Skip to content

fix(sdk): fail step when result has is_error:true despite success subtype - #1496

Merged
ashwin-ant merged 1 commit into
anthropics:mainfrom
syf2211:fix/1495-fail-on-is-error
Jul 13, 2026
Merged

fix(sdk): fail step when result has is_error:true despite success subtype#1496
ashwin-ant merged 1 commit into
anthropics:mainfrom
syf2211:fix/1495-fail-on-is-error

Conversation

@syf2211

@syf2211 syf2211 commented Jul 11, 2026

Copy link
Copy Markdown
Contributor

Summary

When the Claude Agent SDK returns a result with subtype: "success" but is_error: true, the action now treats the run as a failure instead of reporting a green check.

Motivation

Fixes #1495. Some workflow runs (notably pull_request code-review flows) can emit:

{ "type": "result", "subtype": "success", "is_error": true, ... }

Previously, success was inferred only from subtype, so the step concluded successfully even though no review actually ran. That produced a misleading green CI gate.

Changes

  • base-action/src/run-claude-sdk.ts: require !is_error in addition to subtype === "success" when computing isSuccess
  • Add targeted logging and error text for the anomalous success + is_error: true case without changing messages for standard error_* subtypes
  • base-action/test/run-claude-sdk.test.ts: regression test for the reported failure mode

Tests

  • bun test ./base-action/test/run-claude-sdk.test.ts — pass (2/2)
  • bun test — pass (770/770)
  • bun run typecheck — pass

Notes

  • This is an intentional behavior change: workflows that previously got a green check on success + is_error: true will now fail, which matches the expected CI semantics described in the issue.
  • The existing conclusion output is set to "failure" via the catch path when the step fails.

Fixes #1495

@syf2211
fix(sdk): fail step when result has is_error:true despite success sub…
235b2ea 
…type

Treat subtype success with is_error:true as a failed run so CI does not
show a misleading green check when the review never actually ran.

Fixes anthropics#1495
@ashwin-ant
ashwin-ant merged commit 972a512 into anthropics:main Jul 13, 2026
7 of 36 checks passed
@maksmarcinkiewicz maksmarcinkiewicz mentioned this pull request Jul 14, 2026
Open
@5edges-engineering 5edges-engineering mentioned this pull request Jul 15, 2026
Open
This was referenced Jul 15, 2026
Open
Closed
Merged
ktinubu added a commit to tinaudio/synth-setter that referenced this pull request Jul 15, 2026
@ktinubu
ci: replace stock Claude code-review workflow with repo-review-full (#…
7443b55 
…1943)

* ci: drop stock Claude code-review workflow in favor of repo-review-full

The stock code-review plugin workflow fully overlaps with
claude-repo-review-full.yml, which runs the repo-owned /repo-review-full
pipeline on the same pull_request triggers and has caught more.

Also bump the anthropics/claude-code-action pin from e90deca to current
v1 (1253134) so runs whose Claude result carries is_error:true fail the
job (anthropics/claude-code-action#1496) instead of passing green with
no review posted, and repoint the workflow's doc-map/reference/rotation
doc rows at the surviving workflow.

Refs #1938

* docs: fix stale concurrency-gotcha row for the deleted review workflow

The Known gotchas / Concurrency section still named claude-code-review
and its claude-review-<PR#> group; repoint it at claude-repo-review-full
and its actual group key.

Refs #1938

* ci: bump claude-code-action pin in claude.yml to match

Same e90deca -> 1253134 (v1) bump as claude-repo-review-full.yml, so
@claude mention runs also fail loudly on is_error:true results instead
of passing green.

Refs #1938
@kyle-sexton kyle-sexton mentioned this pull request Jul 16, 2026
Merged
kyle-sexton added a commit to melodic-software/ci-workflows that referenced this pull request Jul 16, 2026
@kyle-sexton @claude
fix(claude-review): surface real review failures instead of a silent …
df54d0e 
…green (#117)

## Summary

Every `claude-review` run across all consumer repos has been silently
reporting green for the last 27+ hours while the underlying Claude Agent
SDK call fails with `is_error: true` (0 cost, 1 turn, <1s). No red
check, no warning, just a permanently stuck "I'll analyze this and get
back to you" placeholder comment on every PR.

**Root cause of the invisibility:** our pinned
`anthropics/claude-code-action` version (v1.0.165→166) predates upstream
fix [#1496](anthropics/claude-code-action#1496)
for
[#1495](anthropics/claude-code-action#1495)
("Action reports success when result is is_error:true"), which first
shipped in v1.0.172. Before that fix, `steps.claude-review.outcome` was
always `success` regardless of the SDK result, so our existing "Report
review outcome" step's failure branch was dead code.

**This PR does not fix why the SDK call itself is failing** — that's
bisected to an Anthropic-account-side condition on the
`CLAUDE_CODE_OAUTH_TOKEN` credential (two independent tokens broke
simultaneously with no local change; 27+ hours of continuous failure
rules out a simple 5-hour rate-limit reset). That requires checking the
Anthropic Console, which isn't something this PR can address. This PR
makes that failure *visible* instead of silently green, which is the
actual gap that let it run unnoticed for over a day.

## Changes

- Bump `anthropics/claude-code-action` pin from v1.0.166 → **v1.0.174**
(past the #1495 fix; also picks up an unrelated `ghu_` token-redaction
hardening from the same release range — reviewed every intermediate
commit v1.0.172→v1.0.175 via `gh api compare`, nothing else in range).
- Rewrite "Report review outcome": on a real failure, read the action's
own `execution_file` output (no `show_full_output` needed) for the last
SDK result, emit a real `::error::` annotation (was `::warning::`, and
never fired), and expose `review_failed`/`review_detail` step outputs.
- New "Comment on genuine review failure" step: posts (sticky, via
`--edit-last --create-if-none`) an explicit PR comment labeling any
lingering placeholder as an incomplete infra failure — not "no findings"
— with the run URL and last SDK result.
- `continue-on-error: true` stays on the review step for now — this is a
visibility fix, not a new merge gate. Left as a deliberate follow-up
decision whether a persistent failure should eventually block.

## Verification

- `actionlint` — clean.
- `zizmor` — one pre-existing `artipacked` medium finding, confirmed
unchanged from `main` (unrelated to this change, already accepted by
design per the checkout step's own comment).
- Dry-ran the new shell logic locally against three cases (clean review
/ `is_error` with execution file / failure with missing execution file)
— all three branch and format correctly.
- Not yet verified against a live GitHub Actions run — the account-side
failure currently affecting every repo means the very next PR push
anywhere downstream will exercise the failure path for real once this
rolls out.

## Scope notes

- Did not bundle the still-unconsumed `runner` self-hosted-routing input
(from `4dbb0df`) — that's a separate, deliberately staged multi-repo
rollout per its own commit message.
- Follow-up once merged: bump the pinned SHA in each of the 6 caller
repos (`dotfiles`, `standards`, `claude-code-plugins`, `provisioning`,
`github-iac`, `medley`).

🤖 Generated with [Claude Code](https://claude.com/claude-code)

https://claude.ai/code/session_01QSCqyt1o7XnDXCgyp8ejKT

---------

Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
This was referenced Jul 19, 2026
Merged
Merged
mergify Bot added a commit to ArcadeData/arcadedb that referenced this pull request Jul 19, 2026
@mergify
chore(deps): bump the github-actions group with 5 updates [skip ci]
3ca18b5 
Bumps the github-actions group with 5 updates:
| Package | From | To |
| --- | --- | --- |
| [actions/setup-java](https://github.com/actions/setup-java) | `5.5.0` | `5.6.0` |
| [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) | `1.0.171` | `1.0.178` |
| [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) | `4.37.0` | `4.37.1` |
| [github/codeql-action/init](https://github.com/github/codeql-action) | `4.37.0` | `4.37.1` |
| [github/codeql-action/analyze](https://github.com/github/codeql-action) | `4.37.0` | `4.37.1` |
Updates `actions/setup-java` from 5.5.0 to 5.6.0
Release notes

*Sourced from [actions/setup-java's releases](https://github.com/actions/setup-java/releases).*

> v5.6.0
> ------
>
> What's Changed
> --------------
>
> * Backport to v5: Add Maven compiler problem matcher for javac diagnostics by [`@​brunoborges`](https://github.com/brunoborges) in [actions/setup-java#1087](https://redirect.github.com/actions/setup-java/pull/1087)
> * feat: expose cache-primary-key output ([#597](https://redirect.github.com/actions/setup-java/issues/597)) [v5 backport] by [`@​brunoborges`](https://github.com/brunoborges) in [actions/setup-java#1089](https://redirect.github.com/actions/setup-java/pull/1089)
> * dist: Cover Tencent Kona JDK 25 ([#1108](https://redirect.github.com/actions/setup-java/issues/1108)) [v5 backport] by [`@​brunoborges`](https://github.com/brunoborges) in [actions/setup-java#1110](https://redirect.github.com/actions/setup-java/pull/1110)
> * Backport [#1111](https://redirect.github.com/actions/setup-java/issues/1111): Preserve Maven toolchains across repeated setup-java runs ([#1099](https://redirect.github.com/actions/setup-java/issues/1099)) by [`@​brunoborges`](https://github.com/brunoborges) in [actions/setup-java#1113](https://redirect.github.com/actions/setup-java/pull/1113)
> * Backport [#1097](https://redirect.github.com/actions/setup-java/issues/1097)/[#1098](https://redirect.github.com/actions/setup-java/issues/1098) to v5: cache Maven and Gradle wrapper distributions separately by [`@​brunoborges`](https://github.com/brunoborges) in [actions/setup-java#1122](https://redirect.github.com/actions/setup-java/pull/1122)
>
> **Full Changelog**: <actions/setup-java@v5...v5.6.0>


Commits

* [`03ad4de`](actions/setup-java@03ad4de) Backport [#1097](https://redirect.github.com/actions/setup-java/issues/1097)/[#1098](https://redirect.github.com/actions/setup-java/issues/1098): cache Maven and Gradle wrapper distributions separately...
* [`d229d2e`](actions/setup-java@d229d2e) Backport [#1111](https://redirect.github.com/actions/setup-java/issues/1111): Preserve Maven toolchains across repeated setup-java runs ([#1](https://redirect.github.com/actions/setup-java/issues/1)...
* [`bbf0f69`](actions/setup-java@bbf0f69) dist: Cover Tencent Kona JDK 25 ([#1110](https://redirect.github.com/actions/setup-java/issues/1110))
* [`513edc4`](actions/setup-java@513edc4) feat: expose cache-primary-key output ([#597](https://redirect.github.com/actions/setup-java/issues/597)) [v5 backport] ([#1089](https://redirect.github.com/actions/setup-java/issues/1089))
* [`62df799`](actions/setup-java@62df799) Add Maven compiler problem matcher for javac diagnostics ([#1087](https://redirect.github.com/actions/setup-java/issues/1087))
* [`176156a`](actions/setup-java@176156a) chore: bump version to 5.6.0 for v5 release line
* [`bf7b8de`](actions/setup-java@bf7b8de) build: rebuild dist for backported changes ([#1079](https://redirect.github.com/actions/setup-java/issues/1079), [#1083](https://redirect.github.com/actions/setup-java/issues/1083), [#1084](https://redirect.github.com/actions/setup-java/issues/1084))
* [`0173e6d`](actions/setup-java@0173e6d) Infer distribution from asdf .tool-versions vendor prefix ([#1084](https://redirect.github.com/actions/setup-java/issues/1084))
* [`f45cd82`](actions/setup-java@f45cd82) Rename jdkFile input to jdk-file with deprecated alias ([#1083](https://redirect.github.com/actions/setup-java/issues/1083))
* [`e2863ad`](actions/setup-java@e2863ad) Map Zulu x86 architecture to i686 for Azul Metadata API ([#1079](https://redirect.github.com/actions/setup-java/issues/1079))
* Additional commits viewable in [compare view](actions/setup-java@0f481fc...03ad4de)
  
Updates `anthropics/claude-code-action` from 1.0.171 to 1.0.178
Release notes

*Sourced from [anthropics/claude-code-action's releases](https://github.com/anthropics/claude-code-action/releases).*

> v1.0.178
> --------
>
> **Full Changelog**: <anthropics/claude-code-action@v1...v1.0.178>
>
> v1.0.177
> --------
>
> **Full Changelog**: <anthropics/claude-code-action@v1...v1.0.177>
>
> v1.0.176
> --------
>
> What's Changed
> --------------
>
> * docs: fix dead example links in custom-automations.md by [`@​evol1228`](https://github.com/evol1228) in [anthropics/claude-code-action#1513](https://redirect.github.com/anthropics/claude-code-action/pull/1513)
> * test: cover prepareContext validation error branches by [`@​farmer-data`](https://github.com/farmer-data) in [anthropics/claude-code-action#1460](https://redirect.github.com/anthropics/claude-code-action/pull/1460)
> * fix: sanitize {{label}} in branch name templates by [`@​pa-arth`](https://github.com/pa-arth) in [anthropics/claude-code-action#1492](https://redirect.github.com/anthropics/claude-code-action/pull/1492)
> * fix(sanitizer): strip alt text from reference-style markdown images by [`@​HumphreySun98`](https://github.com/HumphreySun98) in [anthropics/claude-code-action#1488](https://redirect.github.com/anthropics/claude-code-action/pull/1488)
> * fix: map claude\_args model to SDK options by [`@​Epochex`](https://github.com/Epochex) in [anthropics/claude-code-action#1474](https://redirect.github.com/anthropics/claude-code-action/pull/1474)
> * fix: allow leading underscore in branch names (valid per git-check-ref-format) by [`@​riley-mete-db`](https://github.com/riley-mete-db) in [anthropics/claude-code-action#1486](https://redirect.github.com/anthropics/claude-code-action/pull/1486)
> * fix(format): filter out thinking\_tokens system messages from step summary by [`@​anishesg`](https://github.com/anishesg) in [anthropics/claude-code-action#1479](https://redirect.github.com/anthropics/claude-code-action/pull/1479)
> * docs: map custom\_instructions to --append-system-prompt ([#1480](https://redirect.github.com/anthropics/claude-code-action/issues/1480)) by [`@​farmer-data`](https://github.com/farmer-data) in [anthropics/claude-code-action#1484](https://redirect.github.com/anthropics/claude-code-action/pull/1484)
> * fix: handle null comment/review author from deleted accounts by [`@​pa-arth`](https://github.com/pa-arth) in [anthropics/claude-code-action#1490](https://redirect.github.com/anthropics/claude-code-action/pull/1490)
>
> New Contributors
> ----------------
>
> * [`@​evol1228`](https://github.com/evol1228) made their first contribution in [anthropics/claude-code-action#1513](https://redirect.github.com/anthropics/claude-code-action/pull/1513)
> * [`@​pa-arth`](https://github.com/pa-arth) made their first contribution in [anthropics/claude-code-action#1492](https://redirect.github.com/anthropics/claude-code-action/pull/1492)
> * [`@​HumphreySun98`](https://github.com/HumphreySun98) made their first contribution in [anthropics/claude-code-action#1488](https://redirect.github.com/anthropics/claude-code-action/pull/1488)
> * [`@​Epochex`](https://github.com/Epochex) made their first contribution in [anthropics/claude-code-action#1474](https://redirect.github.com/anthropics/claude-code-action/pull/1474)
> * [`@​riley-mete-db`](https://github.com/riley-mete-db) made their first contribution in [anthropics/claude-code-action#1486](https://redirect.github.com/anthropics/claude-code-action/pull/1486)
> * [`@​anishesg`](https://github.com/anishesg) made their first contribution in [anthropics/claude-code-action#1479](https://redirect.github.com/anthropics/claude-code-action/pull/1479)
>
> **Full Changelog**: <anthropics/claude-code-action@v1...v1.0.176>
>
> v1.0.175
> --------
>
> **Full Changelog**: <anthropics/claude-code-action@v1...v1.0.175>
>
> v1.0.174
> --------
>
> What's Changed
> --------------
>
> * fix(sanitizer): redact GitHub user-to-server (ghu\_) tokens by [`@​NickNojiri`](https://github.com/NickNojiri) in [anthropics/claude-code-action#1502](https://redirect.github.com/anthropics/claude-code-action/pull/1502)
>
> New Contributors
> ----------------
>
> * [`@​NickNojiri`](https://github.com/NickNojiri) made their first contribution in [anthropics/claude-code-action#1502](https://redirect.github.com/anthropics/claude-code-action/pull/1502)
>
> **Full Changelog**: <anthropics/claude-code-action@v1...v1.0.174>
>
> v1.0.173
> --------
>
> **Full Changelog**: <anthropics/claude-code-action@v1...v1.0.173>
>
> v1.0.172
> --------
>
> What's Changed
> --------------
>
> * fix(sdk): fail step when result has is\_error:true despite success subtype by [`@​syf2211`](https://github.com/syf2211) in [anthropics/claude-code-action#1496](https://redirect.github.com/anthropics/claude-code-action/pull/1496)
>
> **Full Changelog**: <anthropics/claude-code-action@v1...v1.0.172>


Commits

* [`af0559e`](anthropics/claude-code-action@af0559e) chore: bump Claude Code to 2.1.215 and Agent SDK to 0.3.215
* [`3553f84`](anthropics/claude-code-action@3553f84) chore: bump Claude Code to 2.1.214 and Agent SDK to 0.3.214
* [`700e7f8`](anthropics/claude-code-action@700e7f8) chore: bump Claude Code to 2.1.212 and Agent SDK to 0.3.212
* [`3e807ec`](anthropics/claude-code-action@3e807ec) fix: handle null comment/review author from deleted accounts ([#1490](https://redirect.github.com/anthropics/claude-code-action/issues/1490))
* [`2988cbe`](anthropics/claude-code-action@2988cbe) docs: map custom\_instructions to --append-system-prompt ([#1480](https://redirect.github.com/anthropics/claude-code-action/issues/1480)) ([#1484](https://redirect.github.com/anthropics/claude-code-action/issues/1484))
* [`a1c0599`](anthropics/claude-code-action@a1c0599) fix(format): filter out thinking\_tokens system messages from step summary ([#1](https://redirect.github.com/anthropics/claude-code-action/issues/1)...
* [`5bfa96a`](anthropics/claude-code-action@5bfa96a) fix: allow leading underscore in branch names (valid per git-check-ref-format...
* [`214a706`](anthropics/claude-code-action@214a706) fix: map claude\_args model to SDK options ([#1474](https://redirect.github.com/anthropics/claude-code-action/issues/1474))
* [`5f509a1`](anthropics/claude-code-action@5f509a1) fix(sanitizer): strip alt text from reference-style markdown images ([#1488](https://redirect.github.com/anthropics/claude-code-action/issues/1488))
* [`e64308f`](anthropics/claude-code-action@e64308f) fix: sanitize {{label}} in branch name templates ([#1492](https://redirect.github.com/anthropics/claude-code-action/issues/1492))
* Additional commits viewable in [compare view](anthropics/claude-code-action@e90deca...af0559e)
  
Updates `github/codeql-action/upload-sarif` from 4.37.0 to 4.37.1
Release notes

*Sourced from [github/codeql-action/upload-sarif's releases](https://github.com/github/codeql-action/releases).*

> v4.37.1
> -------
>
> * *Upcoming breaking change*: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. [#3956](https://redirect.github.com/github/codeql-action/pull/3956)
> * Update default CodeQL bundle version to [2.26.1](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1). [#4019](https://redirect.github.com/github/codeql-action/pull/4019)


Changelog

*Sourced from [github/codeql-action/upload-sarif's changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md).*

> CodeQL Action Changelog
> =======================
>
> See the [releases page](https://github.com/github/codeql-action/releases) for the relevant changes to the CodeQL CLI and language packs.
>
> [UNRELEASED]
> ------------
>
> No user facing changes.
>
> 4.37.1 - 16 Jul 2026
> --------------------
>
> * *Upcoming breaking change*: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. [#3956](https://redirect.github.com/github/codeql-action/pull/3956)
> * Update default CodeQL bundle version to [2.26.1](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1). [#4019](https://redirect.github.com/github/codeql-action/pull/4019)
>
> 4.37.0 - 08 Jul 2026
> --------------------
>
> * Update default CodeQL bundle version to [2.26.0](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0). [#3995](https://redirect.github.com/github/codeql-action/pull/3995)
> * In addition to the existing input format, the `config-file` input for the `codeql-action/init` step will soon support a new `[owner/]repo[@ref][:path]` format. All components except the repository name are optional. If omitted, `owner` defaults to the same owner as the repository the analysis is running for, `ref` to `main`, and `path` to `.github/codeql-action.yaml`. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. [#3973](https://redirect.github.com/github/codeql-action/pull/3973)
>
> 4.36.3 - 01 Jul 2026
> --------------------
>
> No user facing changes.
>
> 4.36.2 - 04 Jun 2026
> --------------------
>
> * Cache CodeQL CLI version information across Actions steps. [#3943](https://redirect.github.com/github/codeql-action/pull/3943)
> * Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. [#3937](https://redirect.github.com/github/codeql-action/pull/3937)
> * Update default CodeQL bundle version to [2.25.6](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.6). [#3948](https://redirect.github.com/github/codeql-action/pull/3948)
>
> 4.36.1 - 02 Jun 2026
> --------------------
>
> No user facing changes.
>
> 4.36.0 - 22 May 2026
> --------------------
>
> * *Breaking change*: Bump the minimum required CodeQL bundle version to 2.19.4. [#3894](https://redirect.github.com/github/codeql-action/pull/3894)
> * Add support for SHA-256 Git object IDs. [#3893](https://redirect.github.com/github/codeql-action/pull/3893)
> * Update default CodeQL bundle version to [2.25.5](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.5). [#3926](https://redirect.github.com/github/codeql-action/pull/3926)
>
> 4.35.5 - 15 May 2026
> --------------------
>
> * We have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. [#3899](https://redirect.github.com/github/codeql-action/pull/3899)
> * For performance and accuracy reasons, [improved incremental analysis](https://redirect.github.com/github/roadmap/issues/1158) will now only be enabled on a pull request when diff-informed analysis is also enabled for that run. If diff-informed analysis is unavailable (for example, because the PR diff ranges could not be computed), the action will fall back to a full analysis. [#3791](https://redirect.github.com/github/codeql-action/pull/3791)
> * If multiple inputs are provided for the GitHub-internal `analysis-kinds` input, only `code-scanning` will be enabled. The `analysis-kinds` input is experimental, for GitHub-internal use only, and may change without notice at any time. [#3892](https://redirect.github.com/github/codeql-action/pull/3892)
> * Added an experimental change which, when running a Code Scanning analysis for a PR with [improved incremental analysis](https://redirect.github.com/github/roadmap/issues/1158) enabled, prefers CodeQL CLI versions that have a cached overlay-base database for the configured languages. This speeds up analysis for a repository when there is not yet a cached overlay-base database for the latest CLI version. We expect to roll this change out to everyone in May. [#3880](https://redirect.github.com/github/codeql-action/pull/3880)
>
> 4.35.4 - 07 May 2026
> --------------------
>
> * Update default CodeQL bundle version to [2.25.4](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.4). [#3881](https://redirect.github.com/github/codeql-action/pull/3881)
>
> 4.35.3 - 01 May 2026
> --------------------

... (truncated)


Commits

* [`7188fc3`](github/codeql-action@7188fc3) Merge pull request [#4020](https://redirect.github.com/github/codeql-action/issues/4020) from github/update-v4.37.1-9e7c07009
* [`c8b5f69`](github/codeql-action@c8b5f69) Update changelog for v4.37.1
* [`9e7c070`](github/codeql-action@9e7c070) Merge pull request [#4014](https://redirect.github.com/github/codeql-action/issues/4014) from github/mbg/explicit-remote-prefix
* [`3492b7e`](github/codeql-action@3492b7e) Change `REMOTE_PATH_PREFIX` to `remote=`
* [`3654baa`](github/codeql-action@3654baa) Merge remote-tracking branch 'origin/main' into mbg/explicit-remote-prefix
* [`2d682ac`](github/codeql-action@2d682ac) Merge pull request [#4017](https://redirect.github.com/github/codeql-action/issues/4017) from github/dependabot/github\_actions/dot-github/wor...
* [`23f6a50`](github/codeql-action@23f6a50) Merge pull request [#4009](https://redirect.github.com/github/codeql-action/issues/4009) from github/mbg/action-state/additions
* [`1ee3c75`](github/codeql-action@1ee3c75) Merge pull request [#4018](https://redirect.github.com/github/codeql-action/issues/4018) from github/dependabot/github\_actions/dot-github/wor...
* [`e053684`](github/codeql-action@e053684) Merge pull request [#4015](https://redirect.github.com/github/codeql-action/issues/4015) from github/dependabot/npm\_and\_yarn/npm-minor-fd2e83...
* [`6803c56`](github/codeql-action@6803c56) Merge pull request [#4019](https://redirect.github.com/github/codeql-action/issues/4019) from github/update-bundle/codeql-bundle-v2.26.1
* Additional commits viewable in [compare view](github/codeql-action@99df26d...7188fc3)
  
Updates `github/codeql-action/init` from 4.37.0 to 4.37.1
Release notes

*Sourced from [github/codeql-action/init's releases](https://github.com/github/codeql-action/releases).*

> v4.37.1
> -------
>
> * *Upcoming breaking change*: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. [#3956](https://redirect.github.com/github/codeql-action/pull/3956)
> * Update default CodeQL bundle version to [2.26.1](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1). [#4019](https://redirect.github.com/github/codeql-action/pull/4019)


Changelog

*Sourced from [github/codeql-action/init's changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md).*

> CodeQL Action Changelog
> =======================
>
> See the [releases page](https://github.com/github/codeql-action/releases) for the relevant changes to the CodeQL CLI and language packs.
>
> [UNRELEASED]
> ------------
>
> No user facing changes.
>
> 4.37.1 - 16 Jul 2026
> --------------------
>
> * *Upcoming breaking change*: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. [#3956](https://redirect.github.com/github/codeql-action/pull/3956)
> * Update default CodeQL bundle version to [2.26.1](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1). [#4019](https://redirect.github.com/github/codeql-action/pull/4019)
>
> 4.37.0 - 08 Jul 2026
> --------------------
>
> * Update default CodeQL bundle version to [2.26.0](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0). [#3995](https://redirect.github.com/github/codeql-action/pull/3995)
> * In addition to the existing input format, the `config-file` input for the `codeql-action/init` step will soon support a new `[owner/]repo[@ref][:path]` format. All components except the repository name are optional. If omitted, `owner` defaults to the same owner as the repository the analysis is running for, `ref` to `main`, and `path` to `.github/codeql-action.yaml`. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. [#3973](https://redirect.github.com/github/codeql-action/pull/3973)
>
> 4.36.3 - 01 Jul 2026
> --------------------
>
> No user facing changes.
>
> 4.36.2 - 04 Jun 2026
> --------------------
>
> * Cache CodeQL CLI version information across Actions steps. [#3943](https://redirect.github.com/github/codeql-action/pull/3943)
> * Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. [#3937](https://redirect.github.com/github/codeql-action/pull/3937)
> * Update default CodeQL bundle version to [2.25.6](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.6). [#3948](https://redirect.github.com/github/codeql-action/pull/3948)
>
> 4.36.1 - 02 Jun 2026
> --------------------
>
> No user facing changes.
>
> 4.36.0 - 22 May 2026
> --------------------
>
> * *Breaking change*: Bump the minimum required CodeQL bundle version to 2.19.4. [#3894](https://redirect.github.com/github/codeql-action/pull/3894)
> * Add support for SHA-256 Git object IDs. [#3893](https://redirect.github.com/github/codeql-action/pull/3893)
> * Update default CodeQL bundle version to [2.25.5](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.5). [#3926](https://redirect.github.com/github/codeql-action/pull/3926)
>
> 4.35.5 - 15 May 2026
> --------------------
>
> * We have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. [#3899](https://redirect.github.com/github/codeql-action/pull/3899)
> * For performance and accuracy reasons, [improved incremental analysis](https://redirect.github.com/github/roadmap/issues/1158) will now only be enabled on a pull request when diff-informed analysis is also enabled for that run. If diff-informed analysis is unavailable (for example, because the PR diff ranges could not be computed), the action will fall back to a full analysis. [#3791](https://redirect.github.com/github/codeql-action/pull/3791)
> * If multiple inputs are provided for the GitHub-internal `analysis-kinds` input, only `code-scanning` will be enabled. The `analysis-kinds` input is experimental, for GitHub-internal use only, and may change without notice at any time. [#3892](https://redirect.github.com/github/codeql-action/pull/3892)
> * Added an experimental change which, when running a Code Scanning analysis for a PR with [improved incremental analysis](https://redirect.github.com/github/roadmap/issues/1158) enabled, prefers CodeQL CLI versions that have a cached overlay-base database for the configured languages. This speeds up analysis for a repository when there is not yet a cached overlay-base database for the latest CLI version. We expect to roll this change out to everyone in May. [#3880](https://redirect.github.com/github/codeql-action/pull/3880)
>
> 4.35.4 - 07 May 2026
> --------------------
>
> * Update default CodeQL bundle version to [2.25.4](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.4). [#3881](https://redirect.github.com/github/codeql-action/pull/3881)
>
> 4.35.3 - 01 May 2026
> --------------------

... (truncated)


Commits

* [`7188fc3`](github/codeql-action@7188fc3) Merge pull request [#4020](https://redirect.github.com/github/codeql-action/issues/4020) from github/update-v4.37.1-9e7c07009
* [`c8b5f69`](github/codeql-action@c8b5f69) Update changelog for v4.37.1
* [`9e7c070`](github/codeql-action@9e7c070) Merge pull request [#4014](https://redirect.github.com/github/codeql-action/issues/4014) from github/mbg/explicit-remote-prefix
* [`3492b7e`](github/codeql-action@3492b7e) Change `REMOTE_PATH_PREFIX` to `remote=`
* [`3654baa`](github/codeql-action@3654baa) Merge remote-tracking branch 'origin/main' into mbg/explicit-remote-prefix
* [`2d682ac`](github/codeql-action@2d682ac) Merge pull request [#4017](https://redirect.github.com/github/codeql-action/issues/4017) from github/dependabot/github\_actions/dot-github/wor...
* [`23f6a50`](github/codeql-action@23f6a50) Merge pull request [#4009](https://redirect.github.com/github/codeql-action/issues/4009) from github/mbg/action-state/additions
* [`1ee3c75`](github/codeql-action@1ee3c75) Merge pull request [#4018](https://redirect.github.com/github/codeql-action/issues/4018) from github/dependabot/github\_actions/dot-github/wor...
* [`e053684`](github/codeql-action@e053684) Merge pull request [#4015](https://redirect.github.com/github/codeql-action/issues/4015) from github/dependabot/npm\_and\_yarn/npm-minor-fd2e83...
* [`6803c56`](github/codeql-action@6803c56) Merge pull request [#4019](https://redirect.github.com/github/codeql-action/issues/4019) from github/update-bundle/codeql-bundle-v2.26.1
* Additional commits viewable in [compare view](github/codeql-action@99df26d...7188fc3)
  
Updates `github/codeql-action/analyze` from 4.37.0 to 4.37.1
Release notes

*Sourced from [github/codeql-action/analyze's releases](https://github.com/github/codeql-action/releases).*

> v4.37.1
> -------
>
> * *Upcoming breaking change*: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. [#3956](https://redirect.github.com/github/codeql-action/pull/3956)
> * Update default CodeQL bundle version to [2.26.1](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1). [#4019](https://redirect.github.com/github/codeql-action/pull/4019)


Changelog

*Sourced from [github/codeql-action/analyze's changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md).*

> CodeQL Action Changelog
> =======================
>
> See the [releases page](https://github.com/github/codeql-action/releases) for the relevant changes to the CodeQL CLI and language packs.
>
> [UNRELEASED]
> ------------
>
> No user facing changes.
>
> 4.37.1 - 16 Jul 2026
> --------------------
>
> * *Upcoming breaking change*: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. [#3956](https://redirect.github.com/github/codeql-action/pull/3956)
> * Update default CodeQL bundle version to [2.26.1](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1). [#4019](https://redirect.github.com/github/codeql-action/pull/4019)
>
> 4.37.0 - 08 Jul 2026
> --------------------
>
> * Update default CodeQL bundle version to [2.26.0](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0). [#3995](https://redirect.github.com/github/codeql-action/pull/3995)
> * In addition to the existing input format, the `config-file` input for the `codeql-action/init` step will soon support a new `[owner/]repo[@ref][:path]` format. All components except the repository name are optional. If omitted, `owner` defaults to the same owner as the repository the analysis is running for, `ref` to `main`, and `path` to `.github/codeql-action.yaml`. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. [#3973](https://redirect.github.com/github/codeql-action/pull/3973)
>
> 4.36.3 - 01 Jul 2026
> --------------------
>
> No user facing changes.
>
> 4.36.2 - 04 Jun 2026
> --------------------
>
> * Cache CodeQL CLI version information across Actions steps. [#3943](https://redirect.github.com/github/codeql-action/pull/3943)
> * Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. [#3937](https://redirect.github.com/github/codeql-action/pull/3937)
> * Update default CodeQL bundle version to [2.25.6](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.6). [#3948](https://redirect.github.com/github/codeql-action/pull/3948)
>
> 4.36.1 - 02 Jun 2026
> --------------------
>
> No user facing changes.
>
> 4.36.0 - 22 May 2026
> --------------------
>
> * *Breaking change*: Bump the minimum required CodeQL bundle version to 2.19.4. [#3894](https://redirect.github.com/github/codeql-action/pull/3894)
> * Add support for SHA-256 Git object IDs. [#3893](https://redirect.github.com/github/codeql-action/pull/3893)
> * Update default CodeQL bundle version to [2.25.5](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.5). [#3926](https://redirect.github.com/github/codeql-action/pull/3926)
>
> 4.35.5 - 15 May 2026
> --------------------
>
> * We have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. [#3899](https://redirect.github.com/github/codeql-action/pull/3899)
> * For performance and accuracy reasons, [improved incremental analysis](https://redirect.github.com/github/roadmap/issues/1158) will now only be enabled on a pull request when diff-informed analysis is also enabled for that run. If diff-informed analysis is unavailable (for example, because the PR diff ranges could not be computed), the action will fall back to a full analysis. [#3791](https://redirect.github.com/github/codeql-action/pull/3791)
> * If multiple inputs are provided for the GitHub-internal `analysis-kinds` input, only `code-scanning` will be enabled. The `analysis-kinds` input is experimental, for GitHub-internal use only, and may change without notice at any time. [#3892](https://redirect.github.com/github/codeql-action/pull/3892)
> * Added an experimental change which, when running a Code Scanning analysis for a PR with [improved incremental analysis](https://redirect.github.com/github/roadmap/issues/1158) enabled, prefers CodeQL CLI versions that have a cached overlay-base database for the configured languages. This speeds up analysis for a repository when there is not yet a cached overlay-base database for the latest CLI version. We expect to roll this change out to everyone in May. [#3880](https://redirect.github.com/github/codeql-action/pull/3880)
>
> 4.35.4 - 07 May 2026
> --------------------
>
> * Update default CodeQL bundle version to [2.25.4](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.4). [#3881](https://redirect.github.com/github/codeql-action/pull/3881)
>
> 4.35.3 - 01 May 2026
> --------------------

... (truncated)


Commits

* [`7188fc3`](github/codeql-action@7188fc3) Merge pull request [#4020](https://redirect.github.com/github/codeql-action/issues/4020) from github/update-v4.37.1-9e7c07009
* [`c8b5f69`](github/codeql-action@c8b5f69) Update changelog for v4.37.1
* [`9e7c070`](github/codeql-action@9e7c070) Merge pull request [#4014](https://redirect.github.com/github/codeql-action/issues/4014) from github/mbg/explicit-remote-prefix
* [`3492b7e`](github/codeql-action@3492b7e) Change `REMOTE_PATH_PREFIX` to `remote=`
* [`3654baa`](github/codeql-action@3654baa) Merge remote-tracking branch 'origin/main' into mbg/explicit-remote-prefix
* [`2d682ac`](github/codeql-action@2d682ac) Merge pull request [#4017](https://redirect.github.com/github/codeql-action/issues/4017) from github/dependabot/github\_actions/dot-github/wor...
* [`23f6a50`](github/codeql-action@23f6a50) Merge pull request [#4009](https://redirect.github.com/github/codeql-action/issues/4009) from github/mbg/action-state/additions
* [`1ee3c75`](github/codeql-action@1ee3c75) Merge pull request [#4018](https://redirect.github.com/github/codeql-action/issues/4018) from github/dependabot/github\_actions/dot-github/wor...
* [`e053684`](github/codeql-action@e053684) Merge pull request [#4015](https://redirect.github.com/github/codeql-action/issues/4015) from github/dependabot/npm\_and\_yarn/npm-minor-fd2e83...
* [`6803c56`](github/codeql-action@6803c56) Merge pull request [#4019](https://redirect.github.com/github/codeql-action/issues/4019) from github/update-bundle/codeql-bundle-v2.26.1
* Additional commits viewable in [compare view](github/codeql-action@99df26d...7188fc3)
  
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
Dependabot commands and options
  
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show  ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore  major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
- `@dependabot ignore  minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
- `@dependabot ignore ` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore ` will remove all of the ignore conditions of the specified dependency
- `@dependabot unignore  ` will remove the ignore condition of the specified dependency and ignore conditions
@lifebugz lifebugz mentioned this pull request Jul 26, 2026
Closed
@aj604 aj604 mentioned this pull request Jul 27, 2026
Merged
This was referenced Aug 14, 2026
Open
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@ashwin-ant ashwin-ant ashwin-ant approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Action reports success (green check) when result is is_error:true — misleading CI review gate

2 participants

@syf2211 @ashwin-ant