diff --git a/.github/actions/prepare-test/action.yml b/.github/actions/prepare-test/action.yml index 5e2b5028f..4c11ec492 100644 --- a/.github/actions/prepare-test/action.yml +++ b/.github/actions/prepare-test/action.yml @@ -6,11 +6,11 @@ inputs: required: true use-all-platform-bundle: description: "If true, we output a tools URL with codeql-bundle.tar.gz file rather than platform-specific URL" - default: 'false' + default: "false" required: false setup-kotlin: description: "If true, we setup kotlin" - default: 'true' + default: "true" required: true outputs: tools-url: @@ -73,7 +73,10 @@ runs: exit 1 fi - - uses: fwilhe2/setup-kotlin@9c245a6425255f5e98ba1ce6c15d31fce7eca9da + - uses: fwilhe2/setup-kotlin@b325539ca8f6e1d9ee04efed06f49bdbf5426dbb # v2.1 if: ${{ inputs.setup-kotlin == 'true' }} with: - version: 1.8.21 + # Kotlin is installed on the runners by default, but the version that is pre-installed is too new + # to be supported by CodeQL. This Kotlin version is selected to be compatible with both the default Java + # version on the `ubuntu-latest` runners and CodeQL. + version: 2.1.20 diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 0e0dd0cce..ae4a4476e 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -26,7 +26,7 @@ updates: - package-ecosystem: github-actions directories: - "/.github/workflows" - - "/.github/actions" + - "/.github/actions/*/" schedule: interval: weekly cooldown: diff --git a/.github/workflows/__go-tracing-autobuilder.yml b/.github/workflows/__go-tracing-autobuilder.yml index fb471c5ea..a36cc43a7 100644 --- a/.github/workflows/__go-tracing-autobuilder.yml +++ b/.github/workflows/__go-tracing-autobuilder.yml @@ -44,7 +44,7 @@ jobs: fail-fast: false matrix: include: - - os: ubuntu-latest + - os: ubuntu-24.04 version: stable-v2.20.7 - os: ubuntu-latest version: stable-v2.21.4 diff --git a/.github/workflows/__go-tracing-custom-build-steps.yml b/.github/workflows/__go-tracing-custom-build-steps.yml index b3b043def..05fedfb03 100644 --- a/.github/workflows/__go-tracing-custom-build-steps.yml +++ b/.github/workflows/__go-tracing-custom-build-steps.yml @@ -44,7 +44,7 @@ jobs: fail-fast: false matrix: include: - - os: ubuntu-latest + - os: ubuntu-24.04 version: stable-v2.20.7 - os: ubuntu-latest version: stable-v2.21.4 diff --git a/.github/workflows/__go-tracing-legacy-workflow.yml b/.github/workflows/__go-tracing-legacy-workflow.yml index 20bdea695..276d4cfda 100644 --- a/.github/workflows/__go-tracing-legacy-workflow.yml +++ b/.github/workflows/__go-tracing-legacy-workflow.yml @@ -44,7 +44,7 @@ jobs: fail-fast: false matrix: include: - - os: ubuntu-latest + - os: ubuntu-24.04 version: stable-v2.20.7 - os: ubuntu-latest version: stable-v2.21.4 diff --git a/.github/workflows/__multi-language-autodetect.yml b/.github/workflows/__multi-language-autodetect.yml index a388e5734..d54b24a1e 100644 --- a/.github/workflows/__multi-language-autodetect.yml +++ b/.github/workflows/__multi-language-autodetect.yml @@ -54,7 +54,7 @@ jobs: fail-fast: false matrix: include: - - os: ubuntu-latest + - os: ubuntu-24.04 version: stable-v2.20.7 - os: macos-15-xlarge version: stable-v2.20.7 diff --git a/.github/workflows/__rubocop-multi-language.yml b/.github/workflows/__rubocop-multi-language.yml deleted file mode 100644 index c3348db6c..000000000 --- a/.github/workflows/__rubocop-multi-language.yml +++ /dev/null @@ -1,74 +0,0 @@ -# Warning: This file is generated automatically, and should not be modified. -# Instead, please modify the template in the pr-checks directory and run: -# pr-checks/sync.sh -# to regenerate this file. - -name: PR Check - RuboCop multi-language -env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - GO111MODULE: auto -on: - push: - branches: - - main - - releases/v* - pull_request: {} - merge_group: - types: - - checks_requested - schedule: - - cron: '0 5 * * *' - workflow_dispatch: - inputs: {} - workflow_call: - inputs: {} -defaults: - run: - shell: bash -concurrency: - cancel-in-progress: ${{ github.event_name == 'pull_request' || false }} - group: rubocop-multi-language-${{github.ref}} -jobs: - rubocop-multi-language: - strategy: - fail-fast: false - matrix: - include: - - os: ubuntu-latest - version: default - name: RuboCop multi-language - if: github.triggering_actor != 'dependabot[bot]' - permissions: - contents: read - security-events: read - timeout-minutes: 45 - runs-on: ${{ matrix.os }} - steps: - - name: Check out repository - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - name: Prepare test - id: prepare-test - uses: ./.github/actions/prepare-test - with: - version: ${{ matrix.version }} - use-all-platform-bundle: 'false' - setup-kotlin: 'true' - - name: Set up Ruby - uses: ruby/setup-ruby@651ff0d62c5c79bed6d53ec518387aae20e72c1a # v1.329.0 - with: - ruby-version: 2.6 - - name: Install Code Scanning integration - run: bundle add code-scanning-rubocop --version 0.3.0 --skip-install - - name: Install dependencies - run: bundle install - - name: RuboCop run - run: | - bash -c " - bundle exec rubocop --require code_scanning --format CodeScanning::SarifFormatter -o rubocop.sarif - [[ $? -ne 2 ]] - " - - uses: ./../action/upload-sarif - with: - sarif_file: rubocop.sarif - env: - CODEQL_ACTION_TEST_MODE: true diff --git a/.github/workflows/__rust.yml b/.github/workflows/__rust.yml index f26b4eb2e..d3b5a8a5b 100644 --- a/.github/workflows/__rust.yml +++ b/.github/workflows/__rust.yml @@ -34,7 +34,7 @@ jobs: fail-fast: false matrix: include: - - os: ubuntu-latest + - os: ubuntu-24.04 version: stable-v2.20.7 - os: ubuntu-latest version: stable-v2.22.1 diff --git a/.github/workflows/debug-artifacts-failure-safe.yml b/.github/workflows/debug-artifacts-failure-safe.yml index c61bd6b17..4f9082acd 100644 --- a/.github/workflows/debug-artifacts-failure-safe.yml +++ b/.github/workflows/debug-artifacts-failure-safe.yml @@ -6,13 +6,13 @@ env: on: push: branches: - - main - - releases/v* + - main + - releases/v* pull_request: merge_group: types: [checks_requested] schedule: - - cron: '0 5 * * *' + - cron: "0 5 * * *" workflow_dispatch: concurrency: @@ -30,10 +30,10 @@ jobs: fail-fast: false matrix: version: - - stable-v2.20.7 - - default - - linked - - nightly-latest + - stable-v2.20.7 + - default + - linked + - nightly-latest name: Upload debug artifacts after failure in analyze continue-on-error: true env: @@ -43,7 +43,12 @@ jobs: # We currently need `security-events: read` to access feature flags. security-events: read timeout-minutes: 45 - runs-on: ubuntu-latest + + # stable-v2.20.7 requires an older version of Java than the default on `ubuntu-latest` (`ubuntu-26.04`). + # We could install that older version on the newer runners, or use the older runner. + # We do the latter here. This can be removed once we stop supporting `v2.20.7`. + runs-on: ${{ case(matrix.version == 'stable-v2.20.7', 'ubuntu-24.04', 'ubuntu-latest') }} + steps: - name: Dump GitHub event run: cat "${GITHUB_EVENT_PATH}" @@ -60,7 +65,7 @@ jobs: - name: Install .NET uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: - dotnet-version: '9.x' + dotnet-version: "9.x" - name: Assert best-effort artifact scan completed uses: ./../action/.github/actions/verify-debug-artifact-scan-completed - uses: ./../action/init diff --git a/.github/workflows/debug-artifacts-safe.yml b/.github/workflows/debug-artifacts-safe.yml index 6d162d9c0..610e1aab8 100644 --- a/.github/workflows/debug-artifacts-safe.yml +++ b/.github/workflows/debug-artifacts-safe.yml @@ -5,13 +5,13 @@ env: on: push: branches: - - main - - releases/v* + - main + - releases/v* pull_request: merge_group: types: [checks_requested] schedule: - - cron: '0 5 * * *' + - cron: "0 5 * * *" workflow_dispatch: concurrency: @@ -29,10 +29,10 @@ jobs: fail-fast: false matrix: version: - - stable-v2.20.7 - - default - - linked - - nightly-latest + - stable-v2.20.7 + - default + - linked + - nightly-latest name: Upload debug artifacts env: CODEQL_ACTION_TEST_MODE: true @@ -41,7 +41,12 @@ jobs: contents: read # We currently need `security-events: read` to access feature flags. security-events: read - runs-on: ubuntu-latest + + # stable-v2.20.7 requires an older version of Java than the default on `ubuntu-latest` (`ubuntu-26.04`). + # We could install that older version on the newer runners, or use the older runner. + # We do the latter here. This can be removed once we stop supporting `v2.20.7`. + runs-on: ${{ case(matrix.version == 'stable-v2.20.7', 'ubuntu-24.04', 'ubuntu-latest') }} + steps: - name: Check out repository uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 @@ -56,7 +61,7 @@ jobs: - name: Install .NET uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: - dotnet-version: '9.x' + dotnet-version: "9.x" - name: Assert best-effort artifact scan completed uses: ./../action/.github/actions/verify-debug-artifact-scan-completed - uses: ./../action/init diff --git a/.github/workflows/deflake.yml b/.github/workflows/deflake.yml index 158dc6c96..27024b378 100644 --- a/.github/workflows/deflake.yml +++ b/.github/workflows/deflake.yml @@ -60,7 +60,6 @@ on: - "PR Check - Proxy test" - "PR Check - Remote config file" - "PR Check - Resolve environment" - - "PR Check - RuboCop multi-language" - "PR Check - Ruby analysis" - "PR Check - Rust analysis" - "PR Check - Split workflow" diff --git a/.github/workflows/pr-dequeued.yml b/.github/workflows/pr-dequeued.yml new file mode 100644 index 000000000..25260c7aa --- /dev/null +++ b/.github/workflows/pr-dequeued.yml @@ -0,0 +1,43 @@ +name: PR dequeued + +on: + pull_request: + types: + - dequeued + +jobs: + notify: + name: Notify + runs-on: ubuntu-slim + + if: github.event.pull_request.merged != true + + permissions: + pull-requests: write + + steps: + - name: Notify that the PR was removed from the merge queue + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + PR_NUMBER: ${{ github.event.pull_request.number }} + REASON: ${{ github.event.reason }} + run: | + # Mention whoever added the PR to the merge queue rather than the PR author, who may be a + # bot such as Dependabot. The `dequeued` event payload doesn't identify the enqueuer, so + # look them up in the most recent `AddedToMergeQueueEvent` on the PR's timeline. + enqueuer=$(gh api graphql \ + -F number="$PR_NUMBER" \ + -f query=' + query($number: Int!) { + repository(owner: "github", name: "codeql-action") { + pullRequest(number: $number) { + timelineItems(itemTypes: [ADDED_TO_MERGE_QUEUE_EVENT], last: 1) { + nodes { ... on AddedToMergeQueueEvent { enqueuer { login } } } + } + } + } + }' \ + --jq '.data.repository.pullRequest.timelineItems.nodes[0].enqueuer.login') + echo "@$enqueuer The pull request was removed from the merge queue (\`$REASON\`)." \ + "Please resolve any issues if required and enqueue the PR again." | + gh pr comment --body-file - --repo github/codeql-action "$PR_NUMBER" diff --git a/README.md b/README.md index 8c4fc4663..d738adcab 100644 --- a/README.md +++ b/README.md @@ -76,7 +76,6 @@ We typically release new minor versions of the CodeQL Action and Bundle when a n | `v4.33.0` | `2.24.3` | Enterprise Server 3.21 | | | `v4.31.10` | `2.23.9` | Enterprise Server 3.20 | | | `v3.29.11` | `2.22.4` | Enterprise Server 3.19 | | -| `v3.28.21` | `2.21.3` | Enterprise Server 3.18 | | See the full list of GHES release and deprecation dates at [GitHub Enterprise Server releases](https://docs.github.com/en/enterprise-server/admin/all-releases#releases-of-github-enterprise-server). diff --git a/lib/entry-points.js b/lib/entry-points.js index 9c9faffc6..a6b351766 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -169382,7 +169382,7 @@ var semver = __toESM(require_semver2()); // src/api-compatibility.json var maximumVersion = "3.23"; -var minimumVersion = "3.18"; +var minimumVersion = "3.19"; // src/json/index.ts function parseString(data) { @@ -176960,9 +176960,9 @@ async function getCombinedTracerConfig(logger2, codeql, config) { // src/codeql.ts var cachedCodeQL = void 0; var CODEQL_MINIMUM_VERSION = "2.20.7"; -var CODEQL_NEXT_MINIMUM_VERSION = "2.21.3"; -var GHES_VERSION_MOST_RECENTLY_DEPRECATED = "3.17"; -var GHES_MOST_RECENT_DEPRECATION_DATE = "2026-09-24"; +var CODEQL_NEXT_MINIMUM_VERSION = "2.22.4"; +var GHES_VERSION_MOST_RECENTLY_DEPRECATED = "3.18"; +var GHES_MOST_RECENT_DEPRECATION_DATE = "2026-10-16"; var EXTRACTION_DEBUG_MODE_VERBOSITY = "progress++"; function isDiskConfigurationError(e) { if (!(e instanceof Error)) { diff --git a/pr-checks/checks/rubocop-multi-language.yml b/pr-checks/checks/rubocop-multi-language.yml deleted file mode 100644 index eec3aa833..000000000 --- a/pr-checks/checks/rubocop-multi-language.yml +++ /dev/null @@ -1,23 +0,0 @@ -name: "RuboCop multi-language" -description: "Tests using RuboCop to analyze a multi-language repository and then using the CodeQL Action to upload the resulting SARIF" -# This check doesn't use CodeQL, so the `version` matrix variable is unused. -versions: - - default -steps: - - name: Set up Ruby - uses: ruby/setup-ruby@651ff0d62c5c79bed6d53ec518387aae20e72c1a # v1.329.0 - with: - ruby-version: 2.6 - - name: Install Code Scanning integration - run: bundle add code-scanning-rubocop --version 0.3.0 --skip-install - - name: Install dependencies - run: bundle install - - name: RuboCop run - run: | - bash -c " - bundle exec rubocop --require code_scanning --format CodeScanning::SarifFormatter -o rubocop.sarif - [[ $? -ne 2 ]] - " - - uses: ./../action/upload-sarif - with: - sarif_file: rubocop.sarif diff --git a/pr-checks/sync.ts b/pr-checks/sync.ts index 1729f5409..c205e94a7 100755 --- a/pr-checks/sync.ts +++ b/pr-checks/sync.ts @@ -137,7 +137,15 @@ interface LanguageSetup { /** Describes partial mappings from built-in languages to their specific setup information. */ type LanguageSetups = Partial>; -// The default set of CodeQL Bundle versions to use for the PR checks. +/** A type representing version identifiers. */ +type Version = + | "default" + | "linked" + | "nightly-latest" + // This is an approximation, but sufficient validation for our needs here. + | `stable-v${number}.${number}.${number}`; + +/** The default set of CodeQL Bundle versions to use for the PR checks. */ const defaultTestVersions = [ // The oldest supported CodeQL version. If bumping, update `CODEQL_MINIMUM_VERSION` in `codeql.ts` "stable-v2.20.7", @@ -159,7 +167,10 @@ const defaultTestVersions = [ "linked", // A nightly build directly from the our private repo, built in the last 24 hours. "nightly-latest", -]; +] as const satisfies Version[]; + +/** A type representing the default test versions. */ +type DefaultTestVersion = (typeof defaultTestVersions)[number]; /** The default versions we use for languages / frameworks, if not specified as a workflow input. */ const defaultLanguageVersions = { @@ -313,9 +324,11 @@ const languageSetups: LanguageSetups = { }, }; -// This is essentially an arbitrary version of `yq`, which happened to be the one that -// `choco` fetched when we moved away from using that here. -// See https://github.com/github/codeql-action/pull/3423 +/** + * This is essentially an arbitrary version of `yq`, which happened to be the one that + * `choco` fetched when we moved away from using that here. + * See https://github.com/github/codeql-action/pull/3423 + */ const YQ_VERSION = "v4.50.1"; const CHECKS_DIR = path.join(PR_CHECKS_DIR, "checks"); @@ -442,10 +455,23 @@ function generateJobMatrix( : [operatingSystemConfig["runner-image"]]; for (const runnerImage of runnerImagesForOs) { - matrix.push({ - os: runnerImage, - version, - }); + // stable-v2.20.7 requires an older version of Java than the default on `ubuntu-latest`. + // We could install that older version on the newer runners, or use the older runner. + // We do the latter here. This can be removed once we stop supporting `v2.20.7`. + // Since this is typed as `DefaultTestVersion`, it will become an error once `stable-v2.20.7` + // is removed from `defaultTestVersions`. + const requiresOlderRunnerImage: DefaultTestVersion = "stable-v2.20.7"; + if ( + runnerImage === "ubuntu-latest" && + version === requiresOlderRunnerImage + ) { + matrix.push({ os: "ubuntu-24.04", version }); + } else { + matrix.push({ + os: runnerImage, + version, + }); + } } } } diff --git a/src/api-compatibility.json b/src/api-compatibility.json index c1122fb2a..83ff180db 100644 --- a/src/api-compatibility.json +++ b/src/api-compatibility.json @@ -1 +1 @@ -{"maximumVersion":"3.23","minimumVersion":"3.18"} +{"maximumVersion":"3.23","minimumVersion":"3.19"} diff --git a/src/codeql.ts b/src/codeql.ts index ba004dde1..8f2d9843e 100644 --- a/src/codeql.ts +++ b/src/codeql.ts @@ -260,17 +260,17 @@ const CODEQL_MINIMUM_VERSION = "2.20.7"; /** * This version will shortly become the oldest version of CodeQL that the Action will run with. */ -const CODEQL_NEXT_MINIMUM_VERSION = "2.21.3"; +const CODEQL_NEXT_MINIMUM_VERSION = "2.22.4"; /** * This is the version of GHES that was most recently deprecated. */ -const GHES_VERSION_MOST_RECENTLY_DEPRECATED = "3.17"; +const GHES_VERSION_MOST_RECENTLY_DEPRECATED = "3.18"; /** * This is the deprecation date for the version of GHES that was most recently deprecated. */ -const GHES_MOST_RECENT_DEPRECATION_DATE = "2026-09-24"; +const GHES_MOST_RECENT_DEPRECATION_DATE = "2026-10-16"; /** The CLI verbosity level to use for extraction in debug mode. */ const EXTRACTION_DEBUG_MODE_VERBOSITY = "progress++"; diff --git a/unreleased-change-notes/ghes-3-18-deprecation.md b/unreleased-change-notes/ghes-3-18-deprecation.md new file mode 100644 index 000000000..0e33d3932 --- /dev/null +++ b/unreleased-change-notes/ghes-3-18-deprecation.md @@ -0,0 +1 @@ +- _Upcoming breaking change_: CodeQL version 2.22.3 and earlier were discontinued on 16 October 2026 alongside GitHub Enterprise Server 3.18, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. [#4266](https://github.com/github/codeql-action/pull/4266)