. The change must pass CI before merge.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions


          Bump github/codeql-action/upload-sarif from 4.36.0 to 4.38.2 (PowerSh…

72bcfa1

…ell#28126)

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Patrick Meinecke (SeeminglyScience) requested review from a team and Justin Chung (jshigetomi) as code owners

October 7, 2026 18:16

Copilot AI balanced review requested due to automatic review settings

October 7, 2026 18:16

Patrick Meinecke (SeeminglyScience) added the CL-BuildPackaging Indicates that a PR should be marked as a build or packaging change in the Change Log label

Oct 7, 2026

azure-pipelines Bot commented Oct 7, 2026

Copy link

Copy Markdown

Azure Pipelines: There may be pipelines that require an authorized user to comment /azp run to run.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

Copilot started reviewing on behalf of Patrick Meinecke (SeeminglyScience)

October 7, 2026 18:16

View session

Copilot AI reviewed

Oct 7, 2026

View reviewed changes

Copilot AI left a comment

Copy link

Copy Markdown

Contributor

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔵 Needs a closer look

Required CI validation remains unverified for this release-branch major-version upgrade.

1 open finding

Update dependency annotation to v4.38.2 · New

What changed in this PR

Backports #28126 to release/v7.6.7, updating the Scorecard workflow’s security-results uploader.

Changes:

Updates the immutable github/codeql-action/upload-sarif pin to v4.38.2.

File	Description
`.github/workflows/scorecards.yml`	Updates the action used to upload Scorecard SARIF results.

🧠 Review effort: Balanced

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

Comment thread

.github/workflows/scorecards.yml

		# Upload the results to GitHub's code scanning dashboard.
		- name: "Upload to code-scanning"
		uses: github/codeql-action/upload-sarif@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v3.29.5
		uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v3.29.5

Aditya Patwardhan (adityapatwardhan) approved these changes

Oct 7, 2026

View reviewed changes

Patrick Meinecke (SeeminglyScience) merged commit 7f7a17b into PowerShell:release/v7.6.7

Oct 7, 2026

36 checks passed

Uh oh!

There was an error while loading. Please reload this page.

Patrick Meinecke (SeeminglyScience) deleted the backport/release/v7.6.7/28126-3b5c0c354 branch

October 7, 2026 19:27

Reviewers

Copilot code review Copilot

Copilot review effort

Applies to this pull request for everyone.Learn more about Copilot code review.

Copilot left review comments

Aditya Patwardhan (adityapatwardhan)

adityapatwardhan approved these changes

Justin Chung (jshigetomi)

Awaiting requested review from jshigetomi

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

CL-BuildPackaging

Indicates that a PR should be marked as a build or packaging change in the Change Log

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

3 participants

Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.

You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.