From cfb633522edc0beb2aa7fe65aacf76c51ff70374 Mon Sep 17 00:00:00 2001 From: Gaurav Chaudhary Date: Fri, 23 Oct 2026 11:55:37 +0530 Subject: [PATCH] ci: update SARIF uploader to CodeQL v4 Pin the supported v4.39.1 uploader in both scan workflows and all README examples. Preserve existing permissions, scan inputs, triggers and report paths. Signed-off-by: Gaurav Chaudhary --- .github/workflows/example-scan-image.yaml | 2 +- .github/workflows/example-scan.yaml | 2 +- README.md | 14 +++++++------- 3 files changed, 9 insertions(+), 9 deletions(-) diff --git a/.github/workflows/example-scan-image.yaml b/.github/workflows/example-scan-image.yaml index ada24d4..09d8935 100644 --- a/.github/workflows/example-scan-image.yaml +++ b/.github/workflows/example-scan-image.yaml @@ -27,6 +27,6 @@ jobs: # accessKey: ${{secrets.KUBESCAPE_ACCESS_KEY}} # server: ${{ vars.KUBESCAPE_SERVER }} - name: Upload Kubescape scan results to Github Code Scanning - uses: github/codeql-action/upload-sarif@v2 + uses: github/codeql-action/upload-sarif@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1 with: sarif_file: results.sarif diff --git a/.github/workflows/example-scan.yaml b/.github/workflows/example-scan.yaml index 6ab2fdf..0e56903 100644 --- a/.github/workflows/example-scan.yaml +++ b/.github/workflows/example-scan.yaml @@ -21,6 +21,6 @@ jobs: # # Optional - Scan a specific path. Default will scan all # files: "examples/*.yaml" - name: Upload Kubescape scan results to Github Code Scanning - uses: github/codeql-action/upload-sarif@v2 + uses: github/codeql-action/upload-sarif@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1 with: sarif_file: results.sarif diff --git a/README.md b/README.md index 1cca413..b91ec33 100644 --- a/README.md +++ b/README.md @@ -32,7 +32,7 @@ jobs: # # Optional: Scan a specific path. Default will scan the whole repository # files: "examples/*.yaml" - name: Upload Kubescape scan results to Github Code Scanning - uses: github/codeql-action/upload-sarif@v2 + uses: github/codeql-action/upload-sarif@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1 with: sarif_file: results.sarif ``` @@ -193,7 +193,7 @@ jobs: # accessKey: ${{secrets.KUBESCAPE_ACCESS_KEY}} # server: ${{ vars.KUBESCAPE_SERVER }} - name: Upload Kubescape scan results to Github Code Scanning - uses: github/codeql-action/upload-sarif@v2 + uses: github/codeql-action/upload-sarif@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1 with: sarif_file: results.sarif ``` @@ -275,7 +275,7 @@ jobs: accessKey: ${{secrets.KUBESCAPE_ACCESS_KEY}} server: ${{ vars.KUBESCAPE_SERVER }} - name: Upload Kubescape scan results to Github Code Scanning - uses: github/codeql-action/upload-sarif@v2 + uses: github/codeql-action/upload-sarif@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1 with: sarif_file: results.sarif ``` @@ -304,7 +304,7 @@ jobs: # Scan a specific path. Default will scan the whole repository files: "examples/kubernetes-manifests/*.yaml" - name: Upload Kubescape scan results to Github Code Scanning - uses: github/codeql-action/upload-sarif@v2 + uses: github/codeql-action/upload-sarif@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1 with: sarif_file: results.sarif ``` @@ -333,7 +333,7 @@ jobs: frameworks: | nsa,mitre - name: Upload Kubescape scan results to Github Code Scanning - uses: github/codeql-action/upload-sarif@v2 + uses: github/codeql-action/upload-sarif@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1 with: sarif_file: results.sarif ``` @@ -361,7 +361,7 @@ jobs: outputFile: results failedThreshold: 50 - name: Upload Kubescape scan results to Github Code Scanning - uses: github/codeql-action/upload-sarif@v2 + uses: github/codeql-action/upload-sarif@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1 with: sarif_file: results.sarif ``` @@ -388,7 +388,7 @@ jobs: outputFile: results severityThreshold: medium - name: Upload Kubescape scan results to Github Code Scanning - uses: github/codeql-action/upload-sarif@v2 + uses: github/codeql-action/upload-sarif@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1 with: sarif_file: results.sarif ```