github/codeql-action
1
0
Fork 0
mirror of https://github.com/github/codeql-action.git synced 2026-11-05 04:29:40 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge remote-tracking branch 'origin/main' into mbg/macos27/xcode-detection

Browse Source
This commit is contained in:
Michael B. Gale
2026-10-30 16:22:57 +00:00
parent 80d7b74bf4 255c50d4d6
commit 9410c4a524
77 changed files with 228 additions and 227 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
.github/workflows/__all-platform-bundle.yml generated vendored
View File

@@ -54,11 +54,11 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: nightly-latest
- os: macos-latest-xlarge
- os: macos-26-xlarge
version: nightly-latest
- os: windows-latest
- os: windows-2025
version: nightly-latest
name: All-platform bundle
if: github.triggering_actor != 'dependabot[bot]'

16
.github/workflows/__analysis-kinds.yml generated vendored
View File

@@ -34,28 +34,28 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
analysis-kinds: code-scanning
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
analysis-kinds: code-quality
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
analysis-kinds: code-scanning,code-quality
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
analysis-kinds: risk-assessment
- os: ubuntu-latest
- os: ubuntu-26.04
version: nightly-latest
analysis-kinds: code-scanning
- os: ubuntu-latest
- os: ubuntu-26.04
version: nightly-latest
analysis-kinds: code-quality
- os: ubuntu-latest
- os: ubuntu-26.04
version: nightly-latest
analysis-kinds: code-scanning,code-quality
- os: ubuntu-latest
- os: ubuntu-26.04
version: nightly-latest
analysis-kinds: risk-assessment
name: Analysis kinds

2
.github/workflows/__analyze-ref-input.yml generated vendored
View File

@@ -54,7 +54,7 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: default
name: "Analyze: 'ref' and 'sha' from inputs"
if: github.triggering_actor != 'dependabot[bot]'

6
.github/workflows/__autobuild-action.yml generated vendored
View File

@@ -44,11 +44,11 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
- os: macos-latest
- os: macos-26
version: linked
- os: windows-latest
- os: windows-2025
version: linked
name: autobuild-action
if: github.triggering_actor != 'dependabot[bot]'

8
.github/workflows/__autobuild-direct-tracing-with-working-dir.yml generated vendored
View File

@@ -44,13 +44,13 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
- os: windows-latest
- os: windows-2025
version: linked
- os: ubuntu-latest
- os: ubuntu-26.04
version: nightly-latest
- os: windows-latest
- os: windows-2025
version: nightly-latest
name: Autobuild direct tracing (custom working directory)
if: github.triggering_actor != 'dependabot[bot]'

2
.github/workflows/__autobuild-working-dir.yml generated vendored
View File

@@ -34,7 +34,7 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
name: Autobuild working directory
if: github.triggering_actor != 'dependabot[bot]'

8
.github/workflows/__build-mode-autobuild.yml generated vendored
View File

@@ -44,13 +44,13 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
- os: windows-latest
- os: windows-2025
version: linked
- os: ubuntu-latest
- os: ubuntu-26.04
version: nightly-latest
- os: windows-latest
- os: windows-2025
version: nightly-latest
name: Build mode autobuild
if: github.triggering_actor != 'dependabot[bot]'

2
.github/workflows/__build-mode-manual.yml generated vendored
View File

@@ -54,7 +54,7 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: nightly-latest
name: Build mode manual
if: github.triggering_actor != 'dependabot[bot]'

4
.github/workflows/__build-mode-none.yml generated vendored
View File

@@ -34,9 +34,9 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
- os: ubuntu-latest
- os: ubuntu-26.04
version: nightly-latest
name: Build mode none
if: github.triggering_actor != 'dependabot[bot]'

2
.github/workflows/__build-mode-rollback.yml generated vendored
View File

@@ -34,7 +34,7 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: nightly-latest
name: Build mode rollback
if: github.triggering_actor != 'dependabot[bot]'

2
.github/workflows/__bundle-from-nightly.yml generated vendored
View File

@@ -34,7 +34,7 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
name: 'Bundle: From nightly'
if: github.triggering_actor != 'dependabot[bot]'

2
.github/workflows/__bundle-from-toolcache.yml generated vendored
View File

@@ -34,7 +34,7 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: toolcache
name: 'Bundle: From toolcache'
if: github.triggering_actor != 'dependabot[bot]'

6
.github/workflows/__bundle-toolcache.yml generated vendored
View File

@@ -34,11 +34,11 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
- os: macos-latest
- os: macos-26
version: linked
- os: windows-latest
- os: windows-2025
version: linked
name: 'Bundle: Caching checks'
if: github.triggering_actor != 'dependabot[bot]'

2
.github/workflows/__cleanup-db-cluster-dir.yml generated vendored
View File

@@ -34,7 +34,7 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
name: Clean up database cluster directory
if: github.triggering_actor != 'dependabot[bot]'

4
.github/workflows/__config-export.yml generated vendored
View File

@@ -34,9 +34,9 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
- os: ubuntu-latest
- os: ubuntu-26.04
version: nightly-latest
name: Config export
if: github.triggering_actor != 'dependabot[bot]'

2
.github/workflows/__config-input.yml generated vendored
View File

@@ -34,7 +34,7 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
name: Config input
if: github.triggering_actor != 'dependabot[bot]'

6
.github/workflows/__cpp-deptrace-disabled.yml generated vendored
View File

@@ -34,11 +34,11 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
- os: ubuntu-latest
- os: ubuntu-26.04
version: default
- os: ubuntu-latest
- os: ubuntu-26.04
version: nightly-latest
name: 'C/C++: disabling autoinstalling dependencies (Linux)'
if: github.triggering_actor != 'dependabot[bot]'

4
.github/workflows/__cpp-deptrace-enabled-on-macos.yml generated vendored
View File

@@ -34,9 +34,9 @@ jobs:
fail-fast: false
matrix:
include:
- os: macos-latest
- os: macos-26
version: linked
- os: macos-latest
- os: macos-26
version: nightly-latest
name: 'C/C++: autoinstalling dependencies is skipped (macOS)'
if: github.triggering_actor != 'dependabot[bot]'

6
.github/workflows/__cpp-deptrace-enabled.yml generated vendored
View File

@@ -34,11 +34,11 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
- os: ubuntu-latest
- os: ubuntu-26.04
version: default
- os: ubuntu-latest
- os: ubuntu-26.04
version: nightly-latest
name: 'C/C++: autoinstalling dependencies (Linux)'
if: github.triggering_actor != 'dependabot[bot]'

4
.github/workflows/__diagnostics-export.yml generated vendored
View File

@@ -34,9 +34,9 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
- os: ubuntu-latest
- os: ubuntu-26.04
version: nightly-latest
name: Diagnostic export
if: github.triggering_actor != 'dependabot[bot]'

4
.github/workflows/__diagnostics-without-db.yml generated vendored
View File

@@ -34,7 +34,7 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
name: Diagnostic export without database
if: github.triggering_actor != 'dependabot[bot]'
@@ -108,7 +108,7 @@ jobs:
contents: read
security-events: read
timeout-minutes: 5
runs-on: ubuntu-latest
runs-on: ubuntu-26.04
steps:
- name: Check out repository
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

6
.github/workflows/__export-file-baseline-information.yml generated vendored
View File

@@ -54,11 +54,11 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: nightly-latest
- os: macos-latest
- os: macos-26
version: nightly-latest
- os: windows-latest
- os: windows-2025
version: nightly-latest
name: Export file baseline information
if: github.triggering_actor != 'dependabot[bot]'

2
.github/workflows/__extractor-ram-threads.yml generated vendored
View File

@@ -34,7 +34,7 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
name: Extractor ram and threads options test
if: github.triggering_actor != 'dependabot[bot]'

4
.github/workflows/__global-proxy.yml generated vendored
View File

@@ -34,9 +34,9 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
- os: ubuntu-latest
- os: ubuntu-26.04
version: nightly-latest
name: Proxy test
if: github.triggering_actor != 'dependabot[bot]'

4
.github/workflows/__go-custom-queries.yml generated vendored
View File

@@ -54,9 +54,9 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
- os: ubuntu-latest
- os: ubuntu-26.04
version: nightly-latest
name: 'Go: Custom queries'
if: github.triggering_actor != 'dependabot[bot]'

2
.github/workflows/__go-indirect-tracing-workaround-diagnostic.yml generated vendored
View File

@@ -44,7 +44,7 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: default
name: 'Go: diagnostic when Go is changed after init step'
if: github.triggering_actor != 'dependabot[bot]'

2
.github/workflows/__go-indirect-tracing-workaround-no-file-program.yml generated vendored
View File

@@ -44,7 +44,7 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: default
name: 'Go: diagnostic when `file` is not installed'
if: github.triggering_actor != 'dependabot[bot]'

2
.github/workflows/__go-indirect-tracing-workaround.yml generated vendored
View File

@@ -44,7 +44,7 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: default
name: 'Go: workaround for indirect tracing'
if: github.triggering_actor != 'dependabot[bot]'

20
.github/workflows/__go-tracing-autobuilder.yml generated vendored
View File

@@ -46,25 +46,25 @@ jobs:
include:
- os: ubuntu-24.04
version: stable-v2.20.7
- os: ubuntu-latest
- os: ubuntu-26.04
version: stable-v2.21.4
- os: ubuntu-latest
- os: ubuntu-26.04
version: stable-v2.22.4
- os: ubuntu-latest
- os: ubuntu-26.04
version: stable-v2.23.9
- os: ubuntu-latest
- os: ubuntu-26.04
version: stable-v2.24.3
- os: ubuntu-latest
- os: ubuntu-26.04
version: stable-v2.25.6
- os: ubuntu-latest
- os: ubuntu-26.04
version: default
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
- os: macos-latest
- os: macos-26
version: linked
- os: ubuntu-latest
- os: ubuntu-26.04
version: nightly-latest
- os: macos-latest
- os: macos-26
version: nightly-latest
name: 'Go: tracing with autobuilder step'
if: github.triggering_actor != 'dependabot[bot]'

20
.github/workflows/__go-tracing-custom-build-steps.yml generated vendored
View File

@@ -46,25 +46,25 @@ jobs:
include:
- os: ubuntu-24.04
version: stable-v2.20.7
- os: ubuntu-latest
- os: ubuntu-26.04
version: stable-v2.21.4
- os: ubuntu-latest
- os: ubuntu-26.04
version: stable-v2.22.4
- os: ubuntu-latest
- os: ubuntu-26.04
version: stable-v2.23.9
- os: ubuntu-latest
- os: ubuntu-26.04
version: stable-v2.24.3
- os: ubuntu-latest
- os: ubuntu-26.04
version: stable-v2.25.6
- os: ubuntu-latest
- os: ubuntu-26.04
version: default
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
- os: macos-latest
- os: macos-26
version: linked
- os: ubuntu-latest
- os: ubuntu-26.04
version: nightly-latest
- os: macos-latest
- os: macos-26
version: nightly-latest
name: 'Go: tracing with custom build steps'
if: github.triggering_actor != 'dependabot[bot]'

20
.github/workflows/__go-tracing-legacy-workflow.yml generated vendored
View File

@@ -46,25 +46,25 @@ jobs:
include:
- os: ubuntu-24.04
version: stable-v2.20.7
- os: ubuntu-latest
- os: ubuntu-26.04
version: stable-v2.21.4
- os: ubuntu-latest
- os: ubuntu-26.04
version: stable-v2.22.4
- os: ubuntu-latest
- os: ubuntu-26.04
version: stable-v2.23.9
- os: ubuntu-latest
- os: ubuntu-26.04
version: stable-v2.24.3
- os: ubuntu-latest
- os: ubuntu-26.04
version: stable-v2.25.6
- os: ubuntu-latest
- os: ubuntu-26.04
version: default
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
- os: macos-latest
- os: macos-26
version: linked
- os: ubuntu-latest
- os: ubuntu-26.04
version: nightly-latest
- os: macos-latest
- os: macos-26
version: nightly-latest
name: 'Go: tracing with legacy workflow'
if: github.triggering_actor != 'dependabot[bot]'

6
.github/workflows/__init-with-registries.yml generated vendored
View File

@@ -34,11 +34,11 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: default
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
- os: ubuntu-latest
- os: ubuntu-26.04
version: nightly-latest
name: 'Packaging: Download using registries'
if: github.triggering_actor != 'dependabot[bot]'

6
.github/workflows/__javascript-source-root.yml generated vendored
View File

@@ -34,11 +34,11 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
- os: ubuntu-latest
- os: ubuntu-26.04
version: default
- os: ubuntu-latest
- os: ubuntu-26.04
version: nightly-latest
name: Custom source root
if: github.triggering_actor != 'dependabot[bot]'

2
.github/workflows/__job-run-uuid-sarif.yml generated vendored
View File

@@ -34,7 +34,7 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: nightly-latest
name: Job run UUID added to SARIF
if: github.triggering_actor != 'dependabot[bot]'

2
.github/workflows/__language-aliases.yml generated vendored
View File

@@ -34,7 +34,7 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
name: Language aliases
if: github.triggering_actor != 'dependabot[bot]'

2
.github/workflows/__local-bundle.yml generated vendored
View File

@@ -54,7 +54,7 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
name: Local CodeQL bundle
if: github.triggering_actor != 'dependabot[bot]'

28
.github/workflows/__multi-language-autodetect.yml generated vendored
View File

@@ -58,37 +58,37 @@ jobs:
version: stable-v2.20.7
- os: macos-15-xlarge
version: stable-v2.20.7
- os: ubuntu-latest
- os: ubuntu-26.04
version: stable-v2.21.4
- os: macos-15-xlarge
version: stable-v2.21.4
- os: ubuntu-latest
- os: ubuntu-26.04
version: stable-v2.22.4
- os: macos-15-xlarge
version: stable-v2.22.4
- os: ubuntu-latest
- os: ubuntu-26.04
version: stable-v2.23.9
- os: macos-latest-xlarge
- os: macos-26-xlarge
version: stable-v2.23.9
- os: ubuntu-latest
- os: ubuntu-26.04
version: stable-v2.24.3
- os: macos-latest-xlarge
- os: macos-26-xlarge
version: stable-v2.24.3
- os: ubuntu-latest
- os: ubuntu-26.04
version: stable-v2.25.6
- os: macos-latest-xlarge
- os: macos-26-xlarge
version: stable-v2.25.6
- os: ubuntu-latest
- os: ubuntu-26.04
version: default
- os: macos-latest-xlarge
- os: macos-26-xlarge
version: default
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
- os: macos-latest-xlarge
- os: macos-26-xlarge
version: linked
- os: ubuntu-latest
- os: ubuntu-26.04
version: nightly-latest
- os: macos-latest-xlarge
- os: macos-26-xlarge
version: nightly-latest
name: Multi-language repository
if: github.triggering_actor != 'dependabot[bot]'

4
.github/workflows/__overlay-init-fallback.yml generated vendored
View File

@@ -34,9 +34,9 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
- os: ubuntu-latest
- os: ubuntu-26.04
version: nightly-latest
name: Overlay database init fallback
if: github.triggering_actor != 'dependabot[bot]'

6
.github/workflows/__packaging-codescanning-config-inputs-js.yml generated vendored
View File

@@ -54,11 +54,11 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
- os: ubuntu-latest
- os: ubuntu-26.04
version: default
- os: ubuntu-latest
- os: ubuntu-26.04
version: nightly-latest
name: 'Packaging: Config and input passed to the CLI'
if: github.triggering_actor != 'dependabot[bot]'

6
.github/workflows/__packaging-config-inputs-js.yml generated vendored
View File

@@ -54,11 +54,11 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
- os: ubuntu-latest
- os: ubuntu-26.04
version: default
- os: ubuntu-latest
- os: ubuntu-26.04
version: nightly-latest
name: 'Packaging: Config and input'
if: github.triggering_actor != 'dependabot[bot]'

6
.github/workflows/__packaging-config-js.yml generated vendored
View File

@@ -54,11 +54,11 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
- os: ubuntu-latest
- os: ubuntu-26.04
version: default
- os: ubuntu-latest
- os: ubuntu-26.04
version: nightly-latest
name: 'Packaging: Config file'
if: github.triggering_actor != 'dependabot[bot]'

6
.github/workflows/__packaging-inputs-js.yml generated vendored
View File

@@ -54,11 +54,11 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
- os: ubuntu-latest
- os: ubuntu-26.04
version: default
- os: ubuntu-latest
- os: ubuntu-26.04
version: nightly-latest
name: 'Packaging: Action input'
if: github.triggering_actor != 'dependabot[bot]'

20
.github/workflows/__per-language-bundle-validation.yml generated vendored
View File

@@ -35,40 +35,40 @@ jobs:
matrix:
include:
- language: actions
os: ubuntu-latest
os: ubuntu-26.04
version: linked
expected-extractors: actions javascript
- language: cpp
os: ubuntu-latest
os: ubuntu-26.04
version: linked
build-mode: manual
build-command: gcc -o main main.c
- language: csharp
os: ubuntu-latest
os: ubuntu-26.04
version: linked
build-mode: none
- language: go
os: ubuntu-latest
os: ubuntu-26.04
version: linked
build-mode: autobuild
- language: java
os: ubuntu-latest
os: ubuntu-26.04
version: linked
build-mode: none
- language: javascript
os: ubuntu-latest
os: ubuntu-26.04
version: linked
- language: python
os: ubuntu-latest
os: ubuntu-26.04
version: linked
- language: ruby
os: ubuntu-latest
os: ubuntu-26.04
version: linked
- language: rust
os: ubuntu-latest
os: ubuntu-26.04
version: linked
- language: swift
os: macos-latest-xlarge
os: macos-26-xlarge
version: linked
build-mode: autobuild
name: Per-language bundles

4
.github/workflows/__remote-config.yml generated vendored
View File

@@ -54,9 +54,9 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
- os: ubuntu-latest
- os: ubuntu-26.04
version: nightly-latest
name: Remote config file
if: github.triggering_actor != 'dependabot[bot]'

6
.github/workflows/__resolve-environment-action.yml generated vendored
View File

@@ -34,11 +34,11 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
- os: ubuntu-latest
- os: ubuntu-26.04
version: default
- os: ubuntu-latest
- os: ubuntu-26.04
version: nightly-latest
name: Resolve environment
if: github.triggering_actor != 'dependabot[bot]'

12
.github/workflows/__ruby.yml generated vendored
View File

@@ -34,17 +34,17 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
- os: macos-latest
- os: macos-26
version: linked
- os: ubuntu-latest
- os: ubuntu-26.04
version: default
- os: macos-latest
- os: macos-26
version: default
- os: ubuntu-latest
- os: ubuntu-26.04
version: nightly-latest
- os: macos-latest
- os: macos-26
version: nightly-latest
name: Ruby analysis
if: github.triggering_actor != 'dependabot[bot]'

8
.github/workflows/__rust.yml generated vendored
View File

@@ -36,13 +36,13 @@ jobs:
include:
- os: ubuntu-24.04
version: stable-v2.20.7
- os: ubuntu-latest
- os: ubuntu-26.04
version: stable-v2.22.1
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
- os: ubuntu-latest
- os: ubuntu-26.04
version: default
- os: ubuntu-latest
- os: ubuntu-26.04
version: nightly-latest
name: Rust analysis
if: github.triggering_actor != 'dependabot[bot]'

12
.github/workflows/__split-workflow.yml generated vendored
View File

@@ -54,17 +54,17 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
- os: macos-latest
- os: macos-26
version: linked
- os: ubuntu-latest
- os: ubuntu-26.04
version: default
- os: macos-latest
- os: macos-26
version: default
- os: ubuntu-latest
- os: ubuntu-26.04
version: nightly-latest
- os: macos-latest
- os: macos-26
version: nightly-latest
name: Split workflow
if: github.triggering_actor != 'dependabot[bot]'

6
.github/workflows/__start-proxy.yml generated vendored
View File

@@ -34,11 +34,11 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
- os: macos-latest
- os: macos-26
version: linked
- os: windows-latest
- os: windows-2025
version: linked
name: Start proxy
if: github.triggering_actor != 'dependabot[bot]'

6
.github/workflows/__submit-sarif-failure.yml generated vendored
View File

@@ -34,11 +34,11 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
- os: ubuntu-latest
- os: ubuntu-26.04
version: default
- os: ubuntu-latest
- os: ubuntu-26.04
version: nightly-latest
name: Submit SARIF after failure
if: github.triggering_actor != 'dependabot[bot]'

2
.github/workflows/__swift-autobuild.yml generated vendored
View File

@@ -34,7 +34,7 @@ jobs:
fail-fast: false
matrix:
include:
- os: macos-latest-xlarge
- os: macos-26-xlarge
version: nightly-latest
name: Swift analysis using autobuild
if: github.triggering_actor != 'dependabot[bot]'

6
.github/workflows/__swift-custom-build.yml generated vendored
View File

@@ -54,11 +54,11 @@ jobs:
fail-fast: false
matrix:
include:
- os: macos-latest-xlarge
- os: macos-26-xlarge
version: linked
- os: macos-latest-xlarge
- os: macos-26-xlarge
version: default
- os: macos-latest-xlarge
- os: macos-26-xlarge
version: nightly-latest
name: Swift analysis using a custom build command
if: github.triggering_actor != 'dependabot[bot]'

4
.github/workflows/__unset-environment.yml generated vendored
View File

@@ -54,9 +54,9 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
- os: ubuntu-latest
- os: ubuntu-26.04
version: nightly-latest
name: Test unsetting environment variables
if: github.triggering_actor != 'dependabot[bot]'

2
.github/workflows/__unsupported-macos.yml generated vendored
View File

@@ -100,7 +100,7 @@ jobs:
contents: read
security-events: read
timeout-minutes: 5
runs-on: ubuntu-latest
runs-on: ubuntu-26.04
steps:
- name: Check out repository
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

2
.github/workflows/__upload-ref-sha-input.yml generated vendored
View File

@@ -54,7 +54,7 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: default
name: "Upload-sarif: 'ref' and 'sha' from inputs"
if: github.triggering_actor != 'dependabot[bot]'

6
.github/workflows/__upload-sarif.yml generated vendored
View File

@@ -54,13 +54,13 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: default
analysis-kinds: code-scanning
- os: ubuntu-latest
- os: ubuntu-26.04
version: default
analysis-kinds: code-quality
- os: ubuntu-latest
- os: ubuntu-26.04
version: default
analysis-kinds: code-scanning,code-quality
name: Test different uses of `upload-sarif`

2
.github/workflows/__with-checkout-path.yml generated vendored
View File

@@ -54,7 +54,7 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
name: Use a custom `checkout_path`
if: github.triggering_actor != 'dependabot[bot]'

4
.github/workflows/codeql.yml vendored
View File

@@ -22,7 +22,7 @@ jobs:
# Identify the CodeQL tool versions to use in the analysis job.
check-codeql-versions:
if: github.triggering_actor != 'dependabot[bot]'
runs-on: ubuntu-latest
runs-on: ubuntu-26.04
outputs:
versions: ${{ steps.compare.outputs.versions }}
@@ -106,7 +106,7 @@ jobs:
analyze-other:
if: github.triggering_actor != 'dependabot[bot]'
runs-on: ubuntu-latest
runs-on: ubuntu-26.04
strategy:
fail-fast: false

6
.github/workflows/codescanning-config-cli.yml vendored
View File

@@ -41,11 +41,11 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
- os: ubuntu-latest
- os: ubuntu-26.04
version: default
- os: ubuntu-latest
- os: ubuntu-26.04
version: nightly-latest
# Code-Scanning config not created because environment variable is not set

4
.github/workflows/debug-artifacts-failure-safe.yml vendored
View File

@@ -47,7 +47,7 @@ jobs:
# stable-v2.20.7 requires an older version of Java than the default on `ubuntu-latest` (`ubuntu-26.04`).
# We could install that older version on the newer runners, or use the older runner.
# We do the latter here. This can be removed once we stop supporting `v2.20.7`.
runs-on: ${{ case(matrix.version == 'stable-v2.20.7', 'ubuntu-24.04', 'ubuntu-latest') }}
runs-on: ${{ case(matrix.version == 'stable-v2.20.7', 'ubuntu-24.04', 'ubuntu-26.04') }}
steps:
- name: Dump GitHub event
@@ -91,7 +91,7 @@ jobs:
timeout-minutes: 45
permissions:
contents: read
runs-on: ubuntu-latest
runs-on: ubuntu-26.04
steps:
- name: Download all artifacts
uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2

4
.github/workflows/debug-artifacts-safe.yml vendored
View File

@@ -45,7 +45,7 @@ jobs:
# stable-v2.20.7 requires an older version of Java than the default on `ubuntu-latest` (`ubuntu-26.04`).
# We could install that older version on the newer runners, or use the older runner.
# We do the latter here. This can be removed once we stop supporting `v2.20.7`.
runs-on: ${{ case(matrix.version == 'stable-v2.20.7', 'ubuntu-24.04', 'ubuntu-latest') }}
runs-on: ${{ case(matrix.version == 'stable-v2.20.7', 'ubuntu-24.04', 'ubuntu-26.04') }}
steps:
- name: Check out repository
@@ -84,7 +84,7 @@ jobs:
timeout-minutes: 45
permissions:
contents: read
runs-on: ubuntu-latest
runs-on: ubuntu-26.04
steps:
- name: Download all artifacts
uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2

10
.github/workflows/post-release-mergeback.yml vendored
View File

@@ -10,7 +10,7 @@ on:
workflow_dispatch:
inputs:
baseBranch:
description: 'The base branch to merge into'
description: "The base branch to merge into"
default: main
required: false
@@ -24,7 +24,7 @@ defaults:
jobs:
merge-back:
runs-on: ubuntu-latest
runs-on: ubuntu-26.04
environment: Automation
if: github.repository == 'github/codeql-action'
env:
@@ -41,16 +41,16 @@ jobs:
- name: Dump GitHub context
env:
GITHUB_CONTEXT: '${{ toJson(github) }}'
GITHUB_CONTEXT: "${{ toJson(github) }}"
run: echo "${GITHUB_CONTEXT}"
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
fetch-depth: 0 # ensure we have all tags and can push commits
fetch-depth: 0 # ensure we have all tags and can push commits
- uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
with:
node-version: 24
cache: 'npm'
cache: "npm"
- name: Install JavaScript dependencies
run: npm ci

8
.github/workflows/pr-checks.yml vendored
View File

@@ -25,7 +25,7 @@ jobs:
strategy:
fail-fast: false
matrix:
os: [ubuntu-latest, macos-latest, windows-latest]
os: [ubuntu-26.04, macos-26, windows-2025]
node-version: [20, 24]
permissions:
contents: read
@@ -71,7 +71,7 @@ jobs:
run: npm test
- name: Lint
if: always() && matrix.os != 'windows-latest'
if: always() && matrix.os != 'windows-2025'
run: npm run lint-ci
- name: Upload sarif
@@ -81,7 +81,7 @@ jobs:
# paired `push` run that the queue branch creates use that ref, so gate on the ref itself
# rather than the event. The same results are uploaded by the `pull_request` run and again
# by the `push` run on `main`.
if: matrix.os == 'ubuntu-latest' && matrix.node-version == 24 && !startsWith(github.ref, 'refs/heads/gh-readonly-queue/')
if: matrix.os == 'ubuntu-26.04' && matrix.node-version == 24 && !startsWith(github.ref, 'refs/heads/gh-readonly-queue/')
with:
sarif_file: eslint.sarif
category: eslint
@@ -93,7 +93,7 @@ jobs:
if: github.triggering_actor != 'dependabot[bot]'
permissions:
contents: read
runs-on: ubuntu-latest
runs-on: ubuntu-26.04
timeout-minutes: 10
concurrency:

2
.github/workflows/prepare-release.yml vendored
View File

@@ -29,7 +29,7 @@ defaults:
jobs:
prepare:
name: "Release info"
runs-on: ubuntu-latest
runs-on: ubuntu-26.04
if: github.repository == 'github/codeql-action'
permissions:

2
.github/workflows/python312-windows.yml vendored
View File

@@ -29,7 +29,7 @@ jobs:
contents: read
# We currently need `security-events: read` to access feature flags.
security-events: read
runs-on: windows-latest
runs-on: windows-2025
steps:
- uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0

2
.github/workflows/query-filters.yml vendored
View File

@@ -25,7 +25,7 @@ jobs:
name: Query Filters Tests
if: github.triggering_actor != 'dependabot[bot]'
timeout-minutes: 45
runs-on: ubuntu-latest
runs-on: ubuntu-26.04
permissions:
contents: read # This permission is needed to allow the GitHub Actions workflow to read the contents of the repository.
steps:

4
.github/workflows/rebuild.yml vendored
View File

@@ -12,7 +12,7 @@ defaults:
jobs:
rebuild:
name: Rebuild Action
runs-on: ubuntu-latest
runs-on: ubuntu-26.04
if: github.event.label.name == 'Rebuild' || github.event_name == 'workflow_dispatch'
env:
@@ -33,7 +33,7 @@ jobs:
uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
with:
node-version: 24
cache: 'npm'
cache: "npm"
- name: Remove label
if: github.event_name == 'pull_request'

2
.github/workflows/rollback-release.yml vendored
View File

@@ -34,7 +34,7 @@ jobs:
rollback:
name: "Create rollback release"
if: github.repository == 'github/codeql-action'
runs-on: ubuntu-latest
runs-on: ubuntu-26.04
timeout-minutes: 45
# Don't set the deployment environment for test runs

2
.github/workflows/test-codeql-bundle-all.yml vendored
View File

@@ -27,7 +27,7 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: nightly-latest
name: 'CodeQL Bundle All'
if: github.triggering_actor != 'dependabot[bot]'

2
.github/workflows/update-bundle.yml vendored
View File

@@ -20,7 +20,7 @@ defaults:
jobs:
update-bundle:
if: github.event.release.prerelease && startsWith(github.event.release.tag_name, 'codeql-bundle-')
runs-on: ubuntu-latest
runs-on: ubuntu-26.04
permissions:
contents: write # needed to push commits
pull-requests: write # needed to create pull requests

4
.github/workflows/update-release-branch.yml vendored
View File

@@ -26,7 +26,7 @@ jobs:
update:
name: "Update release branch"
timeout-minutes: 45
runs-on: ubuntu-latest
runs-on: ubuntu-26.04
if: github.event_name == 'workflow_dispatch'
needs: [prepare]
env:
@@ -79,7 +79,7 @@ jobs:
backport:
name: "Create backport"
timeout-minutes: 45
runs-on: ubuntu-latest
runs-on: ubuntu-26.04
environment: Automation
needs: [prepare]
if: ${{ (github.event_name == 'push') && needs.prepare.outputs.backport_target_branches != '[]' }}

2
pr-checks/checks/all-platform-bundle.yml
View File

@@ -3,7 +3,7 @@ description: "Tests using an all-platform CodeQL Bundle"
operatingSystems:
- ubuntu
- os: macos
runner-image: macos-latest-xlarge
runner-image: macos-26-xlarge
- windows
versions:
- nightly-latest

2
pr-checks/checks/multi-language-autodetect.yml
View File

@@ -3,7 +3,7 @@ description: "An end-to-end integration test of a multi-language repository usin
operatingSystems:
- ubuntu
- os: macos
runner-image: macos-latest-xlarge
runner-image: macos-26-xlarge
# Older CodeQL CLI versions only support Swift up to 6.1, which requires Xcode 16. That is
# not available on macOS 26, so run these versions on macOS 15 where we select Xcode 16
# below. See https://github.com/actions/runner-images/issues/14167.

20
pr-checks/checks/per-language-bundle-validation.yml
View File

@@ -3,41 +3,41 @@ description: Validates extraction and analysis using each per-language CodeQL bu
matrix:
include:
- language: actions
os: ubuntu-latest
os: ubuntu-26.04
version: linked
# Actions also needs the JavaScript extractor.
expected-extractors: actions javascript
- language: cpp
os: ubuntu-latest
os: ubuntu-26.04
version: linked
build-mode: manual
build-command: gcc -o main main.c
- language: csharp
os: ubuntu-latest
os: ubuntu-26.04
version: linked
build-mode: none
- language: go
os: ubuntu-latest
os: ubuntu-26.04
version: linked
build-mode: autobuild
- language: java
os: ubuntu-latest
os: ubuntu-26.04
version: linked
build-mode: none
- language: javascript
os: ubuntu-latest
os: ubuntu-26.04
version: linked
- language: python
os: ubuntu-latest
os: ubuntu-26.04
version: linked
- language: ruby
os: ubuntu-latest
os: ubuntu-26.04
version: linked
- language: rust
os: ubuntu-latest
os: ubuntu-26.04
version: linked
- language: swift
os: macos-latest-xlarge
os: macos-26-xlarge
version: linked
build-mode: autobuild
installNode: true

2
pr-checks/checks/swift-autobuild.yml
View File

@@ -4,7 +4,7 @@ versions:
- nightly-latest
operatingSystems:
- os: macos
runner-image: macos-latest-xlarge
runner-image: macos-26-xlarge
steps:
- uses: ./../action/init
id: init

2
pr-checks/checks/swift-custom-build.yml
View File

@@ -6,7 +6,7 @@ versions:
- nightly-latest
operatingSystems:
- os: macos
runner-image: macos-latest-xlarge
runner-image: macos-26-xlarge
installGo: true
installDotNet: true
env:

19
pr-checks/sync.ts
View File

@@ -43,6 +43,13 @@ type WorkflowInputs = Partial<Record<KnownInputName, WorkflowInput>>;
/** An operating system identifier. */
type OperatingSystemIdentifier = "ubuntu" | "macos" | "windows";
/** Mapping from {@link OperatingSystemIdentifier} to default runner image labels. */
const DEFAULT_RUNNER_IMAGES: Record<OperatingSystemIdentifier, string> = {
ubuntu: "ubuntu-26.04",
macos: "macos-26",
windows: "windows-2025",
};
/**
* Represents an operating system matrix entry for a generated PR check workflow.
*
@@ -414,12 +421,6 @@ function generateJobMatrix(
);
}
const defaultRunnerImages = [
"ubuntu-latest",
"macos-latest",
"windows-latest",
];
for (const operatingSystemConfig of operatingSystems) {
const operatingSystem =
typeof operatingSystemConfig === "string"
@@ -449,7 +450,7 @@ function generateJobMatrix(
const runnerImagesForOs =
typeof operatingSystemConfig === "string" ||
operatingSystemConfig["runner-image"] === undefined
? defaultRunnerImages.filter((image) =>
? Object.values(DEFAULT_RUNNER_IMAGES).filter((image) =>
image.startsWith(operatingSystem),
)
: [operatingSystemConfig["runner-image"]];
@@ -462,7 +463,7 @@ function generateJobMatrix(
// is removed from `defaultTestVersions`.
const requiresOlderRunnerImage: DefaultTestVersion = "stable-v2.20.7";
if (
runnerImage === "ubuntu-latest" &&
runnerImage === DEFAULT_RUNNER_IMAGES["ubuntu"] &&
version === requiresOlderRunnerImage
) {
matrix.push({ os: "ubuntu-24.04", version });
@@ -677,7 +678,7 @@ function generateValidationJob(
"security-events": "read",
},
"timeout-minutes": 5,
"runs-on": "ubuntu-latest",
"runs-on": DEFAULT_RUNNER_IMAGES["ubuntu"],
steps: specSteps,
};