Go analysis fails on v3.30.0+ #3096

Activity

1. hvitved commented on Sep 10, 2025

   

   hvitved

   on Sep 10, 2025

   More actions

   Hi

   This is likely because you use two different SHAs (05963f47d870e2cb19a537396c1f668a348c7d8f and 3c3833e0f8c1c83d449a7478aa59c036a9165498) in https://github.com/GoogleCloudPlatform/magic-modules/blob/main/.github/workflows/codeql.yml. Does it work if you replace the two 05963f47d870e2cb19a537396c1f668a348c7d8f occurrences with 3c3833e0f8c1c83d449a7478aa59c036a9165498?
2. mbg commented on Sep 10, 2025

   

   mbg

   on Sep 10, 2025

   Member

   More actions

   @melinath to add to what @hvitved wrote earlier, the problem with your failed run was that you had pinned 05963f47d870e2cb19a537396c1f668a348c7d8f for the init and autobuild steps in your CodeQL workflow, but used v3 for the analyze step. 05963f47d870e2cb19a537396c1f668a348c7d8f is an ancient version of the CodeQL Action, while v3 gets you the latest version.

   Mixing versions of the CodeQL Action between steps in your workflow is not supported and can lead to unpredictable behaviour. Your change in GoogleCloudPlatform/magic-modules#15104 now pins 3c3833e0f8c1c83d449a7478aa59c036a9165498 for analyze, but keeps 05963f47d870e2cb19a537396c1f668a348c7d8f for the other two CodeQL Action steps.

   At the very least, you should use the same SHA for all codeql-action steps in your workflow, as @hvitved has already suggested. Given this issue, we are now adding checks to ensure that different versions of the CodeQL Action are not mixed in a given workflow:

   • Validate workflow to check that all codeql-action versions are the same #3099
   • Store and check action version in Config #3100

   However, we would generally advise that you keep the version of the codeql-action you use up-to-date (e.g. using Dependabot or by pinning v3). We only offer limited support for older versions of the CodeQL Action.
3. melinath commented on Sep 10, 2025

   

   melinath

   on Sep 10, 2025

   Author

   More actions

   Makes sense, thanks for pointing that out! It looks like we missed pinning the last command in our initial commit and just got lucky until now. Validation to make sure the versions are the same sounds like a great improvement, thanks!
4. mbg commented on Sep 15, 2025

   

   mbg

   on Sep 15, 2025

   Member

   More actions

   I think the issue for you is resolved now, and we have also merged our improved checks, so I will go ahead and close this issue now.
5. mbg

   closed this as completedon Sep 15, 2025