Always seen "Error: Cannot read properties of undefined (reading 'length')" after bumping action to v2.22.12

[mdelapenya]

After bumping the version of codeql-action, I'm seeing this error for every GH action run:

Example run: https://github.com/testcontainers/testcontainers-go/actions/runs/7450719386/job/20270252456?pr=2080

Log output:

Run github/codeql-action/analyze@1500a131381b66de0c52ac28abb13cd79f4b7ecc
  with:
    category: /language:javascript
    output: ../results
    upload: always
    cleanup-level: brutal
    add-snippets: false
    skip-queries: false
    checkout_path: /home/runner/work/testcontainers-go/testcontainers-go
    upload-database: true
    wait-for-processing: true
    token: ***
    matrix: {
    "language": "javascript"
  }
    expect-error: false
  env:
    CODEQL_ACTION_FEATURE_MULTI_LANGUAGE: false
    CODEQL_ACTION_FEATURE_SANDWICH: false
    CODEQL_ACTION_FEATURE_SARIF_COMBINE: true
    CODEQL_ACTION_FEATURE_WILL_UPLOAD: true
    CODEQL_ACTION_VERSION: [2](https://github.com/testcontainers/testcontainers-go/actions/runs/7450719386/job/20270252456?pr=2080#step:5:2).22.12
    JOB_RUN_UUID: 071cbc5c-e9[3](https://github.com/testcontainers/testcontainers-go/actions/runs/7450719386/job/20270252456?pr=2080#step:5:3)0-[4](https://github.com/testcontainers/testcontainers-go/actions/runs/7450719386/job/20270252456?pr=2080#step:5:4)1cf-b918-ee8112b[5](https://github.com/testcontainers/testcontainers-go/actions/runs/7450719386/job/20270252456?pr=2080#step:5:5)df[6](https://github.com/testcontainers/testcontainers-go/actions/runs/7450719386/job/20270252456?pr=2080#step:5:6)b
    CODEQL_ACTION_ANALYSIS_KEY: .github/workflows/codeql.yml:analyze
    CODEQL_WORKFLOW_STARTED_AT: 2024-01-08T1[7](https://github.com/testcontainers/testcontainers-go/actions/runs/7450719386/job/20270252456?pr=2080#step:5:7):03:23.336Z
    CODEQL_RAM: 14567
    CODEQL_THREADS: 4
    CODEQL_EXTRACTOR_PYTHON_DISABLE_LIBRARY_EXTRACTION: true
/opt/hostedtoolcache/CodeQL/2.15.4/x64/codeql/codeql version --format=json
{
  "productName" : "CodeQL",
  "vendor" : "GitHub",
  "version" : "2.15.4",
  "sha" : "6994dfd6d94ee3d20576[8](https://github.com/testcontainers/testcontainers-go/actions/runs/7450719386/job/20270252456?pr=2080#step:5:8)fbe15e18312bf22b388",
  "branches" : [
    "codeql-cli-2.15.4"
  ],
  "copyright" : "Copyright (C) 201[9](https://github.com/testcontainers/testcontainers-go/actions/runs/7450719386/job/20270252456?pr=2080#step:5:9)-2023 GitHub, Inc.",
  "unpackedLocation" : "/opt/hostedtoolcache/CodeQL/2.15.4/x64/codeql",
  "configFileLocation" : "/home/runner/.config/codeql/config",
  "configFileFound" : false,
  "features" : {
    "analysisSummaryV2Option" : true,
    "featuresInVersionResult" : true,
    "indirectTracingSupportsStaticBinaries" : false,
    "supportsPython3[12](https://github.com/testcontainers/testcontainers-go/actions/runs/7450719386/job/20270252456?pr=2080#step:5:12)" : true,
    "mrvaPackCreate" : true,
    "threatModelOption" : true
  }
}
Error: Cannot read properties of undefined (reading 'length')

This was the bump PR, generated by @dependabot and adjusted in the comments by me: https://github.com/testcontainers/testcontainers-go/pull/2056/files

Is it a bug or the applied @dependabot patch was incorrect? Thanks in advance

[adityasharad]

Thanks for asking. Looking at https://github.com/testcontainers/testcontainers-go/pull/2056/files, I see your workflows are using a mix of versions of the CodeQL Action in different steps, which are not compatible with each other within the same workflow. In particular, the github/codeql-action/init step is using the latest v3, while all the other steps are pinned to v2.22.12.

I recommend any one of the following:

• Consistently using the latest version of v3, e.g. github/codeql-action/init@v3, github/codeql-action/autobuild@v3, github/codeql-action/analyze@v3, github/codeql-action/upload-sarif@v3. Dependabot will only be needed for major version updates in this case. OR
• Consistently using a pinned version of v3, e.g. github/codeql-action/init@e5f05b81d5b6ff8cfa111c80c22c5fd02a384118 # v3.23.0 and so on in all the steps. Dependabot will handle all version updates for you in this case.

[mdelapenya]

Thanks @adityasharad, I was looking at that too, but wanted to double check because "why not trusting dependabot?" 😅

I'm going to force the same version for all the actions, thanks for your support

[mdelapenya]

I'm closing the issue, as I fixed it bumping the versions with alignment.

Thanks!