GeezerVison

The World Wide Web, restored to 800 pixels of glory.

GeezerVison is showing github.com — [release/v7.6.10] Bump github/codeql-action/upload-sarif from 4.38.3 to 4.39.1 by daxian-dbw · Pull Request #28338 · PowerShell/PowerShell

Conversation

Dongbo Wang (daxian-dbw) commented Nov 4, 2026

Copy link

Copy Markdown

Member

Backport of #28265 to release/v7.6.10

Triggered by Dongbo Wang (@daxian-dbw) on behalf of @app/dependabot

Original CL Label: CL-BuildPackaging

/cc @PowerShell/powershell-maintainers

Impact

REQUIRED: Choose either Tooling Impact or Customer Impact (or both). At least one checkbox must be selected.

Tooling Impact

Required tooling change
Optional tooling change (include reasoning)

Updates the Scorecard workflow's github/codeql-action/upload-sarif pin from 4.38.3 to 4.39.1.

Customer Impact

Customer reported
Found internally

Regression

REQUIRED: Check exactly one box.

This is not a regression.

Testing

Reviewed the original one-line action-pin diff. Cherry-pick completed without conflicts; the resulting commit changes only .github/workflows/scorecards.yml and the worktree is clean. No local tests were run. Backport CI must pass before merge.

Risk

REQUIRED: Check exactly one box.

High
Medium
Low

Updates a CI dependency used to upload Scorecard SARIF results. The change is limited to the pinned action commit in scorecards.yml and does not change PowerShell runtime behavior.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions


          Bump github/codeql-action/upload-sarif from 4.38.3 to 4.39.1 (PowerSh…

a89831b

…ell#28265)

Dongbo Wang (daxian-dbw) requested review from a team and Justin Chung (jshigetomi) as code owners

November 4, 2026 19:40

Dongbo Wang (daxian-dbw) added the CL-BuildPackaging Indicates that a PR should be marked as a build or packaging change in the Change Log label

Nov 4, 2026

Copilot AI balanced review requested due to automatic review settings

November 4, 2026 19:40

azure-pipelines Bot commented Nov 4, 2026

Copy link

Copy Markdown

Azure Pipelines: There may be pipelines that require an authorized user to comment /azp run to run.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

Copilot started reviewing on behalf of Dongbo Wang (daxian-dbw)

November 4, 2026 19:40

View session

Dongbo Wang (daxian-dbw) merged commit 7b49043 into PowerShell:release/v7.6.10

Nov 4, 2026

18 checks passed

Uh oh!

There was an error while loading. Please reload this page.

Dongbo Wang (daxian-dbw) deleted the backport/release/v7.6.10/28265-54068d2fd branch

November 4, 2026 19:42

Copilot AI reviewed

Nov 4, 2026

View reviewed changes

Copilot AI left a comment

Copy link

Copy Markdown

Contributor

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Changes recommended

The pinned action’s inline annotation still says v3.29.5 instead of v4.39.1, which could mislead dependency reviews.

1 open issue

Update annotation to match v4.39.1 tag · New

What changed in this PR

Backports #28265 to release/v7.6.10, updating the action used to upload Scorecard results to GitHub code scanning. PowerShell runtime behavior is unchanged.

Changes:

Updates the github/codeql-action/upload-sarif commit pin to the verified v4.39.1 release.
Leaves the upload configuration unchanged.

File	Description
`.github/workflows/scorecards.yml`	Updates the pinned action for uploading Scorecard SARIF results.

_{Review effort: Balanced}

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

Comment thread

.github/workflows/scorecards.yml

		# Upload the results to GitHub's code scanning dashboard.
		- name: "Upload to code-scanning"
		uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d # v3.29.5
		uses: github/codeql-action/upload-sarif@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v3.29.5

Reviewers

Copilot code review Copilot

Copilot review effort

Applies to this pull request for everyone.Learn more about Copilot code review.

Copilot left review comments

Justin Chung (jshigetomi)

Awaiting requested review from jshigetomi

jshigetomi is a code owner

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

CL-BuildPackaging

Indicates that a PR should be marked as a build or packaging change in the Change Log

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

2 participants

Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.

You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.