Bump the version of the Action to 2.20.0. This ensures that users who received a Dependabot upgrade to cdcdbb5, which was mistakenly marked as Action version 2.13.4, continue to receive updates to the CodeQL Action.
The CodeQL Action repository contains a series of tags v* corresponding to versions of the CodeQL Action. However it also contains a series of tags codeql-bundle-* that correspond to versions of the CodeQL Bundle, an artifact that contains the CodeQL CLI and the standard CodeQL libraries.
In CodeQL CLI version 2.13.4, we changed the format of the CodeQL Bundle tag from a date, for example codeql-bundle-20230613, to a semantic version, for example codeql-bundle-v2.13.4. This inadvertently sent out Dependabot PRs that upgraded users from v2.3.6 to codeql-bundle-v2.13.4.
To ensure that users who merged this Dependabot upgrade continue to receive correct updates to the CodeQL Action, we are bumping the Action version to make it greater than 2.13.4. We chose version 2.20.0 to help avoid confusion between the version numbers of the CodeQL Action and the CodeQL CLI.
Merge / deployment checklist
Confirm this change is backwards compatible with existing workflows.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bump the version of the Action to 2.20.0. This ensures that users who received a Dependabot upgrade to cdcdbb5, which was mistakenly marked as Action version 2.13.4, continue to receive updates to the CodeQL Action.
Merge / deployment checklist