Go analysis fails on v3.30.0+

[melinath]

Successful run @ Aug 29, 2025, 5:49 PM PDT: https://github.com/GoogleCloudPlatform/magic-modules/actions/runs/17337146028/job/49225275468
v3.30.0 release @ Sep 1, 2025, 6:34 AM PDT: https://github.com/github/codeql-action/releases/tag/v3.30.0
Next run failed @ Sep 2, 2025, 9:15 AM PDT: https://github.com/GoogleCloudPlatform/magic-modules/actions/runs/17409426415/job/49422549848

Error:

Error: Error running analysis for go: Cannot read properties of undefined (reading 'includes')
Warning: Caught an exception while gathering information for telemetry: TypeError: Cannot read properties of undefined (reading 'join'). Will skip sending status report.

[hvitved]

Hi

This is likely because you use two different SHAs (05963f47d870e2cb19a537396c1f668a348c7d8f and 3c3833e0f8c1c83d449a7478aa59c036a9165498) in https://github.com/GoogleCloudPlatform/magic-modules/blob/main/.github/workflows/codeql.yml. Does it work if you replace the two 05963f47d870e2cb19a537396c1f668a348c7d8f occurrences with 3c3833e0f8c1c83d449a7478aa59c036a9165498?

[mbg]

@melinath to add to what @hvitved wrote earlier, the problem with your failed run was that you had pinned 05963f47d870e2cb19a537396c1f668a348c7d8f for the init and autobuild steps in your CodeQL workflow, but used v3 for the analyze step. 05963f47d870e2cb19a537396c1f668a348c7d8f is an ancient version of the CodeQL Action, while v3 gets you the latest version.

Mixing versions of the CodeQL Action between steps in your workflow is not supported and can lead to unpredictable behaviour. Your change in GoogleCloudPlatform/magic-modules#15104 now pins 3c3833e0f8c1c83d449a7478aa59c036a9165498 for analyze, but keeps 05963f47d870e2cb19a537396c1f668a348c7d8f for the other two CodeQL Action steps.

At the very least, you should use the same SHA for all codeql-action steps in your workflow, as @hvitved has already suggested. Given this issue, we are now adding checks to ensure that different versions of the CodeQL Action are not mixed in a given workflow:

• Validate workflow to check that all codeql-action versions are the same #3099
• Store and check action version in Config #3100

However, we would generally advise that you keep the version of the codeql-action you use up-to-date (e.g. using Dependabot or by pinning v3). We only offer limited support for older versions of the CodeQL Action.

[melinath]

Makes sense, thanks for pointing that out! It looks like we missed pinning the last command in our initial commit and just got lucky until now. Validation to make sure the versions are the same sounds like a great improvement, thanks!