github/codeql-action
1
0
Fork 0
mirror of https://github.com/github/codeql-action.git synced 2026-11-05 04:29:40 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge remote-tracking branch 'origin/main' into mbg/ci/typecheck

Browse Source
This commit is contained in:
Michael B. Gale
2026-10-30 16:24:52 +00:00
parent 0aaf198c56 255c50d4d6
commit 8e175f388e
108 changed files with 16872 additions and 7270 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
.github/actions/release-initialise/action.yml vendored
View File

@@ -16,7 +16,7 @@ runs:
shell: bash
- name: Set up Node
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
with:
node-version: 24
cache: 'npm'

8
.github/dependabot.yml vendored
View File

@@ -16,6 +16,14 @@ updates:
# This might be fixed when we move to eslint v9.
- dependency-name: "eslint-plugin-import"
versions: [">=2.30.0"]
# Some of our dependencies are lagging behind with support for new versions of
# `undici` which is why we have to override it in `package.json`. Dependabot
# workflows fail when they try to update a dependency that is explicitly
# overriden. Since this happens somewhat routinely at the moment, we are
# excluding `undici` here and have to manually update it when needed.
- dependency-name: "undici"
versions: [">=7.30.1"]
groups:
npm-minor:
patterns:

6
.github/workflows/__all-platform-bundle.yml generated vendored
View File

@@ -54,11 +54,11 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: nightly-latest
- os: macos-latest-xlarge
- os: macos-26-xlarge
version: nightly-latest
- os: windows-latest
- os: windows-2025
version: nightly-latest
name: All-platform bundle
if: github.triggering_actor != 'dependabot[bot]'

16
.github/workflows/__analysis-kinds.yml generated vendored
View File

@@ -34,28 +34,28 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
analysis-kinds: code-scanning
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
analysis-kinds: code-quality
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
analysis-kinds: code-scanning,code-quality
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
analysis-kinds: risk-assessment
- os: ubuntu-latest
- os: ubuntu-26.04
version: nightly-latest
analysis-kinds: code-scanning
- os: ubuntu-latest
- os: ubuntu-26.04
version: nightly-latest
analysis-kinds: code-quality
- os: ubuntu-latest
- os: ubuntu-26.04
version: nightly-latest
analysis-kinds: code-scanning,code-quality
- os: ubuntu-latest
- os: ubuntu-26.04
version: nightly-latest
analysis-kinds: risk-assessment
name: Analysis kinds

2
.github/workflows/__analyze-ref-input.yml generated vendored
View File

@@ -54,7 +54,7 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: default
name: "Analyze: 'ref' and 'sha' from inputs"
if: github.triggering_actor != 'dependabot[bot]'

6
.github/workflows/__autobuild-action.yml generated vendored
View File

@@ -44,11 +44,11 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
- os: macos-latest
- os: macos-26
version: linked
- os: windows-latest
- os: windows-2025
version: linked
name: autobuild-action
if: github.triggering_actor != 'dependabot[bot]'

8
.github/workflows/__autobuild-direct-tracing-with-working-dir.yml generated vendored
View File

@@ -44,13 +44,13 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
- os: windows-latest
- os: windows-2025
version: linked
- os: ubuntu-latest
- os: ubuntu-26.04
version: nightly-latest
- os: windows-latest
- os: windows-2025
version: nightly-latest
name: Autobuild direct tracing (custom working directory)
if: github.triggering_actor != 'dependabot[bot]'

2
.github/workflows/__autobuild-working-dir.yml generated vendored
View File

@@ -34,7 +34,7 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
name: Autobuild working directory
if: github.triggering_actor != 'dependabot[bot]'

8
.github/workflows/__build-mode-autobuild.yml generated vendored
View File

@@ -44,13 +44,13 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
- os: windows-latest
- os: windows-2025
version: linked
- os: ubuntu-latest
- os: ubuntu-26.04
version: nightly-latest
- os: windows-latest
- os: windows-2025
version: nightly-latest
name: Build mode autobuild
if: github.triggering_actor != 'dependabot[bot]'

2
.github/workflows/__build-mode-manual.yml generated vendored
View File

@@ -54,7 +54,7 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: nightly-latest
name: Build mode manual
if: github.triggering_actor != 'dependabot[bot]'

4
.github/workflows/__build-mode-none.yml generated vendored
View File

@@ -34,9 +34,9 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
- os: ubuntu-latest
- os: ubuntu-26.04
version: nightly-latest
name: Build mode none
if: github.triggering_actor != 'dependabot[bot]'

2
.github/workflows/__build-mode-rollback.yml generated vendored
View File

@@ -34,7 +34,7 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: nightly-latest
name: Build mode rollback
if: github.triggering_actor != 'dependabot[bot]'

2
.github/workflows/__bundle-from-nightly.yml generated vendored
View File

@@ -34,7 +34,7 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
name: 'Bundle: From nightly'
if: github.triggering_actor != 'dependabot[bot]'

2
.github/workflows/__bundle-from-toolcache.yml generated vendored
View File

@@ -34,7 +34,7 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: toolcache
name: 'Bundle: From toolcache'
if: github.triggering_actor != 'dependabot[bot]'

6
.github/workflows/__bundle-toolcache.yml generated vendored
View File

@@ -34,11 +34,11 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
- os: macos-latest
- os: macos-26
version: linked
- os: windows-latest
- os: windows-2025
version: linked
name: 'Bundle: Caching checks'
if: github.triggering_actor != 'dependabot[bot]'

2
.github/workflows/__cleanup-db-cluster-dir.yml generated vendored
View File

@@ -34,7 +34,7 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
name: Clean up database cluster directory
if: github.triggering_actor != 'dependabot[bot]'

4
.github/workflows/__config-export.yml generated vendored
View File

@@ -34,9 +34,9 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
- os: ubuntu-latest
- os: ubuntu-26.04
version: nightly-latest
name: Config export
if: github.triggering_actor != 'dependabot[bot]'

2
.github/workflows/__config-input.yml generated vendored
View File

@@ -34,7 +34,7 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
name: Config input
if: github.triggering_actor != 'dependabot[bot]'

6
.github/workflows/__cpp-deptrace-disabled.yml generated vendored
View File

@@ -34,11 +34,11 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
- os: ubuntu-latest
- os: ubuntu-26.04
version: default
- os: ubuntu-latest
- os: ubuntu-26.04
version: nightly-latest
name: 'C/C++: disabling autoinstalling dependencies (Linux)'
if: github.triggering_actor != 'dependabot[bot]'

4
.github/workflows/__cpp-deptrace-enabled-on-macos.yml generated vendored
View File

@@ -34,9 +34,9 @@ jobs:
fail-fast: false
matrix:
include:
- os: macos-latest
- os: macos-26
version: linked
- os: macos-latest
- os: macos-26
version: nightly-latest
name: 'C/C++: autoinstalling dependencies is skipped (macOS)'
if: github.triggering_actor != 'dependabot[bot]'

6
.github/workflows/__cpp-deptrace-enabled.yml generated vendored
View File

@@ -34,11 +34,11 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
- os: ubuntu-latest
- os: ubuntu-26.04
version: default
- os: ubuntu-latest
- os: ubuntu-26.04
version: nightly-latest
name: 'C/C++: autoinstalling dependencies (Linux)'
if: github.triggering_actor != 'dependabot[bot]'

4
.github/workflows/__diagnostics-export.yml generated vendored
View File

@@ -34,9 +34,9 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
- os: ubuntu-latest
- os: ubuntu-26.04
version: nightly-latest
name: Diagnostic export
if: github.triggering_actor != 'dependabot[bot]'

6
.github/workflows/__diagnostics-without-db.yml generated vendored
View File

@@ -34,7 +34,7 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
name: Diagnostic export without database
if: github.triggering_actor != 'dependabot[bot]'
@@ -108,7 +108,7 @@ jobs:
contents: read
security-events: read
timeout-minutes: 5
runs-on: ubuntu-latest
runs-on: ubuntu-26.04
steps:
- name: Check out repository
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -122,7 +122,7 @@ jobs:
- name: Install dependencies
run: npm ci
- name: Download workflow artifact
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
with:
pattern: test-mode-sarif-*
path: sarif

6
.github/workflows/__export-file-baseline-information.yml generated vendored
View File

@@ -54,11 +54,11 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: nightly-latest
- os: macos-latest
- os: macos-26
version: nightly-latest
- os: windows-latest
- os: windows-2025
version: nightly-latest
name: Export file baseline information
if: github.triggering_actor != 'dependabot[bot]'

2
.github/workflows/__extractor-ram-threads.yml generated vendored
View File

@@ -34,7 +34,7 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
name: Extractor ram and threads options test
if: github.triggering_actor != 'dependabot[bot]'

4
.github/workflows/__global-proxy.yml generated vendored
View File

@@ -34,9 +34,9 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
- os: ubuntu-latest
- os: ubuntu-26.04
version: nightly-latest
name: Proxy test
if: github.triggering_actor != 'dependabot[bot]'

4
.github/workflows/__go-custom-queries.yml generated vendored
View File

@@ -54,9 +54,9 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
- os: ubuntu-latest
- os: ubuntu-26.04
version: nightly-latest
name: 'Go: Custom queries'
if: github.triggering_actor != 'dependabot[bot]'

2
.github/workflows/__go-indirect-tracing-workaround-diagnostic.yml generated vendored
View File

@@ -44,7 +44,7 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: default
name: 'Go: diagnostic when Go is changed after init step'
if: github.triggering_actor != 'dependabot[bot]'

2
.github/workflows/__go-indirect-tracing-workaround-no-file-program.yml generated vendored
View File

@@ -44,7 +44,7 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: default
name: 'Go: diagnostic when `file` is not installed'
if: github.triggering_actor != 'dependabot[bot]'

2
.github/workflows/__go-indirect-tracing-workaround.yml generated vendored
View File

@@ -44,7 +44,7 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: default
name: 'Go: workaround for indirect tracing'
if: github.triggering_actor != 'dependabot[bot]'

20
.github/workflows/__go-tracing-autobuilder.yml generated vendored
View File

@@ -46,25 +46,25 @@ jobs:
include:
- os: ubuntu-24.04
version: stable-v2.20.7
- os: ubuntu-latest
- os: ubuntu-26.04
version: stable-v2.21.4
- os: ubuntu-latest
- os: ubuntu-26.04
version: stable-v2.22.4
- os: ubuntu-latest
- os: ubuntu-26.04
version: stable-v2.23.9
- os: ubuntu-latest
- os: ubuntu-26.04
version: stable-v2.24.3
- os: ubuntu-latest
- os: ubuntu-26.04
version: stable-v2.25.6
- os: ubuntu-latest
- os: ubuntu-26.04
version: default
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
- os: macos-latest
- os: macos-26
version: linked
- os: ubuntu-latest
- os: ubuntu-26.04
version: nightly-latest
- os: macos-latest
- os: macos-26
version: nightly-latest
name: 'Go: tracing with autobuilder step'
if: github.triggering_actor != 'dependabot[bot]'

20
.github/workflows/__go-tracing-custom-build-steps.yml generated vendored
View File

@@ -46,25 +46,25 @@ jobs:
include:
- os: ubuntu-24.04
version: stable-v2.20.7
- os: ubuntu-latest
- os: ubuntu-26.04
version: stable-v2.21.4
- os: ubuntu-latest
- os: ubuntu-26.04
version: stable-v2.22.4
- os: ubuntu-latest
- os: ubuntu-26.04
version: stable-v2.23.9
- os: ubuntu-latest
- os: ubuntu-26.04
version: stable-v2.24.3
- os: ubuntu-latest
- os: ubuntu-26.04
version: stable-v2.25.6
- os: ubuntu-latest
- os: ubuntu-26.04
version: default
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
- os: macos-latest
- os: macos-26
version: linked
- os: ubuntu-latest
- os: ubuntu-26.04
version: nightly-latest
- os: macos-latest
- os: macos-26
version: nightly-latest
name: 'Go: tracing with custom build steps'
if: github.triggering_actor != 'dependabot[bot]'

20
.github/workflows/__go-tracing-legacy-workflow.yml generated vendored
View File

@@ -46,25 +46,25 @@ jobs:
include:
- os: ubuntu-24.04
version: stable-v2.20.7
- os: ubuntu-latest
- os: ubuntu-26.04
version: stable-v2.21.4
- os: ubuntu-latest
- os: ubuntu-26.04
version: stable-v2.22.4
- os: ubuntu-latest
- os: ubuntu-26.04
version: stable-v2.23.9
- os: ubuntu-latest
- os: ubuntu-26.04
version: stable-v2.24.3
- os: ubuntu-latest
- os: ubuntu-26.04
version: stable-v2.25.6
- os: ubuntu-latest
- os: ubuntu-26.04
version: default
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
- os: macos-latest
- os: macos-26
version: linked
- os: ubuntu-latest
- os: ubuntu-26.04
version: nightly-latest
- os: macos-latest
- os: macos-26
version: nightly-latest
name: 'Go: tracing with legacy workflow'
if: github.triggering_actor != 'dependabot[bot]'

6
.github/workflows/__init-with-registries.yml generated vendored
View File

@@ -34,11 +34,11 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: default
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
- os: ubuntu-latest
- os: ubuntu-26.04
version: nightly-latest
name: 'Packaging: Download using registries'
if: github.triggering_actor != 'dependabot[bot]'

6
.github/workflows/__javascript-source-root.yml generated vendored
View File

@@ -34,11 +34,11 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
- os: ubuntu-latest
- os: ubuntu-26.04
version: default
- os: ubuntu-latest
- os: ubuntu-26.04
version: nightly-latest
name: Custom source root
if: github.triggering_actor != 'dependabot[bot]'

2
.github/workflows/__job-run-uuid-sarif.yml generated vendored
View File

@@ -34,7 +34,7 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: nightly-latest
name: Job run UUID added to SARIF
if: github.triggering_actor != 'dependabot[bot]'

2
.github/workflows/__language-aliases.yml generated vendored
View File

@@ -34,7 +34,7 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
name: Language aliases
if: github.triggering_actor != 'dependabot[bot]'

2
.github/workflows/__local-bundle.yml generated vendored
View File

@@ -54,7 +54,7 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
name: Local CodeQL bundle
if: github.triggering_actor != 'dependabot[bot]'

30
.github/workflows/__multi-language-autodetect.yml generated vendored
View File

@@ -58,37 +58,37 @@ jobs:
version: stable-v2.20.7
- os: macos-15-xlarge
version: stable-v2.20.7
- os: ubuntu-latest
- os: ubuntu-26.04
version: stable-v2.21.4
- os: macos-15-xlarge
version: stable-v2.21.4
- os: ubuntu-latest
- os: ubuntu-26.04
version: stable-v2.22.4
- os: macos-15-xlarge
version: stable-v2.22.4
- os: ubuntu-latest
- os: ubuntu-26.04
version: stable-v2.23.9
- os: macos-latest-xlarge
- os: macos-26-xlarge
version: stable-v2.23.9
- os: ubuntu-latest
- os: ubuntu-26.04
version: stable-v2.24.3
- os: macos-latest-xlarge
- os: macos-26-xlarge
version: stable-v2.24.3
- os: ubuntu-latest
- os: ubuntu-26.04
version: stable-v2.25.6
- os: macos-latest-xlarge
- os: macos-26-xlarge
version: stable-v2.25.6
- os: ubuntu-latest
- os: ubuntu-26.04
version: default
- os: macos-latest-xlarge
- os: macos-26-xlarge
version: default
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
- os: macos-latest-xlarge
- os: macos-26-xlarge
version: linked
- os: ubuntu-latest
- os: ubuntu-26.04
version: nightly-latest
- os: macos-latest-xlarge
- os: macos-26-xlarge
version: nightly-latest
name: Multi-language repository
if: github.triggering_actor != 'dependabot[bot]'
@@ -121,7 +121,7 @@ jobs:
# imports `importlib._bootstrap._ERR_MSG`, which those Python versions no longer define.
# See https://github.com/github/codeql-action/pull/3212
if: matrix.version != 'nightly-latest' && matrix.version != 'linked'
uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
with:
python-version: '3.13.15'

4
.github/workflows/__overlay-init-fallback.yml generated vendored
View File

@@ -34,9 +34,9 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
- os: ubuntu-latest
- os: ubuntu-26.04
version: nightly-latest
name: Overlay database init fallback
if: github.triggering_actor != 'dependabot[bot]'

6
.github/workflows/__packaging-codescanning-config-inputs-js.yml generated vendored
View File

@@ -54,11 +54,11 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
- os: ubuntu-latest
- os: ubuntu-26.04
version: default
- os: ubuntu-latest
- os: ubuntu-26.04
version: nightly-latest
name: 'Packaging: Config and input passed to the CLI'
if: github.triggering_actor != 'dependabot[bot]'

6
.github/workflows/__packaging-config-inputs-js.yml generated vendored
View File

@@ -54,11 +54,11 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
- os: ubuntu-latest
- os: ubuntu-26.04
version: default
- os: ubuntu-latest
- os: ubuntu-26.04
version: nightly-latest
name: 'Packaging: Config and input'
if: github.triggering_actor != 'dependabot[bot]'

6
.github/workflows/__packaging-config-js.yml generated vendored
View File

@@ -54,11 +54,11 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
- os: ubuntu-latest
- os: ubuntu-26.04
version: default
- os: ubuntu-latest
- os: ubuntu-26.04
version: nightly-latest
name: 'Packaging: Config file'
if: github.triggering_actor != 'dependabot[bot]'

6
.github/workflows/__packaging-inputs-js.yml generated vendored
View File

@@ -54,11 +54,11 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
- os: ubuntu-latest
- os: ubuntu-26.04
version: default
- os: ubuntu-latest
- os: ubuntu-26.04
version: nightly-latest
name: 'Packaging: Action input'
if: github.triggering_actor != 'dependabot[bot]'

20
.github/workflows/__per-language-bundle-validation.yml generated vendored
View File

@@ -35,40 +35,40 @@ jobs:
matrix:
include:
- language: actions
os: ubuntu-latest
os: ubuntu-26.04
version: linked
expected-extractors: actions javascript
- language: cpp
os: ubuntu-latest
os: ubuntu-26.04
version: linked
build-mode: manual
build-command: gcc -o main main.c
- language: csharp
os: ubuntu-latest
os: ubuntu-26.04
version: linked
build-mode: none
- language: go
os: ubuntu-latest
os: ubuntu-26.04
version: linked
build-mode: autobuild
- language: java
os: ubuntu-latest
os: ubuntu-26.04
version: linked
build-mode: none
- language: javascript
os: ubuntu-latest
os: ubuntu-26.04
version: linked
- language: python
os: ubuntu-latest
os: ubuntu-26.04
version: linked
- language: ruby
os: ubuntu-latest
os: ubuntu-26.04
version: linked
- language: rust
os: ubuntu-latest
os: ubuntu-26.04
version: linked
- language: swift
os: macos-latest-xlarge
os: macos-26-xlarge
version: linked
build-mode: autobuild
name: Per-language bundles

4
.github/workflows/__remote-config.yml generated vendored
View File

@@ -54,9 +54,9 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
- os: ubuntu-latest
- os: ubuntu-26.04
version: nightly-latest
name: Remote config file
if: github.triggering_actor != 'dependabot[bot]'

6
.github/workflows/__resolve-environment-action.yml generated vendored
View File

@@ -34,11 +34,11 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
- os: ubuntu-latest
- os: ubuntu-26.04
version: default
- os: ubuntu-latest
- os: ubuntu-26.04
version: nightly-latest
name: Resolve environment
if: github.triggering_actor != 'dependabot[bot]'

12
.github/workflows/__ruby.yml generated vendored
View File

@@ -34,17 +34,17 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
- os: macos-latest
- os: macos-26
version: linked
- os: ubuntu-latest
- os: ubuntu-26.04
version: default
- os: macos-latest
- os: macos-26
version: default
- os: ubuntu-latest
- os: ubuntu-26.04
version: nightly-latest
- os: macos-latest
- os: macos-26
version: nightly-latest
name: Ruby analysis
if: github.triggering_actor != 'dependabot[bot]'

8
.github/workflows/__rust.yml generated vendored
View File

@@ -36,13 +36,13 @@ jobs:
include:
- os: ubuntu-24.04
version: stable-v2.20.7
- os: ubuntu-latest
- os: ubuntu-26.04
version: stable-v2.22.1
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
- os: ubuntu-latest
- os: ubuntu-26.04
version: default
- os: ubuntu-latest
- os: ubuntu-26.04
version: nightly-latest
name: Rust analysis
if: github.triggering_actor != 'dependabot[bot]'

12
.github/workflows/__split-workflow.yml generated vendored
View File

@@ -54,17 +54,17 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
- os: macos-latest
- os: macos-26
version: linked
- os: ubuntu-latest
- os: ubuntu-26.04
version: default
- os: macos-latest
- os: macos-26
version: default
- os: ubuntu-latest
- os: ubuntu-26.04
version: nightly-latest
- os: macos-latest
- os: macos-26
version: nightly-latest
name: Split workflow
if: github.triggering_actor != 'dependabot[bot]'

6
.github/workflows/__start-proxy.yml generated vendored
View File

@@ -34,11 +34,11 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
- os: macos-latest
- os: macos-26
version: linked
- os: windows-latest
- os: windows-2025
version: linked
name: Start proxy
if: github.triggering_actor != 'dependabot[bot]'

6
.github/workflows/__submit-sarif-failure.yml generated vendored
View File

@@ -34,11 +34,11 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
- os: ubuntu-latest
- os: ubuntu-26.04
version: default
- os: ubuntu-latest
- os: ubuntu-26.04
version: nightly-latest
name: Submit SARIF after failure
if: github.triggering_actor != 'dependabot[bot]'

2
.github/workflows/__swift-autobuild.yml generated vendored
View File

@@ -34,7 +34,7 @@ jobs:
fail-fast: false
matrix:
include:
- os: macos-latest-xlarge
- os: macos-26-xlarge
version: nightly-latest
name: Swift analysis using autobuild
if: github.triggering_actor != 'dependabot[bot]'

6
.github/workflows/__swift-custom-build.yml generated vendored
View File

@@ -54,11 +54,11 @@ jobs:
fail-fast: false
matrix:
include:
- os: macos-latest-xlarge
- os: macos-26-xlarge
version: linked
- os: macos-latest-xlarge
- os: macos-26-xlarge
version: default
- os: macos-latest-xlarge
- os: macos-26-xlarge
version: nightly-latest
name: Swift analysis using a custom build command
if: github.triggering_actor != 'dependabot[bot]'

4
.github/workflows/__unset-environment.yml generated vendored
View File

@@ -54,9 +54,9 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
- os: ubuntu-latest
- os: ubuntu-26.04
version: nightly-latest
name: Test unsetting environment variables
if: github.triggering_actor != 'dependabot[bot]'

135
.github/workflows/__unsupported-macos.yml generated vendored Normal file
View File

@@ -0,0 +1,135 @@
# Warning: This file is generated automatically, and should not be modified.
# Instead, please modify the template in the pr-checks directory and run:
# pr-checks/sync.sh
# to regenerate this file.
name: PR Check - Unsupported macOS
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
GO111MODULE: auto
on:
push:
branches:
- main
- releases/v*
pull_request: {}
merge_group:
types:
- checks_requested
schedule:
- cron: '0 5 * * *'
workflow_dispatch:
inputs: {}
workflow_call:
inputs: {}
defaults:
run:
shell: bash
concurrency:
cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
group: unsupported-macos-${{github.ref}}
jobs:
unsupported-macos:
strategy:
fail-fast: false
matrix:
include:
- os: xcode-27
version: linked
- os: xcode-27
version: nightly-latest
name: Unsupported macOS
if: github.triggering_actor != 'dependabot[bot]'
permissions:
contents: read
security-events: read
timeout-minutes: 45
runs-on: ${{ matrix.os }}
steps:
- name: Check out repository
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Install Node.js
uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
with:
node-version: 20.x
cache: npm
- name: Install newer npm
run: npm install -g npm@11.19.1
- name: Install dependencies
run: npm ci
- name: Prepare test
id: prepare-test
uses: ./.github/actions/prepare-test
with:
version: ${{ matrix.version }}
use-all-platform-bundle: 'false'
setup-kotlin: 'true'
- name: Check xcode_select_link
run: |
readlink /private/var/db/xcode_select_link
file -h /private/var/db/xcode_select_link
- uses: ./../action/init
id: init
continue-on-error: true
env:
CODEQL_ACTION_CHECK_UNSUPPORTED_TRACED_ANALYSIS: true
CODEQL_ACTION_ABORT_UNSUPPORTED_TRACED_ANALYSIS: true
with:
languages: swift
tools: ${{ steps.prepare-test.outputs.tools-url }}
- name: Analyze
# We could run `analyze` here from `./../analyze`, but `getAnalyzeActionName` in `workflow.ts`
# can't cope with that unless we introduce a different testing environment. Since this step
# would just fail on `xcode-27` anyway, we just skip it instead.
if: false
uses: ./analyze
with:
category: '/test-codeql-version:${{ matrix.version }}'
env:
CODEQL_ACTION_SKIP_GENERATE_FAILED_SARIF: false
CODEQL_ACTION_SKIP_SARIF_UPLOAD: true
CODEQL_ACTION_TESTING_ENVIRONMENT: codeql-action-pr-checks
CODEQL_ACTION_TEST_MODE: true
unsupported-macos-sarif-checks:
if: github.triggering_actor != 'dependabot[bot]'
needs:
- unsupported-macos
permissions:
contents: read
security-events: read
timeout-minutes: 5
runs-on: ubuntu-26.04
steps:
- name: Check out repository
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Install Node.js
uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
with:
node-version: 20.x
cache: npm
- name: Install newer npm
run: npm install -g npm@11.19.1
- name: Install dependencies
run: npm ci
- name: Download workflow artifact
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with:
pattern: test-mode-sarif-*
path: sarif
- name: List artifact contents
run: ls -laR ./sarif
- name: Check diagnostics appear in SARIF
env:
SARIF_PATH: "./sarif/"
DIAGNOSTIC_ID: "codeql-action/unsupported-traced-analysis-macos"
DIAGNOSTIC_NAME: "Traced analysis is not supported on this version of macOS"
EXPECTED_LOCATIONS: "0"
EXPECTED_MESSAGE: |
Traced analysis is not supported on macOS 27 or above.
run: npx tsx ./pr-checks/check-diagnostics.ts
env:
CODEQL_ACTION_TEST_MODE: true

2
.github/workflows/__upload-ref-sha-input.yml generated vendored
View File

@@ -54,7 +54,7 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: default
name: "Upload-sarif: 'ref' and 'sha' from inputs"
if: github.triggering_actor != 'dependabot[bot]'

6
.github/workflows/__upload-sarif.yml generated vendored
View File

@@ -54,13 +54,13 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: default
analysis-kinds: code-scanning
- os: ubuntu-latest
- os: ubuntu-26.04
version: default
analysis-kinds: code-quality
- os: ubuntu-latest
- os: ubuntu-26.04
version: default
analysis-kinds: code-scanning,code-quality
name: Test different uses of `upload-sarif`

2
.github/workflows/__with-checkout-path.yml generated vendored
View File

@@ -54,7 +54,7 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
name: Use a custom `checkout_path`
if: github.triggering_actor != 'dependabot[bot]'

4
.github/workflows/codeql.yml vendored
View File

@@ -22,7 +22,7 @@ jobs:
# Identify the CodeQL tool versions to use in the analysis job.
check-codeql-versions:
if: github.triggering_actor != 'dependabot[bot]'
runs-on: ubuntu-latest
runs-on: ubuntu-26.04
outputs:
versions: ${{ steps.compare.outputs.versions }}
@@ -106,7 +106,7 @@ jobs:
analyze-other:
if: github.triggering_actor != 'dependabot[bot]'
runs-on: ubuntu-latest
runs-on: ubuntu-26.04
strategy:
fail-fast: false

6
.github/workflows/codescanning-config-cli.yml vendored
View File

@@ -41,11 +41,11 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
- os: ubuntu-latest
- os: ubuntu-26.04
version: default
- os: ubuntu-latest
- os: ubuntu-26.04
version: nightly-latest
# Code-Scanning config not created because environment variable is not set

5
.github/workflows/debug-artifacts-failure-safe.yml vendored
View File

@@ -47,7 +47,7 @@ jobs:
# stable-v2.20.7 requires an older version of Java than the default on `ubuntu-latest` (`ubuntu-26.04`).
# We could install that older version on the newer runners, or use the older runner.
# We do the latter here. This can be removed once we stop supporting `v2.20.7`.
runs-on: ${{ case(matrix.version == 'stable-v2.20.7', 'ubuntu-24.04', 'ubuntu-latest') }}
runs-on: ${{ case(matrix.version == 'stable-v2.20.7', 'ubuntu-24.04', 'ubuntu-26.04') }}
steps:
- name: Dump GitHub event
@@ -91,12 +91,13 @@ jobs:
timeout-minutes: 45
permissions:
contents: read
runs-on: ubuntu-latest
runs-on: ubuntu-26.04
steps:
- name: Download all artifacts
uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
- name: Check expected artifacts exist
run: |
VERSIONS="stable-v2.20.7 default linked nightly-latest"
LANGUAGES="cpp csharp go java javascript python"
for version in $VERSIONS; do
echo "Artifacts from version $version:"

4
.github/workflows/debug-artifacts-safe.yml vendored
View File

@@ -45,7 +45,7 @@ jobs:
# stable-v2.20.7 requires an older version of Java than the default on `ubuntu-latest` (`ubuntu-26.04`).
# We could install that older version on the newer runners, or use the older runner.
# We do the latter here. This can be removed once we stop supporting `v2.20.7`.
runs-on: ${{ case(matrix.version == 'stable-v2.20.7', 'ubuntu-24.04', 'ubuntu-latest') }}
runs-on: ${{ case(matrix.version == 'stable-v2.20.7', 'ubuntu-24.04', 'ubuntu-26.04') }}
steps:
- name: Check out repository
@@ -84,7 +84,7 @@ jobs:
timeout-minutes: 45
permissions:
contents: read
runs-on: ubuntu-latest
runs-on: ubuntu-26.04
steps:
- name: Download all artifacts
uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2

10
.github/workflows/post-release-mergeback.yml vendored
View File

@@ -10,7 +10,7 @@ on:
workflow_dispatch:
inputs:
baseBranch:
description: 'The base branch to merge into'
description: "The base branch to merge into"
default: main
required: false
@@ -24,7 +24,7 @@ defaults:
jobs:
merge-back:
runs-on: ubuntu-latest
runs-on: ubuntu-26.04
environment: Automation
if: github.repository == 'github/codeql-action'
env:
@@ -41,16 +41,16 @@ jobs:
- name: Dump GitHub context
env:
GITHUB_CONTEXT: '${{ toJson(github) }}'
GITHUB_CONTEXT: "${{ toJson(github) }}"
run: echo "${GITHUB_CONTEXT}"
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
fetch-depth: 0 # ensure we have all tags and can push commits
fetch-depth: 0 # ensure we have all tags and can push commits
- uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
with:
node-version: 24
cache: 'npm'
cache: "npm"
- name: Install JavaScript dependencies
run: npm ci

8
.github/workflows/pr-checks.yml vendored
View File

@@ -25,7 +25,7 @@ jobs:
strategy:
fail-fast: false
matrix:
os: [ubuntu-latest, macos-latest, windows-latest]
os: [ubuntu-26.04, macos-26, windows-2025]
node-version: [20, 24]
permissions:
contents: read
@@ -71,7 +71,7 @@ jobs:
run: npm test
- name: Lint
if: always() && matrix.os != 'windows-latest'
if: always() && matrix.os != 'windows-2025'
run: npm run lint-ci
- name: Upload sarif
@@ -81,7 +81,7 @@ jobs:
# paired `push` run that the queue branch creates use that ref, so gate on the ref itself
# rather than the event. The same results are uploaded by the `pull_request` run and again
# by the `push` run on `main`.
if: matrix.os == 'ubuntu-latest' && matrix.node-version == 24 && !startsWith(github.ref, 'refs/heads/gh-readonly-queue/')
if: matrix.os == 'ubuntu-26.04' && matrix.node-version == 24 && !startsWith(github.ref, 'refs/heads/gh-readonly-queue/')
with:
sarif_file: eslint.sarif
category: eslint
@@ -93,7 +93,7 @@ jobs:
if: github.triggering_actor != 'dependabot[bot]'
permissions:
contents: read
runs-on: ubuntu-latest
runs-on: ubuntu-26.04
timeout-minutes: 10
concurrency:

19
.github/workflows/pr-dequeued.yml vendored
View File

@@ -21,8 +21,23 @@ jobs:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
PR_NUMBER: ${{ github.event.pull_request.number }}
REASON: ${{ github.event.reason }}
USER: ${{ github.event.pull_request.user.login }}
run: |
echo "@$USER The pull request was removed from the merge queue (\`$REASON\`)." \
# Mention whoever added the PR to the merge queue rather than the PR author, who may be a
# bot such as Dependabot. The `dequeued` event payload doesn't identify the enqueuer, so
# look them up in the most recent `AddedToMergeQueueEvent` on the PR's timeline.
enqueuer=$(gh api graphql \
-F number="$PR_NUMBER" \
-f query='
query($number: Int!) {
repository(owner: "github", name: "codeql-action") {
pullRequest(number: $number) {
timelineItems(itemTypes: [ADDED_TO_MERGE_QUEUE_EVENT], last: 1) {
nodes { ... on AddedToMergeQueueEvent { enqueuer { login } } }
}
}
}
}' \
--jq '.data.repository.pullRequest.timelineItems.nodes[0].enqueuer.login')
echo "@$enqueuer The pull request was removed from the merge queue (\`$REASON\`)." \
"Please resolve any issues if required and enqueue the PR again." |
gh pr comment --body-file - --repo github/codeql-action "$PR_NUMBER"

2
.github/workflows/prepare-release.yml vendored
View File

@@ -29,7 +29,7 @@ defaults:
jobs:
prepare:
name: "Release info"
runs-on: ubuntu-latest
runs-on: ubuntu-26.04
if: github.repository == 'github/codeql-action'
permissions:

4
.github/workflows/python312-windows.yml vendored
View File

@@ -29,10 +29,10 @@ jobs:
contents: read
# We currently need `security-events: read` to access feature flags.
security-events: read
runs-on: windows-latest
runs-on: windows-2025
steps:
- uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
- uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
with:
python-version: 3.12

2
.github/workflows/query-filters.yml vendored
View File

@@ -25,7 +25,7 @@ jobs:
name: Query Filters Tests
if: github.triggering_actor != 'dependabot[bot]'
timeout-minutes: 45
runs-on: ubuntu-latest
runs-on: ubuntu-26.04
permissions:
contents: read # This permission is needed to allow the GitHub Actions workflow to read the contents of the repository.
steps:

4
.github/workflows/rebuild.yml vendored
View File

@@ -12,7 +12,7 @@ defaults:
jobs:
rebuild:
name: Rebuild Action
runs-on: ubuntu-latest
runs-on: ubuntu-26.04
if: github.event.label.name == 'Rebuild' || github.event_name == 'workflow_dispatch'
env:
@@ -33,7 +33,7 @@ jobs:
uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
with:
node-version: 24
cache: 'npm'
cache: "npm"
- name: Remove label
if: github.event_name == 'pull_request'

2
.github/workflows/rollback-release.yml vendored
View File

@@ -34,7 +34,7 @@ jobs:
rollback:
name: "Create rollback release"
if: github.repository == 'github/codeql-action'
runs-on: ubuntu-latest
runs-on: ubuntu-26.04
timeout-minutes: 45
# Don't set the deployment environment for test runs

2
.github/workflows/test-codeql-bundle-all.yml vendored
View File

@@ -27,7 +27,7 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: nightly-latest
name: 'CodeQL Bundle All'
if: github.triggering_actor != 'dependabot[bot]'

2
.github/workflows/update-bundle.yml vendored
View File

@@ -20,7 +20,7 @@ defaults:
jobs:
update-bundle:
if: github.event.release.prerelease && startsWith(github.event.release.tag_name, 'codeql-bundle-')
runs-on: ubuntu-latest
runs-on: ubuntu-26.04
permissions:
contents: write # needed to push commits
pull-requests: write # needed to create pull requests

4
.github/workflows/update-release-branch.yml vendored
View File

@@ -26,7 +26,7 @@ jobs:
update:
name: "Update release branch"
timeout-minutes: 45
runs-on: ubuntu-latest
runs-on: ubuntu-26.04
if: github.event_name == 'workflow_dispatch'
needs: [prepare]
env:
@@ -79,7 +79,7 @@ jobs:
backport:
name: "Create backport"
timeout-minutes: 45
runs-on: ubuntu-latest
runs-on: ubuntu-26.04
environment: Automation
needs: [prepare]
if: ${{ (github.event_name == 'push') && needs.prepare.outputs.backport_target_branches != '[]' }}