From e4a635653bd5689cf54eed5e6b091b5613fbbfb3 Mon Sep 17 00:00:00 2001 From: Gonzalo Diaz Date: Mon, 10 Aug 2026 20:49:17 -0400 Subject: [PATCH 1/3] Old images with cmake 3.x disabled. --- .github/workflows/codeql.yml | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 5c6f4f9..3eb768d 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -29,7 +29,7 @@ on: # yamllint disable-line rule:truthy # │ │ │ │ │ # │ │ │ │ │ # * * * * * - - cron: '16 20 * * 0' + - cron: "16 20 * * 0" jobs: analyze: @@ -40,8 +40,7 @@ jobs: # - https://gh.io/using-larger-runners (GitHub.com only) # Consider using larger runners or machines with greater resources # for possible analysis time improvements. - runs-on: - ${{ (matrix.language == 'swift' && 'macos-14') || 'ubuntu-24.04' }} + runs-on: ${{ (matrix.language == 'swift' && 'macos-14') || 'ubuntu-26.04' }} permissions: # required for all workflows security-events: write From 490ebc514385c6a8e51985dcdba288c275b259dc Mon Sep 17 00:00:00 2001 From: Gonzalo Diaz Date: Mon, 10 Aug 2026 20:50:44 -0400 Subject: [PATCH 2/3] [Github Actions] Update ubuntu image to v26 --- .github/workflows/markdown-lint.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/markdown-lint.yml b/.github/workflows/markdown-lint.yml index 051f6e7..54fe76d 100644 --- a/.github/workflows/markdown-lint.yml +++ b/.github/workflows/markdown-lint.yml @@ -19,7 +19,7 @@ permissions: jobs: markdownlint: name: Markdown Lint - runs-on: ubuntu-24.04 + runs-on: ubuntu-26.04 steps: - name: Checkout repository From 055039845674ebc6ab20325309c1a795b66d393b Mon Sep 17 00:00:00 2001 From: Gonzalo Diaz Date: Mon, 10 Aug 2026 20:51:33 -0400 Subject: [PATCH 3/3] [BUGFIX] [Github Actions] Omitting "--only-binary :all:" can lead to the execution of setup scripts. Make sure it is safe here.sonarqube(githubactions:S8541) Using dependencies without locking resolved versions is security-sensitive.sonarqube(githubactions:S8544) --- .github/workflows/yamllint.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/yamllint.yml b/.github/workflows/yamllint.yml index 00e7d3e..4a0304c 100644 --- a/.github/workflows/yamllint.yml +++ b/.github/workflows/yamllint.yml @@ -1,5 +1,4 @@ --- - name: YAML lint on: # yamllint disable-line rule:truthy @@ -19,7 +18,8 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - name: Install yamllint - run: pip install yamllint + run: | + pip install --only-binary :all: yamllint==1.38.0 - name: Lint YAML files run: >