GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — [release/v7.7.0] Bump github/codeql-action/upload-sarif from 4.38.3 to 4.39.1 by jshigetomi · Pull Request #28359 · PowerShell/PowerShell

Conversation

@jshigetomi

@jshigetomi Justin Chung (jshigetomi) commented Nov 5, 2026 •
edited
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Collaborator

Backport of #28265 to release/v7.7.0

Triggered by Justin Chung (@jshigetomi) on behalf of @app/dependabot

Original CL Label: CL-BuildPackaging

/cc @PowerShell/powershell-maintainers

Impact

Tooling Impact

  • Required tooling change
  • Optional tooling change (include reasoning)

Updates the Scorecard workflow's github/codeql-action/upload-sarif pin from 4.38.3 to 4.39.1.

Customer Impact

  • Customer reported
  • Found internally

Regression

  • Yes
  • No

This is not a regression.

Testing

Reviewed the original one-line action-pin diff. Cherry-pick completed without conflicts; the resulting commit changes only .github/workflows/scorecards.yml. No local tests were run. Backport CI must pass before merge.

Risk

  • High
  • Medium
  • Low

Updates a CI dependency used to upload Scorecard SARIF results. The change is limited to the pinned action commit in scorecards.yml and does not change PowerShell runtime behavior.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@dependabot Justin Chung
Bump github/codeql-action/upload-sarif from 4.38.3 to 4.39.1 (#28265)
ab5364b
@jshigetomi
Justin Chung (jshigetomi) requested a review from a team as a code owner November 5, 2026 19:20
Copilot AI balanced review requested due to automatic review settings November 5, 2026 19:20
@azure-pipelines

azure-pipelines Bot commented Nov 5, 2026

Copy link
Copy Markdown
Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@jshigetomi Justin Chung (jshigetomi) changed the title 'x' updated Nov 5, 2026
@jshigetomi Justin Chung (jshigetomi) changed the title updated $([uri]::UnescapeDataString('%5Brelease%2Fv7.7.0%5D%20Bump%20github%2Fcodeql-action%2Fupload-sarif%20from%204.38.3%20to%204.39.1')) Nov 5, 2026
@jshigetomi Justin Chung (jshigetomi) changed the title $([uri]::UnescapeDataString('%5Brelease%2Fv7.7.0%5D%20Bump%20github%2Fcodeql-action%2Fupload-sarif%20from%204.38.3%20to%204.39.1')) %5Brelease%2Fv7.7.0%5D%20Bump%20github%2Fcodeql-action%2Fupload-sarif%20from%204.38.3%20to%204.39.1 Nov 5, 2026
Copilot started reviewing on behalf of Justin Chung (jshigetomi) November 5, 2026 19:21
View session
@jshigetomi Justin Chung (jshigetomi) changed the title %5Brelease%2Fv7.7.0%5D%20Bump%20github%2Fcodeql-action%2Fupload-sarif%20from%204.38.3%20to%204.39.1 [release/v7.7.0] Bump github/codeql-action/upload-sarif from 4.38.3 to 4.39.1 Nov 5, 2026
@jshigetomi Justin Chung (jshigetomi) added the CL-BuildPackaging Indicates that a PR should be marked as a build or packaging change in the Change Log label Nov 5, 2026
Copilot AI reviewed Nov 5, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Changes recommended

The action’s pinned SHA resolves to v4.39.1, but its inline annotation still says v3.29.5, misleading maintainers about the dependency version.

1 open issue
  • Low severity Update annotation to match pinned action version · New
What changed in this PR

Backports #28265 to release/v7.7.0, updating the action used to upload Scorecard results to GitHub code scanning without changing PowerShell runtime behavior.

Changes:

  • Updates the github/codeql-action/upload-sarif commit pin from v4.38.3 to v4.39.1.
  • Leaves workflow inputs and execution steps unchanged.
File Description
.github/​workflows/​scorecards.yml Updates the pinned SARIF upload action.

Review effort: Balanced

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
Comment thread .github/workflows/scorecards.yml
# Upload the results to GitHub's code scanning dashboard.
- name: "Upload to code-scanning"
uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d # v3.29.5
uses: github/codeql-action/upload-sarif@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v3.29.5
@jshigetomi
Justin Chung (jshigetomi) enabled auto-merge (squash) November 5, 2026 19:59
daxian-dbw
Dongbo Wang (daxian-dbw) approved these changes Nov 5, 2026
View reviewed changes

@daxian-dbw Dongbo Wang (daxian-dbw) left a comment

Copy link
Copy Markdown
Member

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot CLI reviewed this backport and confirmed that its changes match the original PR, #28265, as merged into master.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@jshigetomi
Justin Chung (jshigetomi) merged commit a41d0cc into release/v7.7.0 Nov 5, 2026
36 of 42 checks passed

Uh oh!

There was an error while loading. Please reload this page.
@daxian-dbw
Dongbo Wang (daxian-dbw) deleted the backport/release/v7.7.0/28265-54068d2fd branch November 5, 2026 23:09
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot
Copilot review effort
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments
@daxian-dbw Dongbo Wang (daxian-dbw) daxian-dbw approved these changes

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

CL-BuildPackaging Indicates that a PR should be marked as a build or packaging change in the Change Log

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

3 participants

@jshigetomi @daxian-dbw
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.