chore(ci): refresh mature CodeQL, CodSpeed and TruffleHog action pins
Merged
UN
4d ago+69+69+01234567890123456789-14-14-01234567890123456789
Summary
Adopts the five github-actions updates that Dependabot proposed in #1651. Each upstream release has now cleared the seven-day age floor. The PR also triages the two other reports that arrived during the 2026.11.2 cycle.
| Action | From | To | Released |
|---|---|---|---|
| github/codeql-action (init, analyze, upload-sarif) | v4.39.0 | v4.39.1 (9b3254085494) | 2026-10-21 |
| CodSpeedHQ/action | v5.5.0 | v5.6.0 (78102a468f96) | 2026-10-22 |
| trufflesecurity/trufflehog | v3.99.3 | v3.99.7 (31ce31ee1abb), version input 3.99.7 | 2026-10-24 |
- Each SHA was checked against the commit its release tag dereferences to.
tests/integration/ci-workflow-contract.spec.tspins the exact CodSpeed and TruffleHog SHAs and the TruffleHog version input, and moves with them. This is why Dependabot's own branch failed coverage shard 1/4.
Tracker
- pm-ey1zh7 (child of pm-ogzvx6) owns this refresh.
- #1652 → pm-jd2zim: pm-jd2zim gains an acceptance criterion. When the post-open check refuses after a late lock-directory swap, the lock file the open created must be removed only through the bound directory and only while it is still the opened inode. Then no empty lock file stays outside the tracker, and pm never unlinks a file it did not create. This is the refusal-side half of the post-create seam that pm-jd2zim already owns, so no separate item is filed.
- #1650 → pm-t3jxjj: closed, as #1403, #1448, #1503 and #1600 were.
@sentry/node11.9.0 still fails the build with TS2353 (enableLogsis not inNodeOptions) and keeps the dependency footprint that exceeds the runtime bundle budget.
Verification
tests/integration/ci-workflow-contract.spec.ts: 24 passed.check-dependency-cooldown,check-workflow-permissionsandactionlintpass on the changed workflows.- The
graph-composition,tracker-context-qualityandrecord-integrityassurance runs pass. pnpm security:scan: clean.
Summary by Sourcery
Refresh mature GitHub Actions pins and align workflow validation, changelog, and project tracking records with the updated releases.
Enhancements:
- Refresh pinned GitHub Actions dependencies to mature CodeQL 4.39.1, CodSpeed 5.6.0, and TruffleHog 3.99.7 releases.
- Update workflow contract coverage and project tracking records for the refreshed action pins and related issue triage.
CI:
- Update CodeQL, CodSpeed, and TruffleHog workflow pins and TruffleHog's version constraint to the latest verified releases.
Documentation:
- Document the GitHub Actions pin refresh in the changelog.
Tests:
- Update CI workflow contract expectations for the new CodSpeed and TruffleHog revisions.
Chores:
- Record the dependency refresh and associated tracker updates.
Summary by cubic
Refreshes the pinned CodeQL, CodSpeed, and TruffleHog GitHub Actions to the versions Dependabot proposed in #1651 now that each release has cleared the seven-day age floor, and updates the workflow contract spec that pins the CodSpeed and TruffleHog SHAs.
Tracker updates
pm-ey1zh7closes with the refresh; the spec's CodeQL checks accept any 40-character SHA and do not readscorecard.yml, so the CodeQL refresh rests on the tag-to-SHA check and actionlint.pm-jd2zimgains the GH-1652 refusal-side criterion: after a late lock-directory swap, the refused post-open check leaves the created entry in place and reports its residue path and opened dev/ino, because Node has no race-free conditional unlink.pm-t3jxjjcloses Dependabot #1650 (@sentry/node11.9.0) for the same TS2353enableLogsbuild failure and unchanged runtime-bundle footprint.