[ANAMASGARD]

Summary

Fixes #86.

Replace the retired CodeQL v2 SARIF uploader with an immutable v4.39.1 release pin in both scan workflows and all README examples.

Changes

Update all nine references across three files:

• .github/workflows/example-scan.yaml: one reference.
• .github/workflows/example-scan-image.yaml: one reference.
• README.md: seven references.

Pin the uploader to:

github/codeql-action/upload-sarif@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 — v4.39.1.

Existing workflow permissions, triggers, scanner inputs, thresholds, error handling, and report paths remain unchanged.

Motivation

CodeQL Action v2 is retired and no longer receives support or updates. Updating the workflows and documentation prevents users from inheriting this retired dependency when copying the examples.

Validation

• Verified the release tag resolves to the pinned commit.
• Verified action metadata and the sarif_file input.
• Confirmed all nine replacements are revision-only changes.
• Parsed 12 workflow/documentation YAML documents.
• Passed 41 repository test assertions.
• Exercised the actual pinned uploader’s local schema validation, fingerprinting, compression, and test-mode payload pipeline, including an invalid-SARIF negative control.
• Passed whitespace checks; workflow lint introduced no new diagnostics.

The local uploader tests block outbound HTTP and do not establish GitHub server acceptance.

Related report-access issue

This PR does not fix the report-ownership problem tracked in #85.

The hosted configuration and image runs executed the new v4 uploader but failed with EACCES when reading reports generated by upstream kubescape/github-action@main:

• Configuration run
• Image run

The CodeQL retirement annotation was not the demonstrated fatal cause of the earlier upload failures. Report access must be corrected separately, followed by hosted validation with both improvements in place.

Compatibility

CodeQL v4 uses Node 24. Users adapting these examples to self-hosted runners must ensure their runner supports that runtime.

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 58 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: b7442349-c970-49f0-ada9-c4806690b3a3

📥 Commits

Reviewing files that changed from the base of the PR and between 6a52718 and cfb6335.

📒 Files selected for processing: 3

• .github/workflows/example-scan-image.yaml
• .github/workflows/example-scan.yaml
• README.md

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[matthyx]

Approve: no blocking defects found in cfb633522edc0beb2aa7fe65aacf76c51ff70374, reviewed against main at 6a527186fc87c668469fe8b9333b251ffc4eaed8.

This is needed dependency maintenance for #86: the target still contains nine retired v2 uploader references. All nine substitutions are exact and the annotated upstream v4.39.1 tag resolves to the pinned commit. The existing sarif_file, token defaults and permissions remain compatible; workflow behavior is otherwise unchanged. GitHub's retirement notice establishes the need, independently of upload failures.

History: searched repository PRs/issues across states using codeql, upload-sarif, SARIF and example-scan, plus the 65-PR/23-issue inventory (100-item caps, no cap reached). No superseding uploader update was found within that scope; search indexing and unmentioned changes remain limits. #87/#85 address report access separately; merged #84 fixes SARIF paths. Merged #18/#22 establish the upload integration; merged #76 establishes SHA-pinning precedent. Its author's preference for tags in README is not a maintainer prohibition. Closed #74 was superseded by main-branch fixes per maintainer discussion, not rejection of dependency updates. The #20 revert concerned a broken entrypoint executable bit, which this change does not touch. No applicable prior rejection found.

Validation: independently compared base/head contents (nine revision-only replacements), parsed all 12 YAML documents, checked added-line whitespace, and verified upstream tag/action metadata. Independent code review found no defects; architecture review found only an optional portability note. Actionlint diagnostics were unchanged between base/head. Existing entrypoint CI passed. No repository scripts or uploader code were executed locally, and the author's 41 assertions/test-mode uploader results were not rerun.

The failed configuration, image and autofix logs show report-read EACCES failures matching #85; both scan jobs reach v4.39.1. This PR does not fix those failures or establish successful server acceptance. Combined hosted validation remains outstanding, not a regression introduced by this revision update.

Nonblocking: consider documenting Node 24 / runner >=2.327.1 and GHES compatibility near the first README example. All supplied complete examples use ubuntu-latest; old adapted enterprise runners are the compatibility exposure.

Immediately before submission, the PR remained open, non-draft and mergeable with unchanged head/base and no substantive existing reviews or inline comments. Verdict: approve for the scoped uploader update; hosted upload success is still unverified.