From 1a80c9b44e5e264432dae07ab446f24f05596f40 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 8 Sep 2025 17:54:44 +0000 Subject: [PATCH 01/53] Bump the actions group with 4 updates Bumps the actions group with 4 updates: [actions/setup-go](https://github.com/actions/setup-go), [actions/github-script](https://github.com/actions/github-script), [actions/setup-node](https://github.com/actions/setup-node) and [actions/setup-python](https://github.com/actions/setup-python). Updates `actions/setup-go` from 5 to 6 - [Release notes](https://github.com/actions/setup-go/releases) - [Commits](https://github.com/actions/setup-go/compare/v5...v6) Updates `actions/github-script` from 7 to 8 - [Release notes](https://github.com/actions/github-script/releases) - [Commits](https://github.com/actions/github-script/compare/v7...v8) Updates `actions/setup-node` from 4 to 5 - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](https://github.com/actions/setup-node/compare/v4...v5) Updates `actions/setup-python` from 5 to 6 - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](https://github.com/actions/setup-python/compare/v5...v6) --- updated-dependencies: - dependency-name: actions/setup-go dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: actions/github-script dependency-version: '8' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: actions/setup-node dependency-version: '5' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: actions/setup-python dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions ... Signed-off-by: dependabot[bot] --- .github/workflows/__all-platform-bundle.yml | 2 +- .github/workflows/__analyze-ref-input.yml | 2 +- .github/workflows/__build-mode-manual.yml | 2 +- .github/workflows/__bundle-toolcache.yml | 6 +++--- .github/workflows/__bundle-zstd.yml | 4 ++-- .github/workflows/__config-export.yml | 2 +- .github/workflows/__config-input.yml | 2 +- .github/workflows/__diagnostics-export.yml | 2 +- .github/workflows/__export-file-baseline-information.yml | 2 +- .github/workflows/__go-custom-queries.yml | 2 +- .../__go-indirect-tracing-workaround-diagnostic.yml | 6 +++--- .../__go-indirect-tracing-workaround-no-file-program.yml | 4 ++-- .github/workflows/__go-indirect-tracing-workaround.yml | 2 +- .github/workflows/__go-tracing-autobuilder.yml | 2 +- .github/workflows/__go-tracing-custom-build-steps.yml | 2 +- .github/workflows/__go-tracing-legacy-workflow.yml | 2 +- .github/workflows/__multi-language-autodetect.yml | 2 +- .../workflows/__packaging-codescanning-config-inputs-js.yml | 4 ++-- .github/workflows/__packaging-config-inputs-js.yml | 4 ++-- .github/workflows/__packaging-config-js.yml | 4 ++-- .github/workflows/__packaging-inputs-js.yml | 4 ++-- .github/workflows/__quality-queries.yml | 4 ++-- .github/workflows/__remote-config.yml | 2 +- .github/workflows/__split-workflow.yml | 2 +- .github/workflows/__swift-custom-build.yml | 2 +- .github/workflows/__test-local-codeql.yml | 2 +- .github/workflows/__unset-environment.yml | 2 +- .github/workflows/__upload-quality-sarif.yml | 2 +- .github/workflows/__upload-ref-sha-input.yml | 2 +- .github/workflows/__with-checkout-path.yml | 2 +- .github/workflows/codescanning-config-cli.yml | 2 +- .github/workflows/debug-artifacts-failure-safe.yml | 2 +- .github/workflows/debug-artifacts-safe.yml | 2 +- .github/workflows/post-release-mergeback.yml | 2 +- .github/workflows/pr-checks.yml | 4 ++-- .github/workflows/python312-windows.yml | 2 +- .github/workflows/query-filters.yml | 2 +- .github/workflows/rebuild.yml | 2 +- .github/workflows/update-bundle.yml | 2 +- .github/workflows/update-proxy-release.yml | 2 +- .../update-supported-enterprise-server-versions.yml | 2 +- 41 files changed, 53 insertions(+), 53 deletions(-) diff --git a/.github/workflows/__all-platform-bundle.yml b/.github/workflows/__all-platform-bundle.yml index 45407c57b..658fa0cc9 100644 --- a/.github/workflows/__all-platform-bundle.yml +++ b/.github/workflows/__all-platform-bundle.yml @@ -59,7 +59,7 @@ jobs: use-all-platform-bundle: 'true' setup-kotlin: 'true' - name: Install Go - uses: actions/setup-go@v5 + uses: actions/setup-go@v6 with: go-version: ${{ inputs.go-version || '>=1.21.0' }} cache: false diff --git a/.github/workflows/__analyze-ref-input.yml b/.github/workflows/__analyze-ref-input.yml index 5e03f4992..884aaf358 100644 --- a/.github/workflows/__analyze-ref-input.yml +++ b/.github/workflows/__analyze-ref-input.yml @@ -63,7 +63,7 @@ jobs: use-all-platform-bundle: 'false' setup-kotlin: 'true' - name: Install Go - uses: actions/setup-go@v5 + uses: actions/setup-go@v6 with: go-version: ${{ inputs.go-version || '>=1.21.0' }} cache: false diff --git a/.github/workflows/__build-mode-manual.yml b/.github/workflows/__build-mode-manual.yml index efec3292b..be988571d 100644 --- a/.github/workflows/__build-mode-manual.yml +++ b/.github/workflows/__build-mode-manual.yml @@ -59,7 +59,7 @@ jobs: use-all-platform-bundle: 'false' setup-kotlin: 'true' - name: Install Go - uses: actions/setup-go@v5 + uses: actions/setup-go@v6 with: go-version: ${{ inputs.go-version || '>=1.21.0' }} cache: false diff --git a/.github/workflows/__bundle-toolcache.yml b/.github/workflows/__bundle-toolcache.yml index 7d9becc00..9afd8d8e6 100644 --- a/.github/workflows/__bundle-toolcache.yml +++ b/.github/workflows/__bundle-toolcache.yml @@ -53,7 +53,7 @@ jobs: use-all-platform-bundle: 'false' setup-kotlin: 'true' - name: Remove CodeQL from toolcache - uses: actions/github-script@v7 + uses: actions/github-script@v8 with: script: | const fs = require('fs'); @@ -63,7 +63,7 @@ jobs: - name: Install @actions/tool-cache run: npm install @actions/tool-cache - name: Check toolcache does not contain CodeQL - uses: actions/github-script@v7 + uses: actions/github-script@v8 with: script: | const toolcache = require('@actions/tool-cache'); @@ -82,7 +82,7 @@ jobs: output: ${{ runner.temp }}/results upload-database: false - name: Check CodeQL is installed within the toolcache - uses: actions/github-script@v7 + uses: actions/github-script@v8 with: script: | const toolcache = require('@actions/tool-cache'); diff --git a/.github/workflows/__bundle-zstd.yml b/.github/workflows/__bundle-zstd.yml index 650a8617d..74847326e 100644 --- a/.github/workflows/__bundle-zstd.yml +++ b/.github/workflows/__bundle-zstd.yml @@ -53,7 +53,7 @@ jobs: use-all-platform-bundle: 'false' setup-kotlin: 'true' - name: Remove CodeQL from toolcache - uses: actions/github-script@v7 + uses: actions/github-script@v8 with: script: | const fs = require('fs'); @@ -78,7 +78,7 @@ jobs: path: ${{ runner.temp }}/results/javascript.sarif retention-days: 7 - name: Check diagnostic with expected tools URL appears in SARIF - uses: actions/github-script@v7 + uses: actions/github-script@v8 env: SARIF_PATH: ${{ runner.temp }}/results/javascript.sarif with: diff --git a/.github/workflows/__config-export.yml b/.github/workflows/__config-export.yml index b3af26b4f..b050b6dd0 100644 --- a/.github/workflows/__config-export.yml +++ b/.github/workflows/__config-export.yml @@ -74,7 +74,7 @@ jobs: path: ${{ runner.temp }}/results/javascript.sarif retention-days: 7 - name: Check config properties appear in SARIF - uses: actions/github-script@v7 + uses: actions/github-script@v8 env: SARIF_PATH: ${{ runner.temp }}/results/javascript.sarif with: diff --git a/.github/workflows/__config-input.yml b/.github/workflows/__config-input.yml index 160a61b81..0c6ff46f0 100644 --- a/.github/workflows/__config-input.yml +++ b/.github/workflows/__config-input.yml @@ -42,7 +42,7 @@ jobs: - name: Check out repository uses: actions/checkout@v5 - name: Install Node.js - uses: actions/setup-node@v4 + uses: actions/setup-node@v5 with: node-version: 20.x cache: npm diff --git a/.github/workflows/__diagnostics-export.yml b/.github/workflows/__diagnostics-export.yml index e07aa5e96..d95c95c4e 100644 --- a/.github/workflows/__diagnostics-export.yml +++ b/.github/workflows/__diagnostics-export.yml @@ -86,7 +86,7 @@ jobs: path: ${{ runner.temp }}/results/javascript.sarif retention-days: 7 - name: Check diagnostics appear in SARIF - uses: actions/github-script@v7 + uses: actions/github-script@v8 env: SARIF_PATH: ${{ runner.temp }}/results/javascript.sarif with: diff --git a/.github/workflows/__export-file-baseline-information.yml b/.github/workflows/__export-file-baseline-information.yml index 86c519d5a..c53eb1057 100644 --- a/.github/workflows/__export-file-baseline-information.yml +++ b/.github/workflows/__export-file-baseline-information.yml @@ -63,7 +63,7 @@ jobs: use-all-platform-bundle: 'false' setup-kotlin: 'true' - name: Install Go - uses: actions/setup-go@v5 + uses: actions/setup-go@v6 with: go-version: ${{ inputs.go-version || '>=1.21.0' }} cache: false diff --git a/.github/workflows/__go-custom-queries.yml b/.github/workflows/__go-custom-queries.yml index a8b0658a6..6d75cf9c7 100644 --- a/.github/workflows/__go-custom-queries.yml +++ b/.github/workflows/__go-custom-queries.yml @@ -61,7 +61,7 @@ jobs: use-all-platform-bundle: 'false' setup-kotlin: 'true' - name: Install Go - uses: actions/setup-go@v5 + uses: actions/setup-go@v6 with: go-version: ${{ inputs.go-version || '>=1.21.0' }} cache: false diff --git a/.github/workflows/__go-indirect-tracing-workaround-diagnostic.yml b/.github/workflows/__go-indirect-tracing-workaround-diagnostic.yml index 554bf86e1..3e82cfda7 100644 --- a/.github/workflows/__go-indirect-tracing-workaround-diagnostic.yml +++ b/.github/workflows/__go-indirect-tracing-workaround-diagnostic.yml @@ -59,7 +59,7 @@ jobs: use-all-platform-bundle: 'false' setup-kotlin: 'true' - name: Install Go - uses: actions/setup-go@v5 + uses: actions/setup-go@v6 with: go-version: ${{ inputs.go-version || '>=1.21.0' }} cache: false @@ -68,7 +68,7 @@ jobs: languages: go tools: ${{ steps.prepare-test.outputs.tools-url }} # Deliberately change Go after the `init` step - - uses: actions/setup-go@v5 + - uses: actions/setup-go@v6 with: go-version: '1.20' - name: Build code @@ -79,7 +79,7 @@ jobs: output: ${{ runner.temp }}/results upload-database: false - name: Check diagnostic appears in SARIF - uses: actions/github-script@v7 + uses: actions/github-script@v8 env: SARIF_PATH: ${{ runner.temp }}/results/go.sarif with: diff --git a/.github/workflows/__go-indirect-tracing-workaround-no-file-program.yml b/.github/workflows/__go-indirect-tracing-workaround-no-file-program.yml index 6af7dce43..a2f6a38ad 100644 --- a/.github/workflows/__go-indirect-tracing-workaround-no-file-program.yml +++ b/.github/workflows/__go-indirect-tracing-workaround-no-file-program.yml @@ -59,7 +59,7 @@ jobs: use-all-platform-bundle: 'false' setup-kotlin: 'true' - name: Install Go - uses: actions/setup-go@v5 + uses: actions/setup-go@v6 with: go-version: ${{ inputs.go-version || '>=1.21.0' }} cache: false @@ -80,7 +80,7 @@ jobs: output: ${{ runner.temp }}/results upload-database: false - name: Check diagnostic appears in SARIF - uses: actions/github-script@v7 + uses: actions/github-script@v8 env: SARIF_PATH: ${{ runner.temp }}/results/go.sarif with: diff --git a/.github/workflows/__go-indirect-tracing-workaround.yml b/.github/workflows/__go-indirect-tracing-workaround.yml index 5e6b4e8a2..c6c18a025 100644 --- a/.github/workflows/__go-indirect-tracing-workaround.yml +++ b/.github/workflows/__go-indirect-tracing-workaround.yml @@ -59,7 +59,7 @@ jobs: use-all-platform-bundle: 'false' setup-kotlin: 'true' - name: Install Go - uses: actions/setup-go@v5 + uses: actions/setup-go@v6 with: go-version: ${{ inputs.go-version || '>=1.21.0' }} cache: false diff --git a/.github/workflows/__go-tracing-autobuilder.yml b/.github/workflows/__go-tracing-autobuilder.yml index f761175d9..9e25fdd33 100644 --- a/.github/workflows/__go-tracing-autobuilder.yml +++ b/.github/workflows/__go-tracing-autobuilder.yml @@ -89,7 +89,7 @@ jobs: use-all-platform-bundle: 'false' setup-kotlin: 'true' - name: Install Go - uses: actions/setup-go@v5 + uses: actions/setup-go@v6 with: go-version: ${{ inputs.go-version || '>=1.21.0' }} cache: false diff --git a/.github/workflows/__go-tracing-custom-build-steps.yml b/.github/workflows/__go-tracing-custom-build-steps.yml index e06136080..7852b849d 100644 --- a/.github/workflows/__go-tracing-custom-build-steps.yml +++ b/.github/workflows/__go-tracing-custom-build-steps.yml @@ -89,7 +89,7 @@ jobs: use-all-platform-bundle: 'false' setup-kotlin: 'true' - name: Install Go - uses: actions/setup-go@v5 + uses: actions/setup-go@v6 with: go-version: ${{ inputs.go-version || '>=1.21.0' }} cache: false diff --git a/.github/workflows/__go-tracing-legacy-workflow.yml b/.github/workflows/__go-tracing-legacy-workflow.yml index f81fd1698..1b31aa7b8 100644 --- a/.github/workflows/__go-tracing-legacy-workflow.yml +++ b/.github/workflows/__go-tracing-legacy-workflow.yml @@ -89,7 +89,7 @@ jobs: use-all-platform-bundle: 'false' setup-kotlin: 'true' - name: Install Go - uses: actions/setup-go@v5 + uses: actions/setup-go@v6 with: go-version: ${{ inputs.go-version || '>=1.21.0' }} cache: false diff --git a/.github/workflows/__multi-language-autodetect.yml b/.github/workflows/__multi-language-autodetect.yml index e5f157881..2984c596f 100644 --- a/.github/workflows/__multi-language-autodetect.yml +++ b/.github/workflows/__multi-language-autodetect.yml @@ -89,7 +89,7 @@ jobs: use-all-platform-bundle: 'false' setup-kotlin: 'true' - name: Install Go - uses: actions/setup-go@v5 + uses: actions/setup-go@v6 with: go-version: ${{ inputs.go-version || '>=1.21.0' }} cache: false diff --git a/.github/workflows/__packaging-codescanning-config-inputs-js.yml b/.github/workflows/__packaging-codescanning-config-inputs-js.yml index 185cccbc2..e40182916 100644 --- a/.github/workflows/__packaging-codescanning-config-inputs-js.yml +++ b/.github/workflows/__packaging-codescanning-config-inputs-js.yml @@ -68,7 +68,7 @@ jobs: - name: Check out repository uses: actions/checkout@v5 - name: Install Node.js - uses: actions/setup-node@v4 + uses: actions/setup-node@v5 with: node-version: 20.x cache: npm @@ -82,7 +82,7 @@ jobs: use-all-platform-bundle: 'false' setup-kotlin: 'true' - name: Install Go - uses: actions/setup-go@v5 + uses: actions/setup-go@v6 with: go-version: ${{ inputs.go-version || '>=1.21.0' }} cache: false diff --git a/.github/workflows/__packaging-config-inputs-js.yml b/.github/workflows/__packaging-config-inputs-js.yml index 810b85df3..c51cbe2f1 100644 --- a/.github/workflows/__packaging-config-inputs-js.yml +++ b/.github/workflows/__packaging-config-inputs-js.yml @@ -68,7 +68,7 @@ jobs: - name: Check out repository uses: actions/checkout@v5 - name: Install Node.js - uses: actions/setup-node@v4 + uses: actions/setup-node@v5 with: node-version: 20.x cache: npm @@ -82,7 +82,7 @@ jobs: use-all-platform-bundle: 'false' setup-kotlin: 'true' - name: Install Go - uses: actions/setup-go@v5 + uses: actions/setup-go@v6 with: go-version: ${{ inputs.go-version || '>=1.21.0' }} cache: false diff --git a/.github/workflows/__packaging-config-js.yml b/.github/workflows/__packaging-config-js.yml index ea96e3149..f657d1666 100644 --- a/.github/workflows/__packaging-config-js.yml +++ b/.github/workflows/__packaging-config-js.yml @@ -68,7 +68,7 @@ jobs: - name: Check out repository uses: actions/checkout@v5 - name: Install Node.js - uses: actions/setup-node@v4 + uses: actions/setup-node@v5 with: node-version: 20.x cache: npm @@ -82,7 +82,7 @@ jobs: use-all-platform-bundle: 'false' setup-kotlin: 'true' - name: Install Go - uses: actions/setup-go@v5 + uses: actions/setup-go@v6 with: go-version: ${{ inputs.go-version || '>=1.21.0' }} cache: false diff --git a/.github/workflows/__packaging-inputs-js.yml b/.github/workflows/__packaging-inputs-js.yml index e2db4c443..a9a868770 100644 --- a/.github/workflows/__packaging-inputs-js.yml +++ b/.github/workflows/__packaging-inputs-js.yml @@ -68,7 +68,7 @@ jobs: - name: Check out repository uses: actions/checkout@v5 - name: Install Node.js - uses: actions/setup-node@v4 + uses: actions/setup-node@v5 with: node-version: 20.x cache: npm @@ -82,7 +82,7 @@ jobs: use-all-platform-bundle: 'false' setup-kotlin: 'true' - name: Install Go - uses: actions/setup-go@v5 + uses: actions/setup-go@v6 with: go-version: ${{ inputs.go-version || '>=1.21.0' }} cache: false diff --git a/.github/workflows/__quality-queries.yml b/.github/workflows/__quality-queries.yml index bbd5decf7..755938f5f 100644 --- a/.github/workflows/__quality-queries.yml +++ b/.github/workflows/__quality-queries.yml @@ -127,7 +127,7 @@ jobs: retention-days: 7 - name: Check quality query does not appear in security SARIF if: contains(matrix.analysis-kinds, 'code-scanning') - uses: actions/github-script@v7 + uses: actions/github-script@v8 env: SARIF_PATH: ${{ runner.temp }}/results/javascript.sarif EXPECT_PRESENT: 'false' @@ -135,7 +135,7 @@ jobs: script: ${{ env.CHECK_SCRIPT }} - name: Check quality query appears in quality SARIF if: contains(matrix.analysis-kinds, 'code-quality') - uses: actions/github-script@v7 + uses: actions/github-script@v8 env: SARIF_PATH: ${{ runner.temp }}/results/javascript.quality.sarif EXPECT_PRESENT: 'true' diff --git a/.github/workflows/__remote-config.yml b/.github/workflows/__remote-config.yml index 4a3fd0eff..3b9c82845 100644 --- a/.github/workflows/__remote-config.yml +++ b/.github/workflows/__remote-config.yml @@ -61,7 +61,7 @@ jobs: use-all-platform-bundle: 'false' setup-kotlin: 'true' - name: Install Go - uses: actions/setup-go@v5 + uses: actions/setup-go@v6 with: go-version: ${{ inputs.go-version || '>=1.21.0' }} cache: false diff --git a/.github/workflows/__split-workflow.yml b/.github/workflows/__split-workflow.yml index 869db0745..d4b9e97c5 100644 --- a/.github/workflows/__split-workflow.yml +++ b/.github/workflows/__split-workflow.yml @@ -69,7 +69,7 @@ jobs: use-all-platform-bundle: 'false' setup-kotlin: 'true' - name: Install Go - uses: actions/setup-go@v5 + uses: actions/setup-go@v6 with: go-version: ${{ inputs.go-version || '>=1.21.0' }} cache: false diff --git a/.github/workflows/__swift-custom-build.yml b/.github/workflows/__swift-custom-build.yml index 8fdb34724..7c77983a8 100644 --- a/.github/workflows/__swift-custom-build.yml +++ b/.github/workflows/__swift-custom-build.yml @@ -63,7 +63,7 @@ jobs: use-all-platform-bundle: 'false' setup-kotlin: 'true' - name: Install Go - uses: actions/setup-go@v5 + uses: actions/setup-go@v6 with: go-version: ${{ inputs.go-version || '>=1.21.0' }} cache: false diff --git a/.github/workflows/__test-local-codeql.yml b/.github/workflows/__test-local-codeql.yml index 417515dfd..9b849a974 100644 --- a/.github/workflows/__test-local-codeql.yml +++ b/.github/workflows/__test-local-codeql.yml @@ -59,7 +59,7 @@ jobs: use-all-platform-bundle: 'false' setup-kotlin: 'true' - name: Install Go - uses: actions/setup-go@v5 + uses: actions/setup-go@v6 with: go-version: ${{ inputs.go-version || '>=1.21.0' }} cache: false diff --git a/.github/workflows/__unset-environment.yml b/.github/workflows/__unset-environment.yml index 772ac35b0..0707c2c5b 100644 --- a/.github/workflows/__unset-environment.yml +++ b/.github/workflows/__unset-environment.yml @@ -61,7 +61,7 @@ jobs: use-all-platform-bundle: 'false' setup-kotlin: 'true' - name: Install Go - uses: actions/setup-go@v5 + uses: actions/setup-go@v6 with: go-version: ${{ inputs.go-version || '>=1.21.0' }} cache: false diff --git a/.github/workflows/__upload-quality-sarif.yml b/.github/workflows/__upload-quality-sarif.yml index 2332aff84..48877bc6f 100644 --- a/.github/workflows/__upload-quality-sarif.yml +++ b/.github/workflows/__upload-quality-sarif.yml @@ -63,7 +63,7 @@ jobs: use-all-platform-bundle: 'false' setup-kotlin: 'true' - name: Install Go - uses: actions/setup-go@v5 + uses: actions/setup-go@v6 with: go-version: ${{ inputs.go-version || '>=1.21.0' }} cache: false diff --git a/.github/workflows/__upload-ref-sha-input.yml b/.github/workflows/__upload-ref-sha-input.yml index b991e7d36..2b0e1c57a 100644 --- a/.github/workflows/__upload-ref-sha-input.yml +++ b/.github/workflows/__upload-ref-sha-input.yml @@ -63,7 +63,7 @@ jobs: use-all-platform-bundle: 'false' setup-kotlin: 'true' - name: Install Go - uses: actions/setup-go@v5 + uses: actions/setup-go@v6 with: go-version: ${{ inputs.go-version || '>=1.21.0' }} cache: false diff --git a/.github/workflows/__with-checkout-path.yml b/.github/workflows/__with-checkout-path.yml index 223d37642..67a7a915d 100644 --- a/.github/workflows/__with-checkout-path.yml +++ b/.github/workflows/__with-checkout-path.yml @@ -63,7 +63,7 @@ jobs: use-all-platform-bundle: 'false' setup-kotlin: 'true' - name: Install Go - uses: actions/setup-go@v5 + uses: actions/setup-go@v6 with: go-version: ${{ inputs.go-version || '>=1.21.0' }} cache: false diff --git a/.github/workflows/codescanning-config-cli.yml b/.github/workflows/codescanning-config-cli.yml index 925e5ce17..afa9ba6ee 100644 --- a/.github/workflows/codescanning-config-cli.yml +++ b/.github/workflows/codescanning-config-cli.yml @@ -57,7 +57,7 @@ jobs: uses: actions/checkout@v5 - name: Set up Node.js - uses: actions/setup-node@v4 + uses: actions/setup-node@v5 with: node-version: '20' cache: 'npm' diff --git a/.github/workflows/debug-artifacts-failure-safe.yml b/.github/workflows/debug-artifacts-failure-safe.yml index 6cba08900..5d5ef24ac 100644 --- a/.github/workflows/debug-artifacts-failure-safe.yml +++ b/.github/workflows/debug-artifacts-failure-safe.yml @@ -45,7 +45,7 @@ jobs: uses: ./.github/actions/prepare-test with: version: ${{ matrix.version }} - - uses: actions/setup-go@v5 + - uses: actions/setup-go@v6 with: go-version: ^1.13.1 - uses: ./../action/init diff --git a/.github/workflows/debug-artifacts-safe.yml b/.github/workflows/debug-artifacts-safe.yml index 25a9cecc5..287cbfe23 100644 --- a/.github/workflows/debug-artifacts-safe.yml +++ b/.github/workflows/debug-artifacts-safe.yml @@ -41,7 +41,7 @@ jobs: uses: ./.github/actions/prepare-test with: version: ${{ matrix.version }} - - uses: actions/setup-go@v5 + - uses: actions/setup-go@v6 with: go-version: ^1.13.1 - uses: ./../action/init diff --git a/.github/workflows/post-release-mergeback.yml b/.github/workflows/post-release-mergeback.yml index 67d7e9493..bb5f8296e 100644 --- a/.github/workflows/post-release-mergeback.yml +++ b/.github/workflows/post-release-mergeback.yml @@ -43,7 +43,7 @@ jobs: - uses: actions/checkout@v5 with: fetch-depth: 0 # ensure we have all tags and can push commits - - uses: actions/setup-node@v4 + - uses: actions/setup-node@v5 - name: Update git config run: | diff --git a/.github/workflows/pr-checks.yml b/.github/workflows/pr-checks.yml index 365b53a94..0b6dba8a4 100644 --- a/.github/workflows/pr-checks.yml +++ b/.github/workflows/pr-checks.yml @@ -25,13 +25,13 @@ jobs: - uses: actions/checkout@v5 - name: Set up Node.js - uses: actions/setup-node@v4 + uses: actions/setup-node@v5 with: node-version: '20.x' cache: 'npm' - name: Set up Python - uses: actions/setup-python@v5 + uses: actions/setup-python@v6 with: python-version: 3.11 diff --git a/.github/workflows/python312-windows.yml b/.github/workflows/python312-windows.yml index 80944886b..98ab5667b 100644 --- a/.github/workflows/python312-windows.yml +++ b/.github/workflows/python312-windows.yml @@ -22,7 +22,7 @@ jobs: runs-on: windows-latest steps: - - uses: actions/setup-python@v5 + - uses: actions/setup-python@v6 with: python-version: 3.12 diff --git a/.github/workflows/query-filters.yml b/.github/workflows/query-filters.yml index 1014b4e55..2d2ab3c71 100644 --- a/.github/workflows/query-filters.yml +++ b/.github/workflows/query-filters.yml @@ -27,7 +27,7 @@ jobs: uses: actions/checkout@v5 - name: Install Node.js - uses: actions/setup-node@v4 + uses: actions/setup-node@v5 with: node-version: 20.x cache: npm diff --git a/.github/workflows/rebuild.yml b/.github/workflows/rebuild.yml index 9ac5e64e0..ec43df50e 100644 --- a/.github/workflows/rebuild.yml +++ b/.github/workflows/rebuild.yml @@ -68,7 +68,7 @@ jobs: npm run build - name: Set up Python - uses: actions/setup-python@v5 + uses: actions/setup-python@v6 with: python-version: 3.11 diff --git a/.github/workflows/update-bundle.yml b/.github/workflows/update-bundle.yml index 10f5be738..8e7ad48d8 100644 --- a/.github/workflows/update-bundle.yml +++ b/.github/workflows/update-bundle.yml @@ -37,7 +37,7 @@ jobs: git config --global user.name "github-actions[bot]" - name: Set up Node.js - uses: actions/setup-node@v4 + uses: actions/setup-node@v5 with: node-version: '20.x' cache: 'npm' diff --git a/.github/workflows/update-proxy-release.yml b/.github/workflows/update-proxy-release.yml index 5fc3b14b5..e43e40d60 100644 --- a/.github/workflows/update-proxy-release.yml +++ b/.github/workflows/update-proxy-release.yml @@ -37,7 +37,7 @@ jobs: (gh release view --repo "$GITHUB_REPOSITORY" --json "assets" "$RELEASE_TAG" && echo "Release found.") || exit 1 - name: Install Node - uses: actions/setup-node@v4 + uses: actions/setup-node@v5 - name: Checkout repository uses: actions/checkout@v5 diff --git a/.github/workflows/update-supported-enterprise-server-versions.yml b/.github/workflows/update-supported-enterprise-server-versions.yml index 80785a826..35d4ba01f 100644 --- a/.github/workflows/update-supported-enterprise-server-versions.yml +++ b/.github/workflows/update-supported-enterprise-server-versions.yml @@ -17,7 +17,7 @@ jobs: steps: - name: Setup Python - uses: actions/setup-python@v5 + uses: actions/setup-python@v6 with: python-version: "3.13" - name: Checkout CodeQL Action From 436471d2fbcc14b0e324fcfa9cd20d5d897b1626 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Tue, 9 Sep 2025 16:16:43 +0000 Subject: [PATCH 02/53] Initial plan From 8d31b533a271fcac59e4170c0f978ec15302d4e1 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Wed, 10 Sep 2025 09:39:16 +0000 Subject: [PATCH 03/53] Add sync-back automation for Dependabot action version updates Co-authored-by: henrymercer <14129055+henrymercer@users.noreply.github.com> --- pr-checks/checks/bundle-toolcache.yml | 6 +- pr-checks/checks/bundle-zstd.yml | 4 +- pr-checks/checks/config-export.yml | 2 +- pr-checks/checks/diagnostics-export.yml | 2 +- ...indirect-tracing-workaround-diagnostic.yml | 4 +- ...ect-tracing-workaround-no-file-program.yml | 2 +- pr-checks/checks/quality-queries.yml | 4 +- pr-checks/readme.md | 24 ++ pr-checks/sync-back.py | 232 ++++++++++++++++++ pr-checks/sync-back.sh | 25 ++ pr-checks/sync.py | 4 +- 11 files changed, 295 insertions(+), 14 deletions(-) create mode 100755 pr-checks/sync-back.py create mode 100755 pr-checks/sync-back.sh diff --git a/pr-checks/checks/bundle-toolcache.yml b/pr-checks/checks/bundle-toolcache.yml index d384cefee..d3a15fcb4 100644 --- a/pr-checks/checks/bundle-toolcache.yml +++ b/pr-checks/checks/bundle-toolcache.yml @@ -8,7 +8,7 @@ operatingSystems: - windows steps: - name: Remove CodeQL from toolcache - uses: actions/github-script@v7 + uses: actions/github-script@v8 with: script: | const fs = require('fs'); @@ -18,7 +18,7 @@ steps: - name: Install @actions/tool-cache run: npm install @actions/tool-cache - name: Check toolcache does not contain CodeQL - uses: actions/github-script@v7 + uses: actions/github-script@v8 with: script: | const toolcache = require('@actions/tool-cache'); @@ -37,7 +37,7 @@ steps: output: ${{ runner.temp }}/results upload-database: false - name: Check CodeQL is installed within the toolcache - uses: actions/github-script@v7 + uses: actions/github-script@v8 with: script: | const toolcache = require('@actions/tool-cache'); diff --git a/pr-checks/checks/bundle-zstd.yml b/pr-checks/checks/bundle-zstd.yml index de83d8e92..2ec8b3b8d 100644 --- a/pr-checks/checks/bundle-zstd.yml +++ b/pr-checks/checks/bundle-zstd.yml @@ -8,7 +8,7 @@ operatingSystems: - windows steps: - name: Remove CodeQL from toolcache - uses: actions/github-script@v7 + uses: actions/github-script@v8 with: script: | const fs = require('fs'); @@ -33,7 +33,7 @@ steps: path: ${{ runner.temp }}/results/javascript.sarif retention-days: 7 - name: Check diagnostic with expected tools URL appears in SARIF - uses: actions/github-script@v7 + uses: actions/github-script@v8 env: SARIF_PATH: ${{ runner.temp }}/results/javascript.sarif with: diff --git a/pr-checks/checks/config-export.yml b/pr-checks/checks/config-export.yml index ce9448256..c51ad04e2 100644 --- a/pr-checks/checks/config-export.yml +++ b/pr-checks/checks/config-export.yml @@ -18,7 +18,7 @@ steps: path: "${{ runner.temp }}/results/javascript.sarif" retention-days: 7 - name: Check config properties appear in SARIF - uses: actions/github-script@v7 + uses: actions/github-script@v8 env: SARIF_PATH: "${{ runner.temp }}/results/javascript.sarif" with: diff --git a/pr-checks/checks/diagnostics-export.yml b/pr-checks/checks/diagnostics-export.yml index c4e4f3d45..dd41b8df9 100644 --- a/pr-checks/checks/diagnostics-export.yml +++ b/pr-checks/checks/diagnostics-export.yml @@ -32,7 +32,7 @@ steps: path: "${{ runner.temp }}/results/javascript.sarif" retention-days: 7 - name: Check diagnostics appear in SARIF - uses: actions/github-script@v7 + uses: actions/github-script@v8 env: SARIF_PATH: "${{ runner.temp }}/results/javascript.sarif" with: diff --git a/pr-checks/checks/go-indirect-tracing-workaround-diagnostic.yml b/pr-checks/checks/go-indirect-tracing-workaround-diagnostic.yml index bfe7afb38..0768bd58a 100644 --- a/pr-checks/checks/go-indirect-tracing-workaround-diagnostic.yml +++ b/pr-checks/checks/go-indirect-tracing-workaround-diagnostic.yml @@ -12,7 +12,7 @@ steps: languages: go tools: ${{ steps.prepare-test.outputs.tools-url }} # Deliberately change Go after the `init` step - - uses: actions/setup-go@v5 + - uses: actions/setup-go@v6 with: go-version: "1.20" - name: Build code @@ -23,7 +23,7 @@ steps: output: "${{ runner.temp }}/results" upload-database: false - name: Check diagnostic appears in SARIF - uses: actions/github-script@v7 + uses: actions/github-script@v8 env: SARIF_PATH: "${{ runner.temp }}/results/go.sarif" with: diff --git a/pr-checks/checks/go-indirect-tracing-workaround-no-file-program.yml b/pr-checks/checks/go-indirect-tracing-workaround-no-file-program.yml index 9db4cad64..4f9e5eed2 100644 --- a/pr-checks/checks/go-indirect-tracing-workaround-no-file-program.yml +++ b/pr-checks/checks/go-indirect-tracing-workaround-no-file-program.yml @@ -24,7 +24,7 @@ steps: output: "${{ runner.temp }}/results" upload-database: false - name: Check diagnostic appears in SARIF - uses: actions/github-script@v7 + uses: actions/github-script@v8 env: SARIF_PATH: "${{ runner.temp }}/results/go.sarif" with: diff --git a/pr-checks/checks/quality-queries.yml b/pr-checks/checks/quality-queries.yml index 9eb578171..b8420ad20 100644 --- a/pr-checks/checks/quality-queries.yml +++ b/pr-checks/checks/quality-queries.yml @@ -54,7 +54,7 @@ steps: retention-days: 7 - name: Check quality query does not appear in security SARIF if: contains(matrix.analysis-kinds, 'code-scanning') - uses: actions/github-script@v7 + uses: actions/github-script@v8 env: SARIF_PATH: "${{ runner.temp }}/results/javascript.sarif" EXPECT_PRESENT: "false" @@ -62,7 +62,7 @@ steps: script: ${{ env.CHECK_SCRIPT }} - name: Check quality query appears in quality SARIF if: contains(matrix.analysis-kinds, 'code-quality') - uses: actions/github-script@v7 + uses: actions/github-script@v8 env: SARIF_PATH: "${{ runner.temp }}/results/javascript.quality.sarif" EXPECT_PRESENT: "true" diff --git a/pr-checks/readme.md b/pr-checks/readme.md index 618a67503..e96949c04 100644 --- a/pr-checks/readme.md +++ b/pr-checks/readme.md @@ -12,3 +12,27 @@ to one of the files in this directory. ### If you don't want to intall `just` Manually run each step in the `justfile`. + +## Sync-back automation + +When Dependabot updates action versions in the generated workflow files (`.github/workflows/__*.yml`), +the sync-back automation ensures those changes are properly reflected in the source templates. + +### Running sync-back manually + +To sync action versions from generated workflows back to source templates: + +```bash +# Dry run to see what would be changed +./pr-checks/sync-back.sh --dry-run --verbose + +# Actually apply the changes +./pr-checks/sync-back.sh +``` + +The sync-back script (`sync-back.py`) automatically updates: +- Hardcoded action versions in `pr-checks/sync.py` +- Action version references in template files in `pr-checks/checks/` +- Action version references in regular workflow files + +This ensures that the `verify-pr-checks.sh` test always passes after Dependabot PRs. diff --git a/pr-checks/sync-back.py b/pr-checks/sync-back.py new file mode 100755 index 000000000..45e4d333f --- /dev/null +++ b/pr-checks/sync-back.py @@ -0,0 +1,232 @@ +#!/usr/bin/env python3 +""" +Sync-back script to automatically update action versions in source templates +from the generated workflow files after Dependabot updates. + +This script scans the generated workflow files (.github/workflows/__*.yml) to find +the latest action versions used, then updates: +1. Hardcoded action versions in pr-checks/sync.py +2. Action version references in template files in pr-checks/checks/ +3. Action version references in regular workflow files + +This ensures that when Dependabot updates action versions in generated workflows, +those changes are properly synced back to the source templates. +""" + +import os +import re +import glob +import argparse +import sys +from pathlib import Path +from typing import Dict, Set, List, Tuple + + +def scan_generated_workflows(workflow_dir: str) -> Dict[str, str]: + """ + Scan generated workflow files to extract the latest action versions. + + Args: + workflow_dir: Path to .github/workflows directory + + Returns: + Dictionary mapping action names to their latest versions + """ + action_versions = {} + generated_files = glob.glob(os.path.join(workflow_dir, "__*.yml")) + + # Actions we care about syncing + target_actions = { + 'actions/setup-go', + 'actions/setup-node', + 'actions/setup-python', + 'actions/github-script' + } + + for file_path in generated_files: + with open(file_path, 'r') as f: + content = f.read() + + # Find all action uses in the file + pattern = r'uses:\s+(actions/[^@\s]+)@([^@\s]+)' + matches = re.findall(pattern, content) + + for action_name, version in matches: + if action_name in target_actions: + # Take the latest version seen (they should all be the same after Dependabot) + action_versions[action_name] = version + + return action_versions + + +def update_sync_py(sync_py_path: str, action_versions: Dict[str, str]) -> bool: + """ + Update hardcoded action versions in pr-checks/sync.py + + Args: + sync_py_path: Path to sync.py file + action_versions: Dictionary of action names to versions + + Returns: + True if file was modified, False otherwise + """ + if not os.path.exists(sync_py_path): + print(f"Warning: {sync_py_path} not found") + return False + + with open(sync_py_path, 'r') as f: + content = f.read() + + original_content = content + + # Update hardcoded action versions + for action_name, version in action_versions.items(): + # Look for patterns like 'uses': 'actions/setup-node@v4' + pattern = rf"('uses':\s*')(actions/{action_name.split('/')[-1]})@([^']+)(')" + replacement = rf"\1\2@{version}\4" + content = re.sub(pattern, replacement, content) + + if content != original_content: + with open(sync_py_path, 'w') as f: + f.write(content) + print(f"Updated {sync_py_path}") + return True + else: + print(f"No changes needed in {sync_py_path}") + return False + + +def update_template_files(checks_dir: str, action_versions: Dict[str, str]) -> List[str]: + """ + Update action versions in template files in pr-checks/checks/ + + Args: + checks_dir: Path to pr-checks/checks directory + action_versions: Dictionary of action names to versions + + Returns: + List of files that were modified + """ + modified_files = [] + template_files = glob.glob(os.path.join(checks_dir, "*.yml")) + + for file_path in template_files: + with open(file_path, 'r') as f: + content = f.read() + + original_content = content + + # Update action versions + for action_name, version in action_versions.items(): + # Look for patterns like 'uses: actions/setup-node@v4' + pattern = rf"(uses:\s+{re.escape(action_name)})@([^@\s]+)" + replacement = rf"\1@{version}" + content = re.sub(pattern, replacement, content) + + if content != original_content: + with open(file_path, 'w') as f: + f.write(content) + modified_files.append(file_path) + print(f"Updated {file_path}") + + return modified_files + + +def update_regular_workflows(workflow_dir: str, action_versions: Dict[str, str]) -> List[str]: + """ + Update action versions in regular (non-generated) workflow files + + Args: + workflow_dir: Path to .github/workflows directory + action_versions: Dictionary of action names to versions + + Returns: + List of files that were modified + """ + modified_files = [] + + # Get all workflow files that are NOT generated (don't start with __) + all_files = glob.glob(os.path.join(workflow_dir, "*.yml")) + regular_files = [f for f in all_files if not os.path.basename(f).startswith("__")] + + for file_path in regular_files: + with open(file_path, 'r') as f: + content = f.read() + + original_content = content + + # Update action versions + for action_name, version in action_versions.items(): + # Look for patterns like 'uses: actions/setup-node@v4' + pattern = rf"(uses:\s+{re.escape(action_name)})@([^@\s]+)" + replacement = rf"\1@{version}" + content = re.sub(pattern, replacement, content) + + if content != original_content: + with open(file_path, 'w') as f: + f.write(content) + modified_files.append(file_path) + print(f"Updated {file_path}") + + return modified_files + + +def main(): + parser = argparse.ArgumentParser(description="Sync action versions from generated workflows back to templates") + parser.add_argument("--dry-run", action="store_true", help="Show what would be changed without making changes") + parser.add_argument("--verbose", "-v", action="store_true", help="Enable verbose output") + args = parser.parse_args() + + # Get the repository root (assuming script is in pr-checks/) + script_dir = Path(__file__).parent + repo_root = script_dir.parent + + workflow_dir = repo_root / ".github" / "workflows" + checks_dir = script_dir / "checks" + sync_py_path = script_dir / "sync.py" + + print("Scanning generated workflows for latest action versions...") + action_versions = scan_generated_workflows(str(workflow_dir)) + + if args.verbose: + print("Found action versions:") + for action, version in action_versions.items(): + print(f" {action}@{version}") + + if not action_versions: + print("No action versions found in generated workflows") + return 1 + + if args.dry_run: + print("\nDRY RUN - Would make the following changes:") + print(f"Action versions to sync: {action_versions}") + return 0 + + # Update files + print("\nUpdating source files...") + modified_files = [] + + # Update sync.py + if update_sync_py(str(sync_py_path), action_versions): + modified_files.append(str(sync_py_path)) + + # Update template files + template_modified = update_template_files(str(checks_dir), action_versions) + modified_files.extend(template_modified) + + # Update regular workflow files + workflow_modified = update_regular_workflows(str(workflow_dir), action_versions) + modified_files.extend(workflow_modified) + + if modified_files: + print(f"\nSync completed. Modified {len(modified_files)} files:") + for file_path in modified_files: + print(f" {file_path}") + else: + print("\nNo files needed updating - all action versions are already in sync") + + return 0 + + +if __name__ == "__main__": + sys.exit(main()) \ No newline at end of file diff --git a/pr-checks/sync-back.sh b/pr-checks/sync-back.sh new file mode 100755 index 000000000..7a3db6194 --- /dev/null +++ b/pr-checks/sync-back.sh @@ -0,0 +1,25 @@ +#!/bin/bash + +# Sync-back wrapper script +# This script runs the sync-back.py Python script to automatically sync +# Dependabot action version updates back to the source templates. + +set -euo pipefail + +SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" +SYNC_BACK_PY="${SCRIPT_DIR}/sync-back.py" + +# Check if Python script exists +if [[ ! -f "$SYNC_BACK_PY" ]]; then + echo "Error: sync-back.py not found at $SYNC_BACK_PY" >&2 + exit 1 +fi + +# Make sure the Python script is executable +chmod +x "$SYNC_BACK_PY" + +# Run the sync-back script with all provided arguments +echo "Running sync-back automation..." +python3 "$SYNC_BACK_PY" "$@" + +echo "Sync-back completed successfully." \ No newline at end of file diff --git a/pr-checks/sync.py b/pr-checks/sync.py index 6d23cafab..e76945cc4 100755 --- a/pr-checks/sync.py +++ b/pr-checks/sync.py @@ -127,7 +127,7 @@ for file in sorted((this_dir / 'checks').glob('*.yml')): steps.extend([ { 'name': 'Install Node.js', - 'uses': 'actions/setup-node@v4', + 'uses': 'actions/setup-node@v5', 'with': { 'node-version': '20.x', 'cache': 'npm', @@ -165,7 +165,7 @@ for file in sorted((this_dir / 'checks').glob('*.yml')): steps.append({ 'name': 'Install Go', - 'uses': 'actions/setup-go@v5', + 'uses': 'actions/setup-go@v6', 'with': { 'go-version': '${{ inputs.go-version || \'' + baseGoVersionExpr + '\' }}', # to avoid potentially misleading autobuilder results where we expect it to download From f77ed607fd888340dd3b035d106b102f5033d792 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Wed, 10 Sep 2025 16:00:52 +0000 Subject: [PATCH 04/53] Improve sync-back automation with automatic action detection, comment preservation, and tests Co-authored-by: henrymercer <14129055+henrymercer@users.noreply.github.com> --- pr-checks/.gitignore | 2 + pr-checks/readme.md | 17 +- pr-checks/sync-back.py | 56 +++--- pr-checks/sync-back.sh | 25 --- pr-checks/test_sync_back.py | 339 ++++++++++++++++++++++++++++++++++++ 5 files changed, 383 insertions(+), 56 deletions(-) delete mode 100755 pr-checks/sync-back.sh create mode 100644 pr-checks/test_sync_back.py diff --git a/pr-checks/.gitignore b/pr-checks/.gitignore index 0a764a4de..979f35ea9 100644 --- a/pr-checks/.gitignore +++ b/pr-checks/.gitignore @@ -1 +1,3 @@ env +__pycache__/ +*.pyc diff --git a/pr-checks/readme.md b/pr-checks/readme.md index e96949c04..4a0d45f70 100644 --- a/pr-checks/readme.md +++ b/pr-checks/readme.md @@ -18,21 +18,32 @@ Manually run each step in the `justfile`. When Dependabot updates action versions in the generated workflow files (`.github/workflows/__*.yml`), the sync-back automation ensures those changes are properly reflected in the source templates. +The sync-back script automatically detects all actions used in generated workflows and preserves +version comments (e.g., `# v1.2.3`) when syncing versions between files. + ### Running sync-back manually To sync action versions from generated workflows back to source templates: ```bash # Dry run to see what would be changed -./pr-checks/sync-back.sh --dry-run --verbose +python3 pr-checks/sync-back.py --dry-run --verbose # Actually apply the changes -./pr-checks/sync-back.sh +python3 pr-checks/sync-back.py ``` -The sync-back script (`sync-back.py`) automatically updates: +The sync-back script automatically updates: - Hardcoded action versions in `pr-checks/sync.py` - Action version references in template files in `pr-checks/checks/` - Action version references in regular workflow files This ensures that the `verify-pr-checks.sh` test always passes after Dependabot PRs. + +### Testing + +The sync-back script includes comprehensive tests that can be run with: + +```bash +python3 pr-checks/test_sync_back.py -v +``` diff --git a/pr-checks/sync-back.py b/pr-checks/sync-back.py index 45e4d333f..42c57ea90 100755 --- a/pr-checks/sync-back.py +++ b/pr-checks/sync-back.py @@ -4,11 +4,14 @@ Sync-back script to automatically update action versions in source templates from the generated workflow files after Dependabot updates. This script scans the generated workflow files (.github/workflows/__*.yml) to find -the latest action versions used, then updates: +all external action versions used, then updates: 1. Hardcoded action versions in pr-checks/sync.py 2. Action version references in template files in pr-checks/checks/ 3. Action version references in regular workflow files +The script automatically detects all actions used in generated workflows and +preserves version comments (e.g., # v1.2.3) when syncing versions. + This ensures that when Dependabot updates action versions in generated workflows, those changes are properly synced back to the source templates. """ @@ -30,31 +33,25 @@ def scan_generated_workflows(workflow_dir: str) -> Dict[str, str]: workflow_dir: Path to .github/workflows directory Returns: - Dictionary mapping action names to their latest versions + Dictionary mapping action names to their latest versions (including comments) """ action_versions = {} generated_files = glob.glob(os.path.join(workflow_dir, "__*.yml")) - # Actions we care about syncing - target_actions = { - 'actions/setup-go', - 'actions/setup-node', - 'actions/setup-python', - 'actions/github-script' - } - for file_path in generated_files: with open(file_path, 'r') as f: content = f.read() - # Find all action uses in the file - pattern = r'uses:\s+(actions/[^@\s]+)@([^@\s]+)' + # Find all action uses in the file, including potential comments + # This pattern captures: action_name@version_with_possible_comment + pattern = r'uses:\s+([^/\s]+/[^@\s]+)@([^@\n]+)' matches = re.findall(pattern, content) - for action_name, version in matches: - if action_name in target_actions: + for action_name, version_with_comment in matches: + # Only track non-local actions (those with / but not starting with ./) + if '/' in action_name and not action_name.startswith('./'): # Take the latest version seen (they should all be the same after Dependabot) - action_versions[action_name] = version + action_versions[action_name] = version_with_comment.rstrip() return action_versions @@ -65,7 +62,7 @@ def update_sync_py(sync_py_path: str, action_versions: Dict[str, str]) -> bool: Args: sync_py_path: Path to sync.py file - action_versions: Dictionary of action names to versions + action_versions: Dictionary of action names to versions (may include comments) Returns: True if file was modified, False otherwise @@ -80,9 +77,12 @@ def update_sync_py(sync_py_path: str, action_versions: Dict[str, str]) -> bool: original_content = content # Update hardcoded action versions - for action_name, version in action_versions.items(): + for action_name, version_with_comment in action_versions.items(): + # Extract just the version part (before any comment) for sync.py + version = version_with_comment.split('#')[0].strip() if '#' in version_with_comment else version_with_comment.strip() + # Look for patterns like 'uses': 'actions/setup-node@v4' - pattern = rf"('uses':\s*')(actions/{action_name.split('/')[-1]})@([^']+)(')" + pattern = rf"('uses':\s*')(actions/{re.escape(action_name.split('/')[-1])})@([^']+)(')" replacement = rf"\1\2@{version}\4" content = re.sub(pattern, replacement, content) @@ -102,7 +102,7 @@ def update_template_files(checks_dir: str, action_versions: Dict[str, str]) -> L Args: checks_dir: Path to pr-checks/checks directory - action_versions: Dictionary of action names to versions + action_versions: Dictionary of action names to versions (may include comments) Returns: List of files that were modified @@ -117,10 +117,10 @@ def update_template_files(checks_dir: str, action_versions: Dict[str, str]) -> L original_content = content # Update action versions - for action_name, version in action_versions.items(): - # Look for patterns like 'uses: actions/setup-node@v4' - pattern = rf"(uses:\s+{re.escape(action_name)})@([^@\s]+)" - replacement = rf"\1@{version}" + for action_name, version_with_comment in action_versions.items(): + # Look for patterns like 'uses: actions/setup-node@v4' or 'uses: actions/setup-node@sha # comment' + pattern = rf"(uses:\s+{re.escape(action_name)})@([^@\n]+)" + replacement = rf"\1@{version_with_comment}" content = re.sub(pattern, replacement, content) if content != original_content: @@ -138,7 +138,7 @@ def update_regular_workflows(workflow_dir: str, action_versions: Dict[str, str]) Args: workflow_dir: Path to .github/workflows directory - action_versions: Dictionary of action names to versions + action_versions: Dictionary of action names to versions (may include comments) Returns: List of files that were modified @@ -156,10 +156,10 @@ def update_regular_workflows(workflow_dir: str, action_versions: Dict[str, str]) original_content = content # Update action versions - for action_name, version in action_versions.items(): - # Look for patterns like 'uses: actions/setup-node@v4' - pattern = rf"(uses:\s+{re.escape(action_name)})@([^@\s]+)" - replacement = rf"\1@{version}" + for action_name, version_with_comment in action_versions.items(): + # Look for patterns like 'uses: actions/setup-node@v4' or 'uses: actions/setup-node@sha # comment' + pattern = rf"(uses:\s+{re.escape(action_name)})@([^@\n]+)" + replacement = rf"\1@{version_with_comment}" content = re.sub(pattern, replacement, content) if content != original_content: diff --git a/pr-checks/sync-back.sh b/pr-checks/sync-back.sh deleted file mode 100755 index 7a3db6194..000000000 --- a/pr-checks/sync-back.sh +++ /dev/null @@ -1,25 +0,0 @@ -#!/bin/bash - -# Sync-back wrapper script -# This script runs the sync-back.py Python script to automatically sync -# Dependabot action version updates back to the source templates. - -set -euo pipefail - -SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" -SYNC_BACK_PY="${SCRIPT_DIR}/sync-back.py" - -# Check if Python script exists -if [[ ! -f "$SYNC_BACK_PY" ]]; then - echo "Error: sync-back.py not found at $SYNC_BACK_PY" >&2 - exit 1 -fi - -# Make sure the Python script is executable -chmod +x "$SYNC_BACK_PY" - -# Run the sync-back script with all provided arguments -echo "Running sync-back automation..." -python3 "$SYNC_BACK_PY" "$@" - -echo "Sync-back completed successfully." \ No newline at end of file diff --git a/pr-checks/test_sync_back.py b/pr-checks/test_sync_back.py new file mode 100644 index 000000000..3f1c9e460 --- /dev/null +++ b/pr-checks/test_sync_back.py @@ -0,0 +1,339 @@ +#!/usr/bin/env python3 +""" +Tests for the sync-back.py script +""" + +import os +import tempfile +import shutil +import unittest +from pathlib import Path +from unittest.mock import patch +import sys + +# Add the current directory to sys.path and import the sync_back module +sys.path.insert(0, os.path.dirname(os.path.abspath(__file__))) + +# Import the sync-back module +import importlib.util +spec = importlib.util.spec_from_file_location("sync_back", os.path.join(os.path.dirname(__file__), "sync-back.py")) +sync_back = importlib.util.module_from_spec(spec) +spec.loader.exec_module(sync_back) + + +class TestSyncBack(unittest.TestCase): + + def setUp(self): + """Set up temporary directories and files for testing""" + self.test_dir = tempfile.mkdtemp() + self.workflow_dir = os.path.join(self.test_dir, ".github", "workflows") + self.checks_dir = os.path.join(self.test_dir, "pr-checks", "checks") + os.makedirs(self.workflow_dir) + os.makedirs(self.checks_dir) + + # Create sync.py file + self.sync_py_path = os.path.join(self.test_dir, "pr-checks", "sync.py") + + def tearDown(self): + """Clean up temporary directories""" + shutil.rmtree(self.test_dir) + + def test_scan_generated_workflows_basic(self): + """Test basic workflow scanning functionality""" + # Create a test generated workflow file + workflow_content = """ +name: Test Workflow +jobs: + test: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + - uses: actions/setup-node@v5 + - uses: actions/setup-go@v6 + """ + + with open(os.path.join(self.workflow_dir, "__test.yml"), 'w') as f: + f.write(workflow_content) + + result = sync_back.scan_generated_workflows(self.workflow_dir) + + self.assertEqual(result['actions/checkout'], 'v4') + self.assertEqual(result['actions/setup-node'], 'v5') + self.assertEqual(result['actions/setup-go'], 'v6') + + def test_scan_generated_workflows_with_comments(self): + """Test scanning workflows with version comments""" + workflow_content = """ +name: Test Workflow +jobs: + test: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + - uses: ruby/setup-ruby@44511735964dcb71245e7e55f72539531f7bc0eb # v1.257.0 + - uses: actions/setup-python@v6 # Latest Python + """ + + with open(os.path.join(self.workflow_dir, "__test.yml"), 'w') as f: + f.write(workflow_content) + + result = sync_back.scan_generated_workflows(self.workflow_dir) + + self.assertEqual(result['actions/checkout'], 'v4') + self.assertEqual(result['ruby/setup-ruby'], '44511735964dcb71245e7e55f72539531f7bc0eb # v1.257.0') + self.assertEqual(result['actions/setup-python'], 'v6 # Latest Python') + + def test_scan_generated_workflows_ignores_local_actions(self): + """Test that local actions (starting with ./) are ignored""" + workflow_content = """ +name: Test Workflow +jobs: + test: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + - uses: ./.github/actions/local-action + - uses: ./another-local-action@v1 + """ + + with open(os.path.join(self.workflow_dir, "__test.yml"), 'w') as f: + f.write(workflow_content) + + result = sync_back.scan_generated_workflows(self.workflow_dir) + + self.assertEqual(result['actions/checkout'], 'v4') + self.assertNotIn('./.github/actions/local-action', result) + self.assertNotIn('./another-local-action', result) + + def test_scan_generated_workflows_skips_non_generated(self): + """Test that non-generated files are ignored""" + # Create generated file + generated_content = """ +name: Generated +jobs: + test: + steps: + - uses: actions/checkout@v4 + """ + with open(os.path.join(self.workflow_dir, "__generated.yml"), 'w') as f: + f.write(generated_content) + + # Create regular file + regular_content = """ +name: Regular +jobs: + test: + steps: + - uses: actions/checkout@v3 + """ + with open(os.path.join(self.workflow_dir, "regular.yml"), 'w') as f: + f.write(regular_content) + + result = sync_back.scan_generated_workflows(self.workflow_dir) + + # Should only see the version from the generated file + self.assertEqual(result['actions/checkout'], 'v4') + + def test_update_sync_py(self): + """Test updating sync.py file""" + sync_py_content = """ +steps = [ + { + 'uses': 'actions/setup-node@v4', + 'with': {'node-version': '16'} + }, + { + 'uses': 'actions/setup-go@v5', + 'with': {'go-version': '1.19'} + } +] + """ + + with open(self.sync_py_path, 'w') as f: + f.write(sync_py_content) + + action_versions = { + 'actions/setup-node': 'v5', + 'actions/setup-go': 'v6' + } + + result = sync_back.update_sync_py(self.sync_py_path, action_versions) + self.assertTrue(result) + + with open(self.sync_py_path, 'r') as f: + updated_content = f.read() + + self.assertIn("'uses': 'actions/setup-node@v5'", updated_content) + self.assertIn("'uses': 'actions/setup-go@v6'", updated_content) + + def test_update_sync_py_with_comments(self): + """Test updating sync.py file when versions have comments""" + sync_py_content = """ +steps = [ + { + 'uses': 'actions/setup-node@v4', + 'with': {'node-version': '16'} + } +] + """ + + with open(self.sync_py_path, 'w') as f: + f.write(sync_py_content) + + action_versions = { + 'actions/setup-node': 'v5 # Latest version' + } + + result = sync_back.update_sync_py(self.sync_py_path, action_versions) + self.assertTrue(result) + + with open(self.sync_py_path, 'r') as f: + updated_content = f.read() + + # sync.py should get the version without comment + self.assertIn("'uses': 'actions/setup-node@v5'", updated_content) + self.assertNotIn("# Latest version", updated_content) + + def test_update_template_files(self): + """Test updating template files""" + template_content = """ +name: Test Template +steps: + - uses: actions/checkout@v3 + - uses: actions/setup-node@v4 + with: + node-version: 16 + """ + + template_path = os.path.join(self.checks_dir, "test.yml") + with open(template_path, 'w') as f: + f.write(template_content) + + action_versions = { + 'actions/checkout': 'v4', + 'actions/setup-node': 'v5 # Latest' + } + + result = sync_back.update_template_files(self.checks_dir, action_versions) + self.assertEqual(len(result), 1) + self.assertIn(template_path, result) + + with open(template_path, 'r') as f: + updated_content = f.read() + + self.assertIn("uses: actions/checkout@v4", updated_content) + self.assertIn("uses: actions/setup-node@v5 # Latest", updated_content) + + def test_update_template_files_preserves_comments(self): + """Test that updating template files preserves version comments""" + template_content = """ +name: Test Template +steps: + - uses: ruby/setup-ruby@44511735964dcb71245e7e55f72539531f7bc0eb # v1.256.0 + """ + + template_path = os.path.join(self.checks_dir, "test.yml") + with open(template_path, 'w') as f: + f.write(template_content) + + action_versions = { + 'ruby/setup-ruby': '55511735964dcb71245e7e55f72539531f7bc0eb # v1.257.0' + } + + result = sync_back.update_template_files(self.checks_dir, action_versions) + self.assertEqual(len(result), 1) + + with open(template_path, 'r') as f: + updated_content = f.read() + + self.assertIn("uses: ruby/setup-ruby@55511735964dcb71245e7e55f72539531f7bc0eb # v1.257.0", updated_content) + + def test_update_regular_workflows(self): + """Test updating regular workflow files""" + # Create a regular workflow file + workflow_content = """ +name: Regular Workflow +jobs: + test: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v3 + - uses: actions/setup-node@v4 + """ + + workflow_path = os.path.join(self.workflow_dir, "regular.yml") + with open(workflow_path, 'w') as f: + f.write(workflow_content) + + # Create a generated workflow file (should be ignored) + generated_path = os.path.join(self.workflow_dir, "__generated.yml") + with open(generated_path, 'w') as f: + f.write(workflow_content) + + action_versions = { + 'actions/checkout': 'v4', + 'actions/setup-node': 'v5' + } + + result = sync_back.update_regular_workflows(self.workflow_dir, action_versions) + + # Should only update the regular file, not the generated one + self.assertEqual(len(result), 1) + self.assertIn(workflow_path, result) + self.assertNotIn(generated_path, result) + + with open(workflow_path, 'r') as f: + updated_content = f.read() + + self.assertIn("uses: actions/checkout@v4", updated_content) + self.assertIn("uses: actions/setup-node@v5", updated_content) + + def test_no_changes_needed(self): + """Test that functions return False/empty when no changes are needed""" + # Test sync.py with no changes needed + sync_py_content = """ +steps = [ + { + 'uses': 'actions/setup-node@v5', + 'with': {'node-version': '16'} + } +] + """ + + with open(self.sync_py_path, 'w') as f: + f.write(sync_py_content) + + action_versions = { + 'actions/setup-node': 'v5' + } + + result = sync_back.update_sync_py(self.sync_py_path, action_versions) + self.assertFalse(result) + + def test_missing_sync_py_file(self): + """Test handling of missing sync.py file""" + result = sync_back.update_sync_py("/nonexistent/sync.py", {}) + self.assertFalse(result) + + def test_main_dry_run(self): + """Test that dry-run functionality works""" + # Create a test workflow + workflow_content = """ +name: Test +jobs: + test: + steps: + - uses: actions/checkout@v4 + """ + + with open(os.path.join(self.workflow_dir, "__test.yml"), 'w') as f: + f.write(workflow_content) + + # Test the scanning function directly since mocking main() is complex + result = sync_back.scan_generated_workflows(self.workflow_dir) + self.assertIn('actions/checkout', result) + self.assertEqual(result['actions/checkout'], 'v4') + + +if __name__ == '__main__': + unittest.main() \ No newline at end of file From 5d79536231a53872a4b9a0de3411242a170997f2 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Wed, 10 Sep 2025 16:53:17 +0000 Subject: [PATCH 05/53] Remove regular workflow file updates from sync-back script Co-authored-by: henrymercer <14129055+henrymercer@users.noreply.github.com> --- pr-checks/readme.md | 3 ++- pr-checks/sync-back.py | 47 ++----------------------------------- pr-checks/test_sync_back.py | 40 ------------------------------- 3 files changed, 4 insertions(+), 86 deletions(-) diff --git a/pr-checks/readme.md b/pr-checks/readme.md index 4a0d45f70..042e288e0 100644 --- a/pr-checks/readme.md +++ b/pr-checks/readme.md @@ -36,7 +36,8 @@ python3 pr-checks/sync-back.py The sync-back script automatically updates: - Hardcoded action versions in `pr-checks/sync.py` - Action version references in template files in `pr-checks/checks/` -- Action version references in regular workflow files + +Regular workflow files are updated directly by Dependabot and don't need sync-back. This ensures that the `verify-pr-checks.sh` test always passes after Dependabot PRs. diff --git a/pr-checks/sync-back.py b/pr-checks/sync-back.py index 42c57ea90..35d36e575 100755 --- a/pr-checks/sync-back.py +++ b/pr-checks/sync-back.py @@ -7,13 +7,13 @@ This script scans the generated workflow files (.github/workflows/__*.yml) to fi all external action versions used, then updates: 1. Hardcoded action versions in pr-checks/sync.py 2. Action version references in template files in pr-checks/checks/ -3. Action version references in regular workflow files The script automatically detects all actions used in generated workflows and preserves version comments (e.g., # v1.2.3) when syncing versions. This ensures that when Dependabot updates action versions in generated workflows, -those changes are properly synced back to the source templates. +those changes are properly synced back to the source templates. Regular workflow +files are updated directly by Dependabot and don't need sync-back. """ import os @@ -132,45 +132,6 @@ def update_template_files(checks_dir: str, action_versions: Dict[str, str]) -> L return modified_files -def update_regular_workflows(workflow_dir: str, action_versions: Dict[str, str]) -> List[str]: - """ - Update action versions in regular (non-generated) workflow files - - Args: - workflow_dir: Path to .github/workflows directory - action_versions: Dictionary of action names to versions (may include comments) - - Returns: - List of files that were modified - """ - modified_files = [] - - # Get all workflow files that are NOT generated (don't start with __) - all_files = glob.glob(os.path.join(workflow_dir, "*.yml")) - regular_files = [f for f in all_files if not os.path.basename(f).startswith("__")] - - for file_path in regular_files: - with open(file_path, 'r') as f: - content = f.read() - - original_content = content - - # Update action versions - for action_name, version_with_comment in action_versions.items(): - # Look for patterns like 'uses: actions/setup-node@v4' or 'uses: actions/setup-node@sha # comment' - pattern = rf"(uses:\s+{re.escape(action_name)})@([^@\n]+)" - replacement = rf"\1@{version_with_comment}" - content = re.sub(pattern, replacement, content) - - if content != original_content: - with open(file_path, 'w') as f: - f.write(content) - modified_files.append(file_path) - print(f"Updated {file_path}") - - return modified_files - - def main(): parser = argparse.ArgumentParser(description="Sync action versions from generated workflows back to templates") parser.add_argument("--dry-run", action="store_true", help="Show what would be changed without making changes") @@ -214,10 +175,6 @@ def main(): template_modified = update_template_files(str(checks_dir), action_versions) modified_files.extend(template_modified) - # Update regular workflow files - workflow_modified = update_regular_workflows(str(workflow_dir), action_versions) - modified_files.extend(workflow_modified) - if modified_files: print(f"\nSync completed. Modified {len(modified_files)} files:") for file_path in modified_files: diff --git a/pr-checks/test_sync_back.py b/pr-checks/test_sync_back.py index 3f1c9e460..eeb525870 100644 --- a/pr-checks/test_sync_back.py +++ b/pr-checks/test_sync_back.py @@ -248,46 +248,6 @@ steps: self.assertIn("uses: ruby/setup-ruby@55511735964dcb71245e7e55f72539531f7bc0eb # v1.257.0", updated_content) - def test_update_regular_workflows(self): - """Test updating regular workflow files""" - # Create a regular workflow file - workflow_content = """ -name: Regular Workflow -jobs: - test: - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v3 - - uses: actions/setup-node@v4 - """ - - workflow_path = os.path.join(self.workflow_dir, "regular.yml") - with open(workflow_path, 'w') as f: - f.write(workflow_content) - - # Create a generated workflow file (should be ignored) - generated_path = os.path.join(self.workflow_dir, "__generated.yml") - with open(generated_path, 'w') as f: - f.write(workflow_content) - - action_versions = { - 'actions/checkout': 'v4', - 'actions/setup-node': 'v5' - } - - result = sync_back.update_regular_workflows(self.workflow_dir, action_versions) - - # Should only update the regular file, not the generated one - self.assertEqual(len(result), 1) - self.assertIn(workflow_path, result) - self.assertNotIn(generated_path, result) - - with open(workflow_path, 'r') as f: - updated_content = f.read() - - self.assertIn("uses: actions/checkout@v4", updated_content) - self.assertIn("uses: actions/setup-node@v5", updated_content) - def test_no_changes_needed(self): """Test that functions return False/empty when no changes are needed""" # Test sync.py with no changes needed From f5371102858eb38af0cdfb146b6e204bfdfc15f7 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Wed, 10 Sep 2025 16:59:28 +0000 Subject: [PATCH 06/53] Add sync-back script execution to rebuild workflow Co-authored-by: henrymercer <14129055+henrymercer@users.noreply.github.com> --- .github/workflows/rebuild.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/rebuild.yml b/.github/workflows/rebuild.yml index ec43df50e..b3c40dd7f 100644 --- a/.github/workflows/rebuild.yml +++ b/.github/workflows/rebuild.yml @@ -77,6 +77,7 @@ jobs: cd pr-checks python -m pip install --upgrade pip pip install ruamel.yaml==0.17.31 + python3 sync-back.py python3 sync.py - name: "Merge in progress: Finish merge and push" From d9bc711b1c9fe8f539aa0d1ae7e5e82fd807cf63 Mon Sep 17 00:00:00 2001 From: Henry Mercer Date: Wed, 10 Sep 2025 18:12:20 +0100 Subject: [PATCH 07/53] Rename script for consistency --- .github/workflows/rebuild.yml | 2 +- pr-checks/readme.md | 4 ++-- pr-checks/{sync-back.py => sync_back.py} | 0 pr-checks/test_sync_back.py | 10 ++++------ 4 files changed, 7 insertions(+), 9 deletions(-) rename pr-checks/{sync-back.py => sync_back.py} (100%) diff --git a/.github/workflows/rebuild.yml b/.github/workflows/rebuild.yml index b3c40dd7f..cfce78713 100644 --- a/.github/workflows/rebuild.yml +++ b/.github/workflows/rebuild.yml @@ -77,7 +77,7 @@ jobs: cd pr-checks python -m pip install --upgrade pip pip install ruamel.yaml==0.17.31 - python3 sync-back.py + python3 sync_back.py python3 sync.py - name: "Merge in progress: Finish merge and push" diff --git a/pr-checks/readme.md b/pr-checks/readme.md index 042e288e0..58c6b9412 100644 --- a/pr-checks/readme.md +++ b/pr-checks/readme.md @@ -27,10 +27,10 @@ To sync action versions from generated workflows back to source templates: ```bash # Dry run to see what would be changed -python3 pr-checks/sync-back.py --dry-run --verbose +python3 pr-checks/sync_back.py --dry-run --verbose # Actually apply the changes -python3 pr-checks/sync-back.py +python3 pr-checks/sync_back.py ``` The sync-back script automatically updates: diff --git a/pr-checks/sync-back.py b/pr-checks/sync_back.py similarity index 100% rename from pr-checks/sync-back.py rename to pr-checks/sync_back.py diff --git a/pr-checks/test_sync_back.py b/pr-checks/test_sync_back.py index eeb525870..37fc03133 100644 --- a/pr-checks/test_sync_back.py +++ b/pr-checks/test_sync_back.py @@ -1,22 +1,20 @@ #!/usr/bin/env python3 """ -Tests for the sync-back.py script +Tests for the sync_back.py script """ import os -import tempfile import shutil -import unittest -from pathlib import Path -from unittest.mock import patch import sys +import tempfile +import unittest # Add the current directory to sys.path and import the sync_back module sys.path.insert(0, os.path.dirname(os.path.abspath(__file__))) # Import the sync-back module import importlib.util -spec = importlib.util.spec_from_file_location("sync_back", os.path.join(os.path.dirname(__file__), "sync-back.py")) +spec = importlib.util.spec_from_file_location("sync_back", os.path.join(os.path.dirname(__file__), "sync_back.py")) sync_back = importlib.util.module_from_spec(spec) spec.loader.exec_module(sync_back) From d08f9295109931df92ba738efdd68362d92e9436 Mon Sep 17 00:00:00 2001 From: Henry Mercer Date: Wed, 10 Sep 2025 18:12:29 +0100 Subject: [PATCH 08/53] Run test script in CI --- .github/workflows/pr-checks.yml | 4 ++++ pr-checks/__init__.py | 0 2 files changed, 4 insertions(+) create mode 100644 pr-checks/__init__.py diff --git a/.github/workflows/pr-checks.yml b/.github/workflows/pr-checks.yml index 0b6dba8a4..37140e4e5 100644 --- a/.github/workflows/pr-checks.yml +++ b/.github/workflows/pr-checks.yml @@ -51,6 +51,10 @@ jobs: - name: Run unit tests run: npm test + - name: Run pr-checks tests + working-directory: pr-checks + run: python -m unittest discover + - name: Lint if: matrix.os != 'windows-latest' run: npm run lint-ci diff --git a/pr-checks/__init__.py b/pr-checks/__init__.py new file mode 100644 index 000000000..e69de29bb From cde0d796a647ee8286d3f9afcfb752c9e3415c1a Mon Sep 17 00:00:00 2001 From: Henry Mercer Date: Wed, 10 Sep 2025 18:14:08 +0100 Subject: [PATCH 09/53] Run sync back script separately --- .github/workflows/rebuild.yml | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/.github/workflows/rebuild.yml b/.github/workflows/rebuild.yml index cfce78713..37e768c66 100644 --- a/.github/workflows/rebuild.yml +++ b/.github/workflows/rebuild.yml @@ -72,12 +72,16 @@ jobs: with: python-version: 3.11 - - name: Generate workflows + - name: Sync back version updates to generated workflows + working-directory: pr-checks + run: | + python3 sync_back.py -v + + - name: Generate workflows + working-directory: pr-checks run: | - cd pr-checks python -m pip install --upgrade pip pip install ruamel.yaml==0.17.31 - python3 sync_back.py python3 sync.py - name: "Merge in progress: Finish merge and push" From 1343eba2d06f8e026a7bd25e9c4e15f1c0c44698 Mon Sep 17 00:00:00 2001 From: Henry Mercer Date: Wed, 10 Sep 2025 18:14:20 +0100 Subject: [PATCH 10/53] Remove unused imports --- pr-checks/sync_back.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pr-checks/sync_back.py b/pr-checks/sync_back.py index 35d36e575..52b390c20 100755 --- a/pr-checks/sync_back.py +++ b/pr-checks/sync_back.py @@ -22,7 +22,7 @@ import glob import argparse import sys from pathlib import Path -from typing import Dict, Set, List, Tuple +from typing import Dict, List def scan_generated_workflows(workflow_dir: str) -> Dict[str, str]: From d0f02ad6837ae6f14f131fba9795e124c5888675 Mon Sep 17 00:00:00 2001 From: Henry Mercer Date: Wed, 10 Sep 2025 18:24:38 +0100 Subject: [PATCH 11/53] Simplify import --- pr-checks/test_sync_back.py | 10 +--------- 1 file changed, 1 insertion(+), 9 deletions(-) diff --git a/pr-checks/test_sync_back.py b/pr-checks/test_sync_back.py index 37fc03133..b25a6bbc4 100644 --- a/pr-checks/test_sync_back.py +++ b/pr-checks/test_sync_back.py @@ -5,18 +5,10 @@ Tests for the sync_back.py script import os import shutil -import sys import tempfile import unittest -# Add the current directory to sys.path and import the sync_back module -sys.path.insert(0, os.path.dirname(os.path.abspath(__file__))) - -# Import the sync-back module -import importlib.util -spec = importlib.util.spec_from_file_location("sync_back", os.path.join(os.path.dirname(__file__), "sync_back.py")) -sync_back = importlib.util.module_from_spec(spec) -spec.loader.exec_module(sync_back) +import sync_back class TestSyncBack(unittest.TestCase): From c9d2739db2a0060cb585dcc353ce91887ddfa0ec Mon Sep 17 00:00:00 2001 From: Henry Mercer Date: Wed, 10 Sep 2025 18:24:51 +0100 Subject: [PATCH 12/53] Use more generic regexp for `sync.py` changes --- pr-checks/sync_back.py | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pr-checks/sync_back.py b/pr-checks/sync_back.py index 52b390c20..7bcfead85 100755 --- a/pr-checks/sync_back.py +++ b/pr-checks/sync_back.py @@ -82,8 +82,8 @@ def update_sync_py(sync_py_path: str, action_versions: Dict[str, str]) -> bool: version = version_with_comment.split('#')[0].strip() if '#' in version_with_comment else version_with_comment.strip() # Look for patterns like 'uses': 'actions/setup-node@v4' - pattern = rf"('uses':\s*')(actions/{re.escape(action_name.split('/')[-1])})@([^']+)(')" - replacement = rf"\1\2@{version}\4" + pattern = rf"('uses':\s*'){re.escape(action_name)}@(?:[^']+)(')" + replacement = rf"\1{action_name}@{version}\2" content = re.sub(pattern, replacement, content) if content != original_content: @@ -119,7 +119,7 @@ def update_template_files(checks_dir: str, action_versions: Dict[str, str]) -> L # Update action versions for action_name, version_with_comment in action_versions.items(): # Look for patterns like 'uses: actions/setup-node@v4' or 'uses: actions/setup-node@sha # comment' - pattern = rf"(uses:\s+{re.escape(action_name)})@([^@\n]+)" + pattern = rf"(uses:\s+{re.escape(action_name)})@(?:[^@\n]+)" replacement = rf"\1@{version_with_comment}" content = re.sub(pattern, replacement, content) From 5df1d6e0dbe6997a791b3a6700cf2b98fea535ce Mon Sep 17 00:00:00 2001 From: Henry Mercer Date: Mon, 22 Sep 2025 15:39:05 +0100 Subject: [PATCH 13/53] Remove redundant check --- pr-checks/sync_back.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pr-checks/sync_back.py b/pr-checks/sync_back.py index 7bcfead85..d588efc7f 100755 --- a/pr-checks/sync_back.py +++ b/pr-checks/sync_back.py @@ -49,7 +49,7 @@ def scan_generated_workflows(workflow_dir: str) -> Dict[str, str]: for action_name, version_with_comment in matches: # Only track non-local actions (those with / but not starting with ./) - if '/' in action_name and not action_name.startswith('./'): + if not action_name.startswith('./'): # Take the latest version seen (they should all be the same after Dependabot) action_versions[action_name] = version_with_comment.rstrip() From ee37081d031a4f59701d3eabb6677858b20cd575 Mon Sep 17 00:00:00 2001 From: Henry Mercer Date: Mon, 22 Sep 2025 16:34:10 +0200 Subject: [PATCH 14/53] Remove docs about sync back workflow In favour of docs in the script itself --- pr-checks/readme.md | 38 +------------------------------------- 1 file changed, 1 insertion(+), 37 deletions(-) diff --git a/pr-checks/readme.md b/pr-checks/readme.md index 58c6b9412..283ed3599 100644 --- a/pr-checks/readme.md +++ b/pr-checks/readme.md @@ -9,42 +9,6 @@ to one of the files in this directory. 1. Install https://github.com/casey/just by whichever way you prefer. 2. Run `just update-pr-checks` in your terminal. -### If you don't want to intall `just` +### If you don't want to install `just` Manually run each step in the `justfile`. - -## Sync-back automation - -When Dependabot updates action versions in the generated workflow files (`.github/workflows/__*.yml`), -the sync-back automation ensures those changes are properly reflected in the source templates. - -The sync-back script automatically detects all actions used in generated workflows and preserves -version comments (e.g., `# v1.2.3`) when syncing versions between files. - -### Running sync-back manually - -To sync action versions from generated workflows back to source templates: - -```bash -# Dry run to see what would be changed -python3 pr-checks/sync_back.py --dry-run --verbose - -# Actually apply the changes -python3 pr-checks/sync_back.py -``` - -The sync-back script automatically updates: -- Hardcoded action versions in `pr-checks/sync.py` -- Action version references in template files in `pr-checks/checks/` - -Regular workflow files are updated directly by Dependabot and don't need sync-back. - -This ensures that the `verify-pr-checks.sh` test always passes after Dependabot PRs. - -### Testing - -The sync-back script includes comprehensive tests that can be run with: - -```bash -python3 pr-checks/test_sync_back.py -v -``` From 5065ea8eef517afdf6f7e41413ff347bac2896a1 Mon Sep 17 00:00:00 2001 From: Henry Mercer Date: Mon, 22 Sep 2025 16:41:25 +0200 Subject: [PATCH 15/53] Improve comment --- pr-checks/sync_back.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pr-checks/sync_back.py b/pr-checks/sync_back.py index d588efc7f..76202cc78 100755 --- a/pr-checks/sync_back.py +++ b/pr-checks/sync_back.py @@ -50,7 +50,7 @@ def scan_generated_workflows(workflow_dir: str) -> Dict[str, str]: for action_name, version_with_comment in matches: # Only track non-local actions (those with / but not starting with ./) if not action_name.startswith('./'): - # Take the latest version seen (they should all be the same after Dependabot) + # Assume that version numbers are consistent (this should be the case on a Dependabot update PR) action_versions[action_name] = version_with_comment.rstrip() return action_versions From 86ed2117d5126886b07d25a0a5db0ee16734d81b Mon Sep 17 00:00:00 2001 From: Henry Mercer Date: Mon, 22 Sep 2025 16:42:56 +0200 Subject: [PATCH 16/53] Note limitation of looking for `uses: ` in pattern --- pr-checks/sync_back.py | 3 +++ 1 file changed, 3 insertions(+) diff --git a/pr-checks/sync_back.py b/pr-checks/sync_back.py index 76202cc78..ffc18f3fc 100755 --- a/pr-checks/sync_back.py +++ b/pr-checks/sync_back.py @@ -82,6 +82,9 @@ def update_sync_py(sync_py_path: str, action_versions: Dict[str, str]) -> bool: version = version_with_comment.split('#')[0].strip() if '#' in version_with_comment else version_with_comment.strip() # Look for patterns like 'uses': 'actions/setup-node@v4' + # Note that this will break if we store an Action uses reference in a + # variable - that's a risk we're happy to take since in that case the + # PR checks will just fail. pattern = rf"('uses':\s*'){re.escape(action_name)}@(?:[^']+)(')" replacement = rf"\1{action_name}@{version}\2" content = re.sub(pattern, replacement, content) From bb07e07aff4d81b455b93dbecda1510346e2cbf4 Mon Sep 17 00:00:00 2001 From: Henry Mercer Date: Mon, 22 Sep 2025 16:43:58 +0200 Subject: [PATCH 17/53] Remove trailing whitespace --- pr-checks/sync_back.py | 66 +++++++++++++++++++++--------------------- 1 file changed, 33 insertions(+), 33 deletions(-) diff --git a/pr-checks/sync_back.py b/pr-checks/sync_back.py index ffc18f3fc..e4fe0bfa4 100755 --- a/pr-checks/sync_back.py +++ b/pr-checks/sync_back.py @@ -28,59 +28,59 @@ from typing import Dict, List def scan_generated_workflows(workflow_dir: str) -> Dict[str, str]: """ Scan generated workflow files to extract the latest action versions. - + Args: workflow_dir: Path to .github/workflows directory - + Returns: Dictionary mapping action names to their latest versions (including comments) """ action_versions = {} generated_files = glob.glob(os.path.join(workflow_dir, "__*.yml")) - + for file_path in generated_files: with open(file_path, 'r') as f: content = f.read() - + # Find all action uses in the file, including potential comments # This pattern captures: action_name@version_with_possible_comment pattern = r'uses:\s+([^/\s]+/[^@\s]+)@([^@\n]+)' matches = re.findall(pattern, content) - + for action_name, version_with_comment in matches: # Only track non-local actions (those with / but not starting with ./) if not action_name.startswith('./'): # Assume that version numbers are consistent (this should be the case on a Dependabot update PR) action_versions[action_name] = version_with_comment.rstrip() - + return action_versions def update_sync_py(sync_py_path: str, action_versions: Dict[str, str]) -> bool: """ Update hardcoded action versions in pr-checks/sync.py - + Args: sync_py_path: Path to sync.py file action_versions: Dictionary of action names to versions (may include comments) - + Returns: True if file was modified, False otherwise """ if not os.path.exists(sync_py_path): print(f"Warning: {sync_py_path} not found") return False - + with open(sync_py_path, 'r') as f: content = f.read() - + original_content = content - - # Update hardcoded action versions + + # Update hardcoded action versions for action_name, version_with_comment in action_versions.items(): # Extract just the version part (before any comment) for sync.py version = version_with_comment.split('#')[0].strip() if '#' in version_with_comment else version_with_comment.strip() - + # Look for patterns like 'uses': 'actions/setup-node@v4' # Note that this will break if we store an Action uses reference in a # variable - that's a risk we're happy to take since in that case the @@ -88,7 +88,7 @@ def update_sync_py(sync_py_path: str, action_versions: Dict[str, str]) -> bool: pattern = rf"('uses':\s*'){re.escape(action_name)}@(?:[^']+)(')" replacement = rf"\1{action_name}@{version}\2" content = re.sub(pattern, replacement, content) - + if content != original_content: with open(sync_py_path, 'w') as f: f.write(content) @@ -102,36 +102,36 @@ def update_sync_py(sync_py_path: str, action_versions: Dict[str, str]) -> bool: def update_template_files(checks_dir: str, action_versions: Dict[str, str]) -> List[str]: """ Update action versions in template files in pr-checks/checks/ - + Args: checks_dir: Path to pr-checks/checks directory action_versions: Dictionary of action names to versions (may include comments) - + Returns: List of files that were modified """ modified_files = [] template_files = glob.glob(os.path.join(checks_dir, "*.yml")) - + for file_path in template_files: with open(file_path, 'r') as f: content = f.read() - + original_content = content - + # Update action versions for action_name, version_with_comment in action_versions.items(): # Look for patterns like 'uses: actions/setup-node@v4' or 'uses: actions/setup-node@sha # comment' pattern = rf"(uses:\s+{re.escape(action_name)})@(?:[^@\n]+)" replacement = rf"\1@{version_with_comment}" content = re.sub(pattern, replacement, content) - + if content != original_content: with open(file_path, 'w') as f: f.write(content) modified_files.append(file_path) print(f"Updated {file_path}") - + return modified_files @@ -140,51 +140,51 @@ def main(): parser.add_argument("--dry-run", action="store_true", help="Show what would be changed without making changes") parser.add_argument("--verbose", "-v", action="store_true", help="Enable verbose output") args = parser.parse_args() - + # Get the repository root (assuming script is in pr-checks/) script_dir = Path(__file__).parent repo_root = script_dir.parent - + workflow_dir = repo_root / ".github" / "workflows" checks_dir = script_dir / "checks" sync_py_path = script_dir / "sync.py" - + print("Scanning generated workflows for latest action versions...") action_versions = scan_generated_workflows(str(workflow_dir)) - + if args.verbose: print("Found action versions:") for action, version in action_versions.items(): print(f" {action}@{version}") - + if not action_versions: print("No action versions found in generated workflows") return 1 - + if args.dry_run: print("\nDRY RUN - Would make the following changes:") print(f"Action versions to sync: {action_versions}") return 0 - + # Update files print("\nUpdating source files...") modified_files = [] - + # Update sync.py if update_sync_py(str(sync_py_path), action_versions): modified_files.append(str(sync_py_path)) - - # Update template files + + # Update template files template_modified = update_template_files(str(checks_dir), action_versions) modified_files.extend(template_modified) - + if modified_files: print(f"\nSync completed. Modified {len(modified_files)} files:") for file_path in modified_files: print(f" {file_path}") else: print("\nNo files needed updating - all action versions are already in sync") - + return 0 From 8df00436ea90278318ee4935ea97eac7c726fd3e Mon Sep 17 00:00:00 2001 From: Henry Mercer Date: Mon, 22 Sep 2025 16:44:42 +0200 Subject: [PATCH 18/53] Remove half baked dry run functionality --- pr-checks/sync_back.py | 6 ------ 1 file changed, 6 deletions(-) diff --git a/pr-checks/sync_back.py b/pr-checks/sync_back.py index e4fe0bfa4..9cf25b20b 100755 --- a/pr-checks/sync_back.py +++ b/pr-checks/sync_back.py @@ -137,7 +137,6 @@ def update_template_files(checks_dir: str, action_versions: Dict[str, str]) -> L def main(): parser = argparse.ArgumentParser(description="Sync action versions from generated workflows back to templates") - parser.add_argument("--dry-run", action="store_true", help="Show what would be changed without making changes") parser.add_argument("--verbose", "-v", action="store_true", help="Enable verbose output") args = parser.parse_args() @@ -161,11 +160,6 @@ def main(): print("No action versions found in generated workflows") return 1 - if args.dry_run: - print("\nDRY RUN - Would make the following changes:") - print(f"Action versions to sync: {action_versions}") - return 0 - # Update files print("\nUpdating source files...") modified_files = [] From fbe415d86f05c296e3d42f5ca949b95d8cca4fec Mon Sep 17 00:00:00 2001 From: Henry Mercer Date: Mon, 22 Sep 2025 16:46:57 +0200 Subject: [PATCH 19/53] Remove misleading test case --- pr-checks/test_sync_back.py | 126 ++++++++++++++---------------------- 1 file changed, 49 insertions(+), 77 deletions(-) diff --git a/pr-checks/test_sync_back.py b/pr-checks/test_sync_back.py index b25a6bbc4..780167088 100644 --- a/pr-checks/test_sync_back.py +++ b/pr-checks/test_sync_back.py @@ -12,7 +12,7 @@ import sync_back class TestSyncBack(unittest.TestCase): - + def setUp(self): """Set up temporary directories and files for testing""" self.test_dir = tempfile.mkdtemp() @@ -20,14 +20,14 @@ class TestSyncBack(unittest.TestCase): self.checks_dir = os.path.join(self.test_dir, "pr-checks", "checks") os.makedirs(self.workflow_dir) os.makedirs(self.checks_dir) - + # Create sync.py file self.sync_py_path = os.path.join(self.test_dir, "pr-checks", "sync.py") - + def tearDown(self): """Clean up temporary directories""" shutil.rmtree(self.test_dir) - + def test_scan_generated_workflows_basic(self): """Test basic workflow scanning functionality""" # Create a test generated workflow file @@ -41,16 +41,16 @@ jobs: - uses: actions/setup-node@v5 - uses: actions/setup-go@v6 """ - + with open(os.path.join(self.workflow_dir, "__test.yml"), 'w') as f: f.write(workflow_content) - + result = sync_back.scan_generated_workflows(self.workflow_dir) - + self.assertEqual(result['actions/checkout'], 'v4') self.assertEqual(result['actions/setup-node'], 'v5') self.assertEqual(result['actions/setup-go'], 'v6') - + def test_scan_generated_workflows_with_comments(self): """Test scanning workflows with version comments""" workflow_content = """ @@ -63,16 +63,16 @@ jobs: - uses: ruby/setup-ruby@44511735964dcb71245e7e55f72539531f7bc0eb # v1.257.0 - uses: actions/setup-python@v6 # Latest Python """ - + with open(os.path.join(self.workflow_dir, "__test.yml"), 'w') as f: f.write(workflow_content) - + result = sync_back.scan_generated_workflows(self.workflow_dir) - + self.assertEqual(result['actions/checkout'], 'v4') self.assertEqual(result['ruby/setup-ruby'], '44511735964dcb71245e7e55f72539531f7bc0eb # v1.257.0') self.assertEqual(result['actions/setup-python'], 'v6 # Latest Python') - + def test_scan_generated_workflows_ignores_local_actions(self): """Test that local actions (starting with ./) are ignored""" workflow_content = """ @@ -85,45 +85,17 @@ jobs: - uses: ./.github/actions/local-action - uses: ./another-local-action@v1 """ - + with open(os.path.join(self.workflow_dir, "__test.yml"), 'w') as f: f.write(workflow_content) - + result = sync_back.scan_generated_workflows(self.workflow_dir) - + self.assertEqual(result['actions/checkout'], 'v4') self.assertNotIn('./.github/actions/local-action', result) self.assertNotIn('./another-local-action', result) - - def test_scan_generated_workflows_skips_non_generated(self): - """Test that non-generated files are ignored""" - # Create generated file - generated_content = """ -name: Generated -jobs: - test: - steps: - - uses: actions/checkout@v4 - """ - with open(os.path.join(self.workflow_dir, "__generated.yml"), 'w') as f: - f.write(generated_content) - - # Create regular file - regular_content = """ -name: Regular -jobs: - test: - steps: - - uses: actions/checkout@v3 - """ - with open(os.path.join(self.workflow_dir, "regular.yml"), 'w') as f: - f.write(regular_content) - - result = sync_back.scan_generated_workflows(self.workflow_dir) - - # Should only see the version from the generated file - self.assertEqual(result['actions/checkout'], 'v4') - + + def test_update_sync_py(self): """Test updating sync.py file""" sync_py_content = """ @@ -133,29 +105,29 @@ steps = [ 'with': {'node-version': '16'} }, { - 'uses': 'actions/setup-go@v5', + 'uses': 'actions/setup-go@v5', 'with': {'go-version': '1.19'} } ] """ - + with open(self.sync_py_path, 'w') as f: f.write(sync_py_content) - + action_versions = { 'actions/setup-node': 'v5', 'actions/setup-go': 'v6' } - + result = sync_back.update_sync_py(self.sync_py_path, action_versions) self.assertTrue(result) - + with open(self.sync_py_path, 'r') as f: updated_content = f.read() - + self.assertIn("'uses': 'actions/setup-node@v5'", updated_content) self.assertIn("'uses': 'actions/setup-go@v6'", updated_content) - + def test_update_sync_py_with_comments(self): """Test updating sync.py file when versions have comments""" sync_py_content = """ @@ -166,24 +138,24 @@ steps = [ } ] """ - + with open(self.sync_py_path, 'w') as f: f.write(sync_py_content) - + action_versions = { 'actions/setup-node': 'v5 # Latest version' } - + result = sync_back.update_sync_py(self.sync_py_path, action_versions) self.assertTrue(result) - + with open(self.sync_py_path, 'r') as f: updated_content = f.read() - + # sync.py should get the version without comment self.assertIn("'uses': 'actions/setup-node@v5'", updated_content) self.assertNotIn("# Latest version", updated_content) - + def test_update_template_files(self): """Test updating template files""" template_content = """ @@ -194,26 +166,26 @@ steps: with: node-version: 16 """ - + template_path = os.path.join(self.checks_dir, "test.yml") with open(template_path, 'w') as f: f.write(template_content) - + action_versions = { 'actions/checkout': 'v4', 'actions/setup-node': 'v5 # Latest' } - + result = sync_back.update_template_files(self.checks_dir, action_versions) self.assertEqual(len(result), 1) self.assertIn(template_path, result) - + with open(template_path, 'r') as f: updated_content = f.read() - + self.assertIn("uses: actions/checkout@v4", updated_content) self.assertIn("uses: actions/setup-node@v5 # Latest", updated_content) - + def test_update_template_files_preserves_comments(self): """Test that updating template files preserves version comments""" template_content = """ @@ -221,23 +193,23 @@ name: Test Template steps: - uses: ruby/setup-ruby@44511735964dcb71245e7e55f72539531f7bc0eb # v1.256.0 """ - + template_path = os.path.join(self.checks_dir, "test.yml") with open(template_path, 'w') as f: f.write(template_content) - + action_versions = { 'ruby/setup-ruby': '55511735964dcb71245e7e55f72539531f7bc0eb # v1.257.0' } - + result = sync_back.update_template_files(self.checks_dir, action_versions) self.assertEqual(len(result), 1) - + with open(template_path, 'r') as f: updated_content = f.read() - + self.assertIn("uses: ruby/setup-ruby@55511735964dcb71245e7e55f72539531f7bc0eb # v1.257.0", updated_content) - + def test_no_changes_needed(self): """Test that functions return False/empty when no changes are needed""" # Test sync.py with no changes needed @@ -249,22 +221,22 @@ steps = [ } ] """ - + with open(self.sync_py_path, 'w') as f: f.write(sync_py_content) - + action_versions = { 'actions/setup-node': 'v5' } - + result = sync_back.update_sync_py(self.sync_py_path, action_versions) self.assertFalse(result) - + def test_missing_sync_py_file(self): """Test handling of missing sync.py file""" result = sync_back.update_sync_py("/nonexistent/sync.py", {}) self.assertFalse(result) - + def test_main_dry_run(self): """Test that dry-run functionality works""" # Create a test workflow @@ -275,10 +247,10 @@ jobs: steps: - uses: actions/checkout@v4 """ - + with open(os.path.join(self.workflow_dir, "__test.yml"), 'w') as f: f.write(workflow_content) - + # Test the scanning function directly since mocking main() is complex result = sync_back.scan_generated_workflows(self.workflow_dir) self.assertIn('actions/checkout', result) From d9ad6a31c352ca76f113f08199289d8e75d790a7 Mon Sep 17 00:00:00 2001 From: Henry Mercer Date: Mon, 22 Sep 2025 16:47:56 +0200 Subject: [PATCH 20/53] Error if `sync.py` not found --- pr-checks/sync_back.py | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/pr-checks/sync_back.py b/pr-checks/sync_back.py index 9cf25b20b..1474b455e 100755 --- a/pr-checks/sync_back.py +++ b/pr-checks/sync_back.py @@ -68,8 +68,7 @@ def update_sync_py(sync_py_path: str, action_versions: Dict[str, str]) -> bool: True if file was modified, False otherwise """ if not os.path.exists(sync_py_path): - print(f"Warning: {sync_py_path} not found") - return False + raise FileNotFoundError(f"Could not find {sync_py_path}") with open(sync_py_path, 'r') as f: content = f.read() From e9d7b2dd99b5817e200b76f144dd73a448e2dd22 Mon Sep 17 00:00:00 2001 From: Henry Mercer Date: Mon, 22 Sep 2025 16:48:35 +0200 Subject: [PATCH 21/53] Remove unnecessary test cases --- pr-checks/test_sync_back.py | 26 +------------------------- 1 file changed, 1 insertion(+), 25 deletions(-) diff --git a/pr-checks/test_sync_back.py b/pr-checks/test_sync_back.py index 780167088..de2e42d73 100644 --- a/pr-checks/test_sync_back.py +++ b/pr-checks/test_sync_back.py @@ -232,30 +232,6 @@ steps = [ result = sync_back.update_sync_py(self.sync_py_path, action_versions) self.assertFalse(result) - def test_missing_sync_py_file(self): - """Test handling of missing sync.py file""" - result = sync_back.update_sync_py("/nonexistent/sync.py", {}) - self.assertFalse(result) - - def test_main_dry_run(self): - """Test that dry-run functionality works""" - # Create a test workflow - workflow_content = """ -name: Test -jobs: - test: - steps: - - uses: actions/checkout@v4 - """ - - with open(os.path.join(self.workflow_dir, "__test.yml"), 'w') as f: - f.write(workflow_content) - - # Test the scanning function directly since mocking main() is complex - result = sync_back.scan_generated_workflows(self.workflow_dir) - self.assertIn('actions/checkout', result) - self.assertEqual(result['actions/checkout'], 'v4') - if __name__ == '__main__': - unittest.main() \ No newline at end of file + unittest.main() From 2885255647f76aa6b9e8786437481ed061e240dc Mon Sep 17 00:00:00 2001 From: Henry Mercer Date: Tue, 23 Sep 2025 11:29:23 +0200 Subject: [PATCH 22/53] Only sync back versions on Dependabot update PRs --- .github/workflows/rebuild.yml | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/.github/workflows/rebuild.yml b/.github/workflows/rebuild.yml index 37e768c66..c5e69bfd2 100644 --- a/.github/workflows/rebuild.yml +++ b/.github/workflows/rebuild.yml @@ -11,6 +11,10 @@ jobs: runs-on: ubuntu-latest if: github.event.label.name == 'Rebuild' || github.event_name == 'workflow_dispatch' + env: + HEAD_REF: ${{ github.event.pull_request.head.ref || github.event.ref }} + BASE_BRANCH: ${{ github.event.pull_request.base.ref || 'main' }} + permissions: contents: write # needed to push rebuilt commit pull-requests: write # needed to comment on the PR @@ -19,7 +23,7 @@ jobs: uses: actions/checkout@v5 with: fetch-depth: 0 - ref: ${{ github.event.pull_request.head.ref || github.event.ref }} + ref: ${{ env.HEAD_REF }} - name: Remove label if: github.event_name == 'pull_request' @@ -37,8 +41,6 @@ jobs: - name: Merge in changes from base branch id: merge - env: - BASE_BRANCH: ${{ github.event.pull_request.base.ref || 'main' }} run: | git fetch origin "$BASE_BRANCH" @@ -73,6 +75,8 @@ jobs: python-version: 3.11 - name: Sync back version updates to generated workflows + # Only sync back versions on Dependabot update PRs + if: startsWith(env.HEAD_REF, 'dependabot/') working-directory: pr-checks run: | python3 sync_back.py -v From 2bbfe979c31de306d6424f250161ff168cc52f8f Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Wed, 17 Sep 2025 15:31:34 +0000 Subject: [PATCH 23/53] Update default bundle to codeql-bundle-v2.23.1 --- lib/analyze-action.js | 4 ++-- lib/autobuild-action.js | 4 ++-- lib/defaults.json | 8 ++++---- lib/init-action-post.js | 4 ++-- lib/init-action.js | 4 ++-- lib/start-proxy-action.js | 4 ++-- lib/upload-lib.js | 4 ++-- lib/upload-sarif-action.js | 4 ++-- src/defaults.json | 8 ++++---- 9 files changed, 22 insertions(+), 22 deletions(-) diff --git a/lib/analyze-action.js b/lib/analyze-action.js index 9ec4e5c9a..40f7662f3 100644 --- a/lib/analyze-action.js +++ b/lib/analyze-action.js @@ -90587,8 +90587,8 @@ var path8 = __toESM(require("path")); var semver4 = __toESM(require_semver2()); // src/defaults.json -var bundleVersion = "codeql-bundle-v2.23.0"; -var cliVersion = "2.23.0"; +var bundleVersion = "codeql-bundle-v2.23.1"; +var cliVersion = "2.23.1"; // src/overlay-database-utils.ts var crypto = __toESM(require("crypto")); diff --git a/lib/autobuild-action.js b/lib/autobuild-action.js index cbb034877..7ebf6a918 100644 --- a/lib/autobuild-action.js +++ b/lib/autobuild-action.js @@ -78256,8 +78256,8 @@ var path3 = __toESM(require("path")); var semver4 = __toESM(require_semver2()); // src/defaults.json -var bundleVersion = "codeql-bundle-v2.23.0"; -var cliVersion = "2.23.0"; +var bundleVersion = "codeql-bundle-v2.23.1"; +var cliVersion = "2.23.1"; // src/overlay-database-utils.ts var fs2 = __toESM(require("fs")); diff --git a/lib/defaults.json b/lib/defaults.json index 712efc19f..dbc0d5e25 100644 --- a/lib/defaults.json +++ b/lib/defaults.json @@ -1,6 +1,6 @@ { - "bundleVersion": "codeql-bundle-v2.23.0", - "cliVersion": "2.23.0", - "priorBundleVersion": "codeql-bundle-v2.22.4", - "priorCliVersion": "2.22.4" + "bundleVersion": "codeql-bundle-v2.23.1", + "cliVersion": "2.23.1", + "priorBundleVersion": "codeql-bundle-v2.23.0", + "priorCliVersion": "2.23.0" } diff --git a/lib/init-action-post.js b/lib/init-action-post.js index 9f5ee320d..893fbc0b4 100644 --- a/lib/init-action-post.js +++ b/lib/init-action-post.js @@ -128793,8 +128793,8 @@ var path8 = __toESM(require("path")); var semver4 = __toESM(require_semver2()); // src/defaults.json -var bundleVersion = "codeql-bundle-v2.23.0"; -var cliVersion = "2.23.0"; +var bundleVersion = "codeql-bundle-v2.23.1"; +var cliVersion = "2.23.1"; // src/overlay-database-utils.ts var fs6 = __toESM(require("fs")); diff --git a/lib/init-action.js b/lib/init-action.js index 0794a537d..31084d8e8 100644 --- a/lib/init-action.js +++ b/lib/init-action.js @@ -86516,8 +86516,8 @@ var path9 = __toESM(require("path")); var semver4 = __toESM(require_semver2()); // src/defaults.json -var bundleVersion = "codeql-bundle-v2.23.0"; -var cliVersion = "2.23.0"; +var bundleVersion = "codeql-bundle-v2.23.1"; +var cliVersion = "2.23.1"; // src/overlay-database-utils.ts var crypto = __toESM(require("crypto")); diff --git a/lib/start-proxy-action.js b/lib/start-proxy-action.js index c9aa76f79..4dbafc221 100644 --- a/lib/start-proxy-action.js +++ b/lib/start-proxy-action.js @@ -49393,8 +49393,8 @@ function getApiClient() { } // src/defaults.json -var bundleVersion = "codeql-bundle-v2.23.0"; -var cliVersion = "2.23.0"; +var bundleVersion = "codeql-bundle-v2.23.1"; +var cliVersion = "2.23.1"; // src/languages.ts var KnownLanguage = /* @__PURE__ */ ((KnownLanguage2) => { diff --git a/lib/upload-lib.js b/lib/upload-lib.js index 712684630..710c4d3e3 100644 --- a/lib/upload-lib.js +++ b/lib/upload-lib.js @@ -88902,8 +88902,8 @@ var path8 = __toESM(require("path")); var semver4 = __toESM(require_semver2()); // src/defaults.json -var bundleVersion = "codeql-bundle-v2.23.0"; -var cliVersion = "2.23.0"; +var bundleVersion = "codeql-bundle-v2.23.1"; +var cliVersion = "2.23.1"; // src/overlay-database-utils.ts var fs5 = __toESM(require("fs")); diff --git a/lib/upload-sarif-action.js b/lib/upload-sarif-action.js index 6e8364463..2f6e5c0ab 100644 --- a/lib/upload-sarif-action.js +++ b/lib/upload-sarif-action.js @@ -88885,8 +88885,8 @@ var path8 = __toESM(require("path")); var semver3 = __toESM(require_semver2()); // src/defaults.json -var bundleVersion = "codeql-bundle-v2.23.0"; -var cliVersion = "2.23.0"; +var bundleVersion = "codeql-bundle-v2.23.1"; +var cliVersion = "2.23.1"; // src/overlay-database-utils.ts var fs5 = __toESM(require("fs")); diff --git a/src/defaults.json b/src/defaults.json index 712efc19f..dbc0d5e25 100644 --- a/src/defaults.json +++ b/src/defaults.json @@ -1,6 +1,6 @@ { - "bundleVersion": "codeql-bundle-v2.23.0", - "cliVersion": "2.23.0", - "priorBundleVersion": "codeql-bundle-v2.22.4", - "priorCliVersion": "2.22.4" + "bundleVersion": "codeql-bundle-v2.23.1", + "cliVersion": "2.23.1", + "priorBundleVersion": "codeql-bundle-v2.23.0", + "priorCliVersion": "2.23.0" } From e8921f7effe5b69a3acc1781912db7c9fe1f3335 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Wed, 17 Sep 2025 15:31:43 +0000 Subject: [PATCH 24/53] Add changelog note --- CHANGELOG.md | 1 + 1 file changed, 1 insertion(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 3cae4a75f..3c84102a4 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,6 +7,7 @@ See the [releases page](https://github.com/github/codeql-action/releases) for th - We have improved the CodeQL Action's ability to validate that the workflow it is used in does not use different versions of the CodeQL Action for different workflow steps. Mixing different versions of the CodeQL Action in the same workflow is unsupported and can lead to unpredictable results. A warning will now be emitted from the `codeql-action/init` step if different versions of the CodeQL Action are detected in the workflow file. Additionally, an error will now be thrown by the other CodeQL Action steps if they load a configuration file that was generated by a different version of the `codeql-action/init` step. [#3099](https://github.com/github/codeql-action/pull/3099) and [#3100](https://github.com/github/codeql-action/pull/3100) - We added support for reducing the size of dependency caches for Java analyses, which will reduce cache usage and speed up workflows. This will be enabled automatically at a later time. [#3107](https://github.com/github/codeql-action/pull/3107) - You can now run the latest CodeQL nightly bundle by passing `tools: nightly` to the `init` action. In general, the nightly bundle is unstable and we only recommend running it when directed by GitHub staff. [#3130](https://github.com/github/codeql-action/pull/3130) +- Update default CodeQL bundle version to 2.23.1. [#3118](https://github.com/github/codeql-action/pull/3118) ## 3.30.3 - 10 Sep 2025 From eb05da905dde2311f814bcef836fecf6bb74f81a Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Wed, 17 Sep 2025 17:06:58 +0100 Subject: [PATCH 25/53] Specify `Accept` header for `toolcache.downloadTool` --- lib/start-proxy-action.js | 9 ++++++++- src/start-proxy-action.ts | 9 ++++++++- 2 files changed, 16 insertions(+), 2 deletions(-) diff --git a/lib/start-proxy-action.js b/lib/start-proxy-action.js index 4dbafc221..3a5a85c6b 100644 --- a/lib/start-proxy-action.js +++ b/lib/start-proxy-action.js @@ -49682,7 +49682,14 @@ async function getProxyBinaryPath(logger) { const proxyInfo = await getDownloadUrl(logger); let proxyBin = toolcache.find(proxyFileName, proxyInfo.version); if (!proxyBin) { - const temp = await toolcache.downloadTool(proxyInfo.url); + const temp = await toolcache.downloadTool( + proxyInfo.url, + void 0, + void 0, + { + accept: "application/octet-stream" + } + ); const extracted = await toolcache.extractTar(temp); proxyBin = await toolcache.cacheDir( extracted, diff --git a/src/start-proxy-action.ts b/src/start-proxy-action.ts index 6ce3b70ff..c0a8d3c7f 100644 --- a/src/start-proxy-action.ts +++ b/src/start-proxy-action.ts @@ -192,7 +192,14 @@ async function getProxyBinaryPath(logger: Logger): Promise { let proxyBin = toolcache.find(proxyFileName, proxyInfo.version); if (!proxyBin) { - const temp = await toolcache.downloadTool(proxyInfo.url); + const temp = await toolcache.downloadTool( + proxyInfo.url, + undefined, + undefined, + { + accept: "application/octet-stream", + }, + ); const extracted = await toolcache.extractTar(temp); proxyBin = await toolcache.cacheDir( extracted, From 3df807292ad75b40f30540b1126508b01bfb9504 Mon Sep 17 00:00:00 2001 From: Henry Mercer Date: Tue, 23 Sep 2025 14:38:33 +0200 Subject: [PATCH 26/53] Only run PR checks on Ubuntu by default --- .github/workflows/__analyze-ref-input.yml | 4 --- .github/workflows/__config-export.yml | 8 ----- .github/workflows/__diagnostics-export.yml | 8 ----- .github/workflows/__init-with-registries.yml | 14 -------- ...ackaging-codescanning-config-inputs-js.yml | 12 ------- .../__packaging-config-inputs-js.yml | 12 ------- .github/workflows/__packaging-config-js.yml | 12 ------- .github/workflows/__packaging-inputs-js.yml | 12 ------- .github/workflows/__quality-queries.yml | 36 ------------------- .../__resolve-environment-action.yml | 12 ------- .github/workflows/__upload-quality-sarif.yml | 4 --- .github/workflows/__upload-ref-sha-input.yml | 4 --- .github/workflows/__with-checkout-path.yml | 4 --- pr-checks/checks/all-platform-bundle.yml | 1 - pr-checks/checks/autobuild-action.yml | 1 + pr-checks/checks/build-mode-autobuild.yml | 1 - pr-checks/checks/build-mode-manual.yml | 1 - pr-checks/checks/build-mode-none.yml | 1 - pr-checks/checks/build-mode-rollback.yml | 1 - pr-checks/checks/cleanup-db-cluster-dir.yml | 1 - pr-checks/checks/config-input.yml | 1 - pr-checks/checks/cpp-deptrace-disabled.yml | 1 - pr-checks/checks/cpp-deptrace-enabled.yml | 1 - .../export-file-baseline-information.yml | 1 + pr-checks/checks/extractor-ram-threads.yml | 1 - ...indirect-tracing-workaround-diagnostic.yml | 1 - ...ect-tracing-workaround-no-file-program.yml | 1 - .../checks/go-indirect-tracing-workaround.yml | 1 - pr-checks/checks/init-with-registries.yml | 2 -- pr-checks/checks/javascript-source-root.yml | 1 - pr-checks/checks/job-run-uuid-sarif.yml | 1 - pr-checks/checks/language-aliases.yml | 1 - pr-checks/checks/overlay-init-fallback.yml | 1 - pr-checks/checks/rubocop-multi-language.yml | 1 - pr-checks/checks/rust.yml | 1 - pr-checks/checks/submit-sarif-failure.yml | 1 - .../checks/test-autobuild-working-dir.yml | 1 - pr-checks/checks/test-local-codeql.yml | 1 - pr-checks/checks/test-proxy.yml | 1 - pr-checks/sync.py | 13 +------ 40 files changed, 3 insertions(+), 179 deletions(-) diff --git a/.github/workflows/__analyze-ref-input.yml b/.github/workflows/__analyze-ref-input.yml index f2f9f45a5..90571df09 100644 --- a/.github/workflows/__analyze-ref-input.yml +++ b/.github/workflows/__analyze-ref-input.yml @@ -48,10 +48,6 @@ jobs: include: - os: ubuntu-latest version: default - - os: macos-latest - version: default - - os: windows-latest - version: default name: "Analyze: 'ref' and 'sha' from inputs" permissions: contents: read diff --git a/.github/workflows/__config-export.yml b/.github/workflows/__config-export.yml index 85118c3fa..17677c5e6 100644 --- a/.github/workflows/__config-export.yml +++ b/.github/workflows/__config-export.yml @@ -38,16 +38,8 @@ jobs: include: - os: ubuntu-latest version: linked - - os: macos-latest - version: linked - - os: windows-latest - version: linked - os: ubuntu-latest version: nightly-latest - - os: macos-latest - version: nightly-latest - - os: windows-latest - version: nightly-latest name: Config export permissions: contents: read diff --git a/.github/workflows/__diagnostics-export.yml b/.github/workflows/__diagnostics-export.yml index 1b8618798..8260646e9 100644 --- a/.github/workflows/__diagnostics-export.yml +++ b/.github/workflows/__diagnostics-export.yml @@ -38,16 +38,8 @@ jobs: include: - os: ubuntu-latest version: linked - - os: macos-latest - version: linked - - os: windows-latest - version: linked - os: ubuntu-latest version: nightly-latest - - os: macos-latest - version: nightly-latest - - os: windows-latest - version: nightly-latest name: Diagnostic export permissions: contents: read diff --git a/.github/workflows/__init-with-registries.yml b/.github/workflows/__init-with-registries.yml index f570a05e0..3a883b95a 100644 --- a/.github/workflows/__init-with-registries.yml +++ b/.github/workflows/__init-with-registries.yml @@ -38,22 +38,10 @@ jobs: include: - os: ubuntu-latest version: default - - os: macos-latest - version: default - - os: windows-latest - version: default - os: ubuntu-latest version: linked - - os: macos-latest - version: linked - - os: windows-latest - version: linked - os: ubuntu-latest version: nightly-latest - - os: macos-latest - version: nightly-latest - - os: windows-latest - version: nightly-latest name: 'Packaging: Download using registries' permissions: contents: read @@ -117,8 +105,6 @@ jobs: fi - name: Verify contents of qlconfig.yml - # yq is not available on windows - if: runner.os != 'Windows' run: | QLCONFIG_PATH=$RUNNER_TEMP/qlconfig.yml cat $QLCONFIG_PATH | yq -e '.registries[] | select(.url == "https://ghcr.io/v2/") | select(.packages == "*/*")' diff --git a/.github/workflows/__packaging-codescanning-config-inputs-js.yml b/.github/workflows/__packaging-codescanning-config-inputs-js.yml index 0d7d4cf9e..8fb5150f6 100644 --- a/.github/workflows/__packaging-codescanning-config-inputs-js.yml +++ b/.github/workflows/__packaging-codescanning-config-inputs-js.yml @@ -48,22 +48,10 @@ jobs: include: - os: ubuntu-latest version: linked - - os: macos-latest - version: linked - - os: windows-latest - version: linked - os: ubuntu-latest version: default - - os: macos-latest - version: default - - os: windows-latest - version: default - os: ubuntu-latest version: nightly-latest - - os: macos-latest - version: nightly-latest - - os: windows-latest - version: nightly-latest name: 'Packaging: Config and input passed to the CLI' permissions: contents: read diff --git a/.github/workflows/__packaging-config-inputs-js.yml b/.github/workflows/__packaging-config-inputs-js.yml index 7067a4d73..b66365abd 100644 --- a/.github/workflows/__packaging-config-inputs-js.yml +++ b/.github/workflows/__packaging-config-inputs-js.yml @@ -48,22 +48,10 @@ jobs: include: - os: ubuntu-latest version: linked - - os: macos-latest - version: linked - - os: windows-latest - version: linked - os: ubuntu-latest version: default - - os: macos-latest - version: default - - os: windows-latest - version: default - os: ubuntu-latest version: nightly-latest - - os: macos-latest - version: nightly-latest - - os: windows-latest - version: nightly-latest name: 'Packaging: Config and input' permissions: contents: read diff --git a/.github/workflows/__packaging-config-js.yml b/.github/workflows/__packaging-config-js.yml index d6bd2cf7d..542d67e70 100644 --- a/.github/workflows/__packaging-config-js.yml +++ b/.github/workflows/__packaging-config-js.yml @@ -48,22 +48,10 @@ jobs: include: - os: ubuntu-latest version: linked - - os: macos-latest - version: linked - - os: windows-latest - version: linked - os: ubuntu-latest version: default - - os: macos-latest - version: default - - os: windows-latest - version: default - os: ubuntu-latest version: nightly-latest - - os: macos-latest - version: nightly-latest - - os: windows-latest - version: nightly-latest name: 'Packaging: Config file' permissions: contents: read diff --git a/.github/workflows/__packaging-inputs-js.yml b/.github/workflows/__packaging-inputs-js.yml index 03a81db68..b0f90bfe4 100644 --- a/.github/workflows/__packaging-inputs-js.yml +++ b/.github/workflows/__packaging-inputs-js.yml @@ -48,22 +48,10 @@ jobs: include: - os: ubuntu-latest version: linked - - os: macos-latest - version: linked - - os: windows-latest - version: linked - os: ubuntu-latest version: default - - os: macos-latest - version: default - - os: windows-latest - version: default - os: ubuntu-latest version: nightly-latest - - os: macos-latest - version: nightly-latest - - os: windows-latest - version: nightly-latest name: 'Packaging: Action input' permissions: contents: read diff --git a/.github/workflows/__quality-queries.yml b/.github/workflows/__quality-queries.yml index 50f24c61e..281aedf47 100644 --- a/.github/workflows/__quality-queries.yml +++ b/.github/workflows/__quality-queries.yml @@ -45,24 +45,6 @@ jobs: - os: ubuntu-latest version: linked analysis-kinds: code-scanning,code-quality - - os: macos-latest - version: linked - analysis-kinds: code-scanning - - os: macos-latest - version: linked - analysis-kinds: code-quality - - os: macos-latest - version: linked - analysis-kinds: code-scanning,code-quality - - os: windows-latest - version: linked - analysis-kinds: code-scanning - - os: windows-latest - version: linked - analysis-kinds: code-quality - - os: windows-latest - version: linked - analysis-kinds: code-scanning,code-quality - os: ubuntu-latest version: nightly-latest analysis-kinds: code-scanning @@ -72,24 +54,6 @@ jobs: - os: ubuntu-latest version: nightly-latest analysis-kinds: code-scanning,code-quality - - os: macos-latest - version: nightly-latest - analysis-kinds: code-scanning - - os: macos-latest - version: nightly-latest - analysis-kinds: code-quality - - os: macos-latest - version: nightly-latest - analysis-kinds: code-scanning,code-quality - - os: windows-latest - version: nightly-latest - analysis-kinds: code-scanning - - os: windows-latest - version: nightly-latest - analysis-kinds: code-quality - - os: windows-latest - version: nightly-latest - analysis-kinds: code-scanning,code-quality name: Quality queries input permissions: contents: read diff --git a/.github/workflows/__resolve-environment-action.yml b/.github/workflows/__resolve-environment-action.yml index f7ca25276..da2d3c0f9 100644 --- a/.github/workflows/__resolve-environment-action.yml +++ b/.github/workflows/__resolve-environment-action.yml @@ -38,22 +38,10 @@ jobs: include: - os: ubuntu-latest version: default - - os: macos-latest - version: default - - os: windows-latest - version: default - os: ubuntu-latest version: linked - - os: macos-latest - version: linked - - os: windows-latest - version: linked - os: ubuntu-latest version: nightly-latest - - os: macos-latest - version: nightly-latest - - os: windows-latest - version: nightly-latest name: Resolve environment permissions: contents: read diff --git a/.github/workflows/__upload-quality-sarif.yml b/.github/workflows/__upload-quality-sarif.yml index 90a1c9ef1..50637c31b 100644 --- a/.github/workflows/__upload-quality-sarif.yml +++ b/.github/workflows/__upload-quality-sarif.yml @@ -48,10 +48,6 @@ jobs: include: - os: ubuntu-latest version: default - - os: macos-latest - version: default - - os: windows-latest - version: default name: 'Upload-sarif: code quality endpoint' permissions: contents: read diff --git a/.github/workflows/__upload-ref-sha-input.yml b/.github/workflows/__upload-ref-sha-input.yml index 41036c61a..a527d7b98 100644 --- a/.github/workflows/__upload-ref-sha-input.yml +++ b/.github/workflows/__upload-ref-sha-input.yml @@ -48,10 +48,6 @@ jobs: include: - os: ubuntu-latest version: default - - os: macos-latest - version: default - - os: windows-latest - version: default name: "Upload-sarif: 'ref' and 'sha' from inputs" permissions: contents: read diff --git a/.github/workflows/__with-checkout-path.yml b/.github/workflows/__with-checkout-path.yml index ea694d7c6..9296f1194 100644 --- a/.github/workflows/__with-checkout-path.yml +++ b/.github/workflows/__with-checkout-path.yml @@ -48,10 +48,6 @@ jobs: include: - os: ubuntu-latest version: linked - - os: macos-latest - version: linked - - os: windows-latest - version: linked name: Use a custom `checkout_path` permissions: contents: read diff --git a/pr-checks/checks/all-platform-bundle.yml b/pr-checks/checks/all-platform-bundle.yml index 332f12930..75c75c8b5 100644 --- a/pr-checks/checks/all-platform-bundle.yml +++ b/pr-checks/checks/all-platform-bundle.yml @@ -1,7 +1,6 @@ name: "All-platform bundle" description: "Tests using an all-platform CodeQL Bundle" versions: ["nightly-latest"] -operatingSystems: ["ubuntu"] useAllPlatformBundle: "true" installGo: true steps: diff --git a/pr-checks/checks/autobuild-action.yml b/pr-checks/checks/autobuild-action.yml index ac67a81fe..91ae7834c 100644 --- a/pr-checks/checks/autobuild-action.yml +++ b/pr-checks/checks/autobuild-action.yml @@ -1,5 +1,6 @@ name: "autobuild-action" description: "Tests that the C# autobuild action works" +operatingSystems: ["ubuntu", "macos", "windows"] versions: ["linked"] steps: - uses: ./../action/init diff --git a/pr-checks/checks/build-mode-autobuild.yml b/pr-checks/checks/build-mode-autobuild.yml index 7e840d15a..5a5147788 100644 --- a/pr-checks/checks/build-mode-autobuild.yml +++ b/pr-checks/checks/build-mode-autobuild.yml @@ -1,6 +1,5 @@ name: "Build mode autobuild" description: "An end-to-end integration test of a Java repository built using 'build-mode: autobuild'" -operatingSystems: ["ubuntu"] versions: ["nightly-latest"] steps: - name: Set up Java test repo configuration diff --git a/pr-checks/checks/build-mode-manual.yml b/pr-checks/checks/build-mode-manual.yml index 64009c2ee..f1815b7ff 100644 --- a/pr-checks/checks/build-mode-manual.yml +++ b/pr-checks/checks/build-mode-manual.yml @@ -1,6 +1,5 @@ name: "Build mode manual" description: "An end-to-end integration test of a Java repository built using 'build-mode: manual'" -operatingSystems: ["ubuntu"] versions: ["nightly-latest"] installGo: true steps: diff --git a/pr-checks/checks/build-mode-none.yml b/pr-checks/checks/build-mode-none.yml index 4d23614a9..669ea7915 100644 --- a/pr-checks/checks/build-mode-none.yml +++ b/pr-checks/checks/build-mode-none.yml @@ -1,6 +1,5 @@ name: "Build mode none" description: "An end-to-end integration test of a Java repository built using 'build-mode: none'" -operatingSystems: ["ubuntu"] versions: ["linked", "nightly-latest"] steps: - uses: ./../action/init diff --git a/pr-checks/checks/build-mode-rollback.yml b/pr-checks/checks/build-mode-rollback.yml index 1d935314e..49bcfdd1f 100644 --- a/pr-checks/checks/build-mode-rollback.yml +++ b/pr-checks/checks/build-mode-rollback.yml @@ -1,6 +1,5 @@ name: "Build mode rollback" description: "The build mode is rolled back from none to autobuild when the relevant feature flag is enabled." -operatingSystems: ["ubuntu"] versions: ["nightly-latest"] env: CODEQL_ACTION_DISABLE_JAVA_BUILDLESS: true diff --git a/pr-checks/checks/cleanup-db-cluster-dir.yml b/pr-checks/checks/cleanup-db-cluster-dir.yml index 1c181a57e..d2cacf47e 100644 --- a/pr-checks/checks/cleanup-db-cluster-dir.yml +++ b/pr-checks/checks/cleanup-db-cluster-dir.yml @@ -1,6 +1,5 @@ name: "Clean up database cluster directory" description: "The database cluster directory is cleaned up if it is not empty." -operatingSystems: ["ubuntu"] versions: ["linked"] steps: - name: Add a file to the database cluster directory diff --git a/pr-checks/checks/config-input.yml b/pr-checks/checks/config-input.yml index 5807e8594..f139ff90e 100644 --- a/pr-checks/checks/config-input.yml +++ b/pr-checks/checks/config-input.yml @@ -1,7 +1,6 @@ name: "Config input" description: "Tests specifying configuration using the config input" installNode: true -operatingSystems: ["ubuntu"] versions: ["linked"] steps: - name: Copy queries into workspace diff --git a/pr-checks/checks/cpp-deptrace-disabled.yml b/pr-checks/checks/cpp-deptrace-disabled.yml index 1073d0194..5b6e82726 100644 --- a/pr-checks/checks/cpp-deptrace-disabled.yml +++ b/pr-checks/checks/cpp-deptrace-disabled.yml @@ -1,6 +1,5 @@ name: "C/C++: disabling autoinstalling dependencies (Linux)" description: "Checks that running C/C++ autobuild with autoinstalling dependencies explicitly disabled works" -operatingSystems: ["ubuntu"] versions: ["linked", "default", "nightly-latest"] env: DOTNET_GENERATE_ASPNET_CERTIFICATE: "false" diff --git a/pr-checks/checks/cpp-deptrace-enabled.yml b/pr-checks/checks/cpp-deptrace-enabled.yml index f92f29d21..e35910a75 100644 --- a/pr-checks/checks/cpp-deptrace-enabled.yml +++ b/pr-checks/checks/cpp-deptrace-enabled.yml @@ -1,6 +1,5 @@ name: "C/C++: autoinstalling dependencies (Linux)" description: "Checks that running C/C++ autobuild with autoinstalling dependencies works" -operatingSystems: ["ubuntu"] versions: ["linked", "default", "nightly-latest"] env: DOTNET_GENERATE_ASPNET_CERTIFICATE: "false" diff --git a/pr-checks/checks/export-file-baseline-information.yml b/pr-checks/checks/export-file-baseline-information.yml index 2eb0e6d52..f7698f885 100644 --- a/pr-checks/checks/export-file-baseline-information.yml +++ b/pr-checks/checks/export-file-baseline-information.yml @@ -1,5 +1,6 @@ name: "Export file baseline information" description: "Tests that file baseline information is exported when the feature is enabled" +operatingSystems: ["ubuntu", "macos", "windows"] versions: ["nightly-latest"] installGo: true env: diff --git a/pr-checks/checks/extractor-ram-threads.yml b/pr-checks/checks/extractor-ram-threads.yml index 435c9f41e..43638af18 100644 --- a/pr-checks/checks/extractor-ram-threads.yml +++ b/pr-checks/checks/extractor-ram-threads.yml @@ -1,7 +1,6 @@ name: "Extractor ram and threads options test" description: "Tests passing RAM and threads limits to extractors" versions: ["linked"] -operatingSystems: ["ubuntu"] steps: - uses: ./../action/init with: diff --git a/pr-checks/checks/go-indirect-tracing-workaround-diagnostic.yml b/pr-checks/checks/go-indirect-tracing-workaround-diagnostic.yml index e7cd79185..670940124 100644 --- a/pr-checks/checks/go-indirect-tracing-workaround-diagnostic.yml +++ b/pr-checks/checks/go-indirect-tracing-workaround-diagnostic.yml @@ -1,7 +1,6 @@ name: "Go: diagnostic when Go is changed after init step" description: "Checks that we emit a diagnostic if Go is changed after the init step" # only Linux is affected -operatingSystems: ["ubuntu"] # pinned to a version which does not support statically linked binaries for indirect tracing versions: ["default"] installGo: true diff --git a/pr-checks/checks/go-indirect-tracing-workaround-no-file-program.yml b/pr-checks/checks/go-indirect-tracing-workaround-no-file-program.yml index 3f2fa90b9..85e21356c 100644 --- a/pr-checks/checks/go-indirect-tracing-workaround-no-file-program.yml +++ b/pr-checks/checks/go-indirect-tracing-workaround-no-file-program.yml @@ -1,7 +1,6 @@ name: "Go: diagnostic when `file` is not installed" description: "Checks that we emit a diagnostic if the `file` program is not installed" # only Linux is affected -operatingSystems: ["ubuntu"] # pinned to a version which does not support statically linked binaries for indirect tracing versions: ["default"] installGo: true diff --git a/pr-checks/checks/go-indirect-tracing-workaround.yml b/pr-checks/checks/go-indirect-tracing-workaround.yml index 5c6690128..222b964c7 100644 --- a/pr-checks/checks/go-indirect-tracing-workaround.yml +++ b/pr-checks/checks/go-indirect-tracing-workaround.yml @@ -1,7 +1,6 @@ name: "Go: workaround for indirect tracing" description: "Checks that our workaround for indirect tracing for Go 1.21+ on Linux works" # only Linux is affected -operatingSystems: ["ubuntu"] # pinned to a version which does not support statically linked binaries for indirect tracing versions: ["default"] installGo: true diff --git a/pr-checks/checks/init-with-registries.yml b/pr-checks/checks/init-with-registries.yml index bc45d255a..cedc62aab 100644 --- a/pr-checks/checks/init-with-registries.yml +++ b/pr-checks/checks/init-with-registries.yml @@ -62,8 +62,6 @@ steps: fi - name: Verify contents of qlconfig.yml - # yq is not available on windows - if: runner.os != 'Windows' run: | QLCONFIG_PATH=$RUNNER_TEMP/qlconfig.yml cat $QLCONFIG_PATH | yq -e '.registries[] | select(.url == "https://ghcr.io/v2/") | select(.packages == "*/*")' diff --git a/pr-checks/checks/javascript-source-root.yml b/pr-checks/checks/javascript-source-root.yml index 9c933576e..b06dc7bfa 100644 --- a/pr-checks/checks/javascript-source-root.yml +++ b/pr-checks/checks/javascript-source-root.yml @@ -1,7 +1,6 @@ name: "Custom source root" description: "Checks that the argument specifying a non-default source root works" versions: ["linked", "default", "nightly-latest"] # This feature is not compatible with old CLIs -operatingSystems: ["ubuntu"] steps: - name: Move codeql-action run: | diff --git a/pr-checks/checks/job-run-uuid-sarif.yml b/pr-checks/checks/job-run-uuid-sarif.yml index 196e32178..9c0f843d4 100644 --- a/pr-checks/checks/job-run-uuid-sarif.yml +++ b/pr-checks/checks/job-run-uuid-sarif.yml @@ -1,6 +1,5 @@ name: "Job run UUID added to SARIF" description: "Tests that the job run UUID is added to the SARIF output" -operatingSystems: ["ubuntu"] versions: ["nightly-latest"] steps: - uses: ./../action/init diff --git a/pr-checks/checks/language-aliases.yml b/pr-checks/checks/language-aliases.yml index 16f5f044f..b0db1288a 100644 --- a/pr-checks/checks/language-aliases.yml +++ b/pr-checks/checks/language-aliases.yml @@ -1,7 +1,6 @@ name: "Language aliases" description: "Tests that language aliases are resolved correctly" versions: ["linked"] -operatingSystems: ["ubuntu"] steps: - uses: ./../action/init with: diff --git a/pr-checks/checks/overlay-init-fallback.yml b/pr-checks/checks/overlay-init-fallback.yml index 44d19d79c..bfcfd27e7 100644 --- a/pr-checks/checks/overlay-init-fallback.yml +++ b/pr-checks/checks/overlay-init-fallback.yml @@ -1,7 +1,6 @@ name: "Overlay database init fallback" description: "Tests that overlay init action succeeds with non-overlay packs" versions: ["linked", "nightly-latest"] -operatingSystems: ["ubuntu"] steps: - uses: ./../action/init with: diff --git a/pr-checks/checks/rubocop-multi-language.yml b/pr-checks/checks/rubocop-multi-language.yml index b4439a2d3..10819a461 100644 --- a/pr-checks/checks/rubocop-multi-language.yml +++ b/pr-checks/checks/rubocop-multi-language.yml @@ -1,6 +1,5 @@ name: "RuboCop multi-language" description: "Tests using RuboCop to analyze a multi-language repository and then using the CodeQL Action to upload the resulting SARIF" -operatingSystems: ["ubuntu"] # This check doesn't use CodeQL, so the `version` matrix variable is unused. versions: ["default"] steps: diff --git a/pr-checks/checks/rust.yml b/pr-checks/checks/rust.yml index 67920538d..c19fc986d 100644 --- a/pr-checks/checks/rust.yml +++ b/pr-checks/checks/rust.yml @@ -8,7 +8,6 @@ versions: - linked - default - nightly-latest -operatingSystems: ["ubuntu"] steps: - uses: ./../action/init with: diff --git a/pr-checks/checks/submit-sarif-failure.yml b/pr-checks/checks/submit-sarif-failure.yml index ba67db39f..97332e4c9 100644 --- a/pr-checks/checks/submit-sarif-failure.yml +++ b/pr-checks/checks/submit-sarif-failure.yml @@ -1,7 +1,6 @@ name: Submit SARIF after failure description: Check that a SARIF file is submitted for the workflow run if it fails versions: ["linked", "default", "nightly-latest"] -operatingSystems: ["ubuntu"] env: # Internal-only environment variable used to indicate that the post-init Action diff --git a/pr-checks/checks/test-autobuild-working-dir.yml b/pr-checks/checks/test-autobuild-working-dir.yml index eda3677f6..77c1f73c8 100644 --- a/pr-checks/checks/test-autobuild-working-dir.yml +++ b/pr-checks/checks/test-autobuild-working-dir.yml @@ -1,7 +1,6 @@ name: "Autobuild working directory" description: "Tests working-directory input of autobuild action" versions: ["linked"] -operatingSystems: ["ubuntu"] steps: - name: Test setup run: | diff --git a/pr-checks/checks/test-local-codeql.yml b/pr-checks/checks/test-local-codeql.yml index 1e41e5dd3..c16c2bf50 100644 --- a/pr-checks/checks/test-local-codeql.yml +++ b/pr-checks/checks/test-local-codeql.yml @@ -1,7 +1,6 @@ name: "Local CodeQL bundle" description: "Tests using a CodeQL bundle from a local file rather than a URL" versions: ["linked"] -operatingSystems: ["ubuntu"] installGo: true steps: - name: Fetch latest CodeQL bundle diff --git a/pr-checks/checks/test-proxy.yml b/pr-checks/checks/test-proxy.yml index 39efb214e..1d6412574 100644 --- a/pr-checks/checks/test-proxy.yml +++ b/pr-checks/checks/test-proxy.yml @@ -1,7 +1,6 @@ name: "Proxy test" description: "Tests using a proxy specified by the https_proxy environment variable" versions: ["linked", "nightly-latest"] -operatingSystems: ["ubuntu"] container: image: ubuntu:22.04 container-init-steps: diff --git a/pr-checks/sync.py b/pr-checks/sync.py index 206519cc4..fc756c788 100755 --- a/pr-checks/sync.py +++ b/pr-checks/sync.py @@ -29,12 +29,6 @@ defaultTestVersions = [ "nightly-latest" ] -def is_os_and_version_excluded(os, version, exclude_params): - for exclude_param in exclude_params: - if exclude_param[0] == os and exclude_param[1] == version: - return True - return False - # When updating the ruamel.yaml version here, update the PR check in # `.github/workflows/pr-checks.yml` too. header = """# Warning: This file is generated automatically, and should not be modified. @@ -78,22 +72,17 @@ for file in sorted((this_dir / 'checks').glob('*.yml')): if 'inputs' in checkSpecification: workflowInputs = checkSpecification['inputs'] - excludedOsesAndVersions = checkSpecification.get('excludeOsAndVersionCombination', []) for version in checkSpecification.get('versions', defaultTestVersions): if version == "latest": raise ValueError('Did not recognize "version: latest". Did you mean "version: linked"?') runnerImages = ["ubuntu-latest", "macos-latest", "windows-latest"] - operatingSystems = checkSpecification.get('operatingSystems', ["ubuntu", "macos", "windows"]) + operatingSystems = checkSpecification.get('operatingSystems', ["ubuntu"]) for operatingSystem in operatingSystems: runnerImagesForOs = [image for image in runnerImages if image.startswith(operatingSystem)] for runnerImage in runnerImagesForOs: - # Skip appending this combination to the matrix if it is explicitly excluded. - if is_os_and_version_excluded(operatingSystem, version, excludedOsesAndVersions): - continue - matrix.append({ 'os': runnerImage, 'version': version From 29a4b8731d5be5fe16b29b85e89d351c547b84d0 Mon Sep 17 00:00:00 2001 From: Henry Mercer Date: Tue, 23 Sep 2025 14:40:02 +0200 Subject: [PATCH 27/53] Run code scanning config tests on Linux only --- .github/workflows/codescanning-config-cli.yml | 6 ------ 1 file changed, 6 deletions(-) diff --git a/.github/workflows/codescanning-config-cli.yml b/.github/workflows/codescanning-config-cli.yml index 316cb7d13..eca3902c2 100644 --- a/.github/workflows/codescanning-config-cli.yml +++ b/.github/workflows/codescanning-config-cli.yml @@ -41,16 +41,10 @@ jobs: include: - os: ubuntu-latest version: linked - - os: macos-latest - version: linked - os: ubuntu-latest version: default - - os: macos-latest - version: default - os: ubuntu-latest version: nightly-latest - - os: macos-latest - version: nightly-latest # Code-Scanning config not created because environment variable is not set name: Code Scanning Configuration tests From 1ba789f61707358cee314f372ea10300c7bd224b Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 23 Sep 2025 12:52:28 +0000 Subject: [PATCH 28/53] Bump the actions group across 1 directory with 2 updates Bumps the actions group with 2 updates in the / directory: [ruby/setup-ruby](https://github.com/ruby/setup-ruby) and [actions/create-github-app-token](https://github.com/actions/create-github-app-token). Updates `ruby/setup-ruby` from 1.257.0 to 1.263.0 - [Release notes](https://github.com/ruby/setup-ruby/releases) - [Changelog](https://github.com/ruby/setup-ruby/blob/master/release.rb) - [Commits](https://github.com/ruby/setup-ruby/compare/44511735964dcb71245e7e55f72539531f7bc0eb...0481980f17b760ef6bca5e8c55809102a0af1e5a) Updates `actions/create-github-app-token` from 2.1.1 to 2.1.4 - [Release notes](https://github.com/actions/create-github-app-token/releases) - [Commits](https://github.com/actions/create-github-app-token/compare/v2.1.1...v2.1.4) --- updated-dependencies: - dependency-name: ruby/setup-ruby dependency-version: 1.263.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: actions/create-github-app-token dependency-version: 2.1.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions ... Signed-off-by: dependabot[bot] --- .github/workflows/__rubocop-multi-language.yml | 2 +- .github/workflows/post-release-mergeback.yml | 2 +- .github/workflows/rollback-release.yml | 2 +- .github/workflows/update-release-branch.yml | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/__rubocop-multi-language.yml b/.github/workflows/__rubocop-multi-language.yml index 2ab2b5616..200a06b32 100644 --- a/.github/workflows/__rubocop-multi-language.yml +++ b/.github/workflows/__rubocop-multi-language.yml @@ -55,7 +55,7 @@ jobs: use-all-platform-bundle: 'false' setup-kotlin: 'true' - name: Set up Ruby - uses: ruby/setup-ruby@44511735964dcb71245e7e55f72539531f7bc0eb # v1.257.0 + uses: ruby/setup-ruby@0481980f17b760ef6bca5e8c55809102a0af1e5a # v1.263.0 with: ruby-version: 2.6 - name: Install Code Scanning integration diff --git a/.github/workflows/post-release-mergeback.yml b/.github/workflows/post-release-mergeback.yml index 5f28ffffe..03efc0c33 100644 --- a/.github/workflows/post-release-mergeback.yml +++ b/.github/workflows/post-release-mergeback.yml @@ -139,7 +139,7 @@ jobs: token: "${{ secrets.GITHUB_TOKEN }}" - name: Generate token - uses: actions/create-github-app-token@v2.1.1 + uses: actions/create-github-app-token@v2.1.4 id: app-token with: app-id: ${{ vars.AUTOMATION_APP_ID }} diff --git a/.github/workflows/rollback-release.yml b/.github/workflows/rollback-release.yml index cf11d2ca1..937c413f9 100644 --- a/.github/workflows/rollback-release.yml +++ b/.github/workflows/rollback-release.yml @@ -133,7 +133,7 @@ jobs: - name: Generate token if: github.event_name == 'workflow_dispatch' - uses: actions/create-github-app-token@v2.1.1 + uses: actions/create-github-app-token@v2.1.4 id: app-token with: app-id: ${{ vars.AUTOMATION_APP_ID }} diff --git a/.github/workflows/update-release-branch.yml b/.github/workflows/update-release-branch.yml index f850f6505..69700a35f 100644 --- a/.github/workflows/update-release-branch.yml +++ b/.github/workflows/update-release-branch.yml @@ -93,7 +93,7 @@ jobs: pull-requests: write # needed to create pull request steps: - name: Generate token - uses: actions/create-github-app-token@v2.1.1 + uses: actions/create-github-app-token@v2.1.4 id: app-token with: app-id: ${{ vars.AUTOMATION_APP_ID }} From a29637ac0183066fa8c0989ed5e8fa9d3c31e4b0 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Tue, 23 Sep 2025 12:54:09 +0000 Subject: [PATCH 29/53] Rebuild --- pr-checks/checks/rubocop-multi-language.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pr-checks/checks/rubocop-multi-language.yml b/pr-checks/checks/rubocop-multi-language.yml index b4439a2d3..2be248a5f 100644 --- a/pr-checks/checks/rubocop-multi-language.yml +++ b/pr-checks/checks/rubocop-multi-language.yml @@ -5,7 +5,7 @@ operatingSystems: ["ubuntu"] versions: ["default"] steps: - name: Set up Ruby - uses: ruby/setup-ruby@44511735964dcb71245e7e55f72539531f7bc0eb # v1.257.0 + uses: ruby/setup-ruby@0481980f17b760ef6bca5e8c55809102a0af1e5a # v1.263.0 with: ruby-version: 2.6 - name: Install Code Scanning integration From 78e8dc01613759650c078cfaf549362b32493cbf Mon Sep 17 00:00:00 2001 From: Henry Mercer Date: Tue, 23 Sep 2025 14:59:56 +0200 Subject: [PATCH 30/53] Trigger sync back script automatically --- .github/dependabot.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 82313bc87..53072580b 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -23,6 +23,8 @@ updates: directory: "/" schedule: interval: weekly + labels: + - Rebuild groups: actions: patterns: From d34e2474449ae573abcc4a4491c81a79565fc506 Mon Sep 17 00:00:00 2001 From: Henry Mercer Date: Tue, 23 Sep 2025 15:00:15 +0200 Subject: [PATCH 31/53] Enable Dependabot updates for other Actions in `.github/actions` --- .github/dependabot.yml | 12 +++--------- 1 file changed, 3 insertions(+), 9 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 53072580b..ba65192a2 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -20,7 +20,9 @@ updates: patterns: - "*" - package-ecosystem: github-actions - directory: "/" + directories: + - "/" + - "/.github/actions" # All subdirectories outside of "/.github/workflows" must be explicitly included. schedule: interval: weekly labels: @@ -29,11 +31,3 @@ updates: actions: patterns: - "*" - - package-ecosystem: github-actions - directory: "/.github/actions/setup-swift/" # All subdirectories outside of "/.github/workflows" must be explicitly included. - schedule: - interval: weekly - groups: - actions-setup-swift: - patterns: - - "*" From 1b12ed7ea89162bf793ecab8dff3911b47ae8878 Mon Sep 17 00:00:00 2001 From: Henry Mercer Date: Tue, 23 Sep 2025 15:15:15 +0200 Subject: [PATCH 32/53] Run resolve environment PR checks cross-platform --- .github/workflows/__resolve-environment-action.yml | 12 ++++++++++++ pr-checks/checks/resolve-environment-action.yml | 1 + 2 files changed, 13 insertions(+) diff --git a/.github/workflows/__resolve-environment-action.yml b/.github/workflows/__resolve-environment-action.yml index da2d3c0f9..f7ca25276 100644 --- a/.github/workflows/__resolve-environment-action.yml +++ b/.github/workflows/__resolve-environment-action.yml @@ -38,10 +38,22 @@ jobs: include: - os: ubuntu-latest version: default + - os: macos-latest + version: default + - os: windows-latest + version: default - os: ubuntu-latest version: linked + - os: macos-latest + version: linked + - os: windows-latest + version: linked - os: ubuntu-latest version: nightly-latest + - os: macos-latest + version: nightly-latest + - os: windows-latest + version: nightly-latest name: Resolve environment permissions: contents: read diff --git a/pr-checks/checks/resolve-environment-action.yml b/pr-checks/checks/resolve-environment-action.yml index 9722b7228..ed78e0bdb 100644 --- a/pr-checks/checks/resolve-environment-action.yml +++ b/pr-checks/checks/resolve-environment-action.yml @@ -1,5 +1,6 @@ name: "Resolve environment" description: "Tests that the resolve-environment action works for Go and JavaScript/TypeScript" +operatingSystems: ["ubuntu", "macos", "windows"] versions: ["default", "linked", "nightly-latest"] steps: - uses: ./../action/init From c6674f9abda66198b5c68f06c35c6ed3be7ba60c Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 24 Sep 2025 10:13:41 +0000 Subject: [PATCH 33/53] Bump the npm group with 3 updates Bumps the npm group with 3 updates: [@eslint/compat](https://github.com/eslint/rewrite/tree/HEAD/packages/compat), [@typescript-eslint/eslint-plugin](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin) and [@typescript-eslint/parser](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser). Updates `@eslint/compat` from 1.3.2 to 1.4.0 - [Release notes](https://github.com/eslint/rewrite/releases) - [Changelog](https://github.com/eslint/rewrite/blob/main/packages/compat/CHANGELOG.md) - [Commits](https://github.com/eslint/rewrite/commits/compat-v1.4.0/packages/compat) Updates `@typescript-eslint/eslint-plugin` from 8.44.0 to 8.44.1 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/eslint-plugin/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.44.1/packages/eslint-plugin) Updates `@typescript-eslint/parser` from 8.44.0 to 8.44.1 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/parser/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.44.1/packages/parser) --- updated-dependencies: - dependency-name: "@eslint/compat" dependency-version: 1.4.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm - dependency-name: "@typescript-eslint/eslint-plugin" dependency-version: 8.44.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm - dependency-name: "@typescript-eslint/parser" dependency-version: 8.44.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm ... Signed-off-by: dependabot[bot] --- package-lock.json | 235 +++++++++++++++++++++++++--------------------- package.json | 4 +- 2 files changed, 131 insertions(+), 108 deletions(-) diff --git a/package-lock.json b/package-lock.json index 3873f3dfd..a98d6f652 100644 --- a/package-lock.json +++ b/package-lock.json @@ -38,7 +38,7 @@ }, "devDependencies": { "@ava/typescript": "6.0.0", - "@eslint/compat": "^1.3.2", + "@eslint/compat": "^1.4.0", "@eslint/eslintrc": "^3.3.1", "@eslint/js": "^9.36.0", "@microsoft/eslint-formatter-sarif": "^3.1.0", @@ -51,7 +51,7 @@ "@types/node-forge": "^1.3.14", "@types/semver": "^7.7.1", "@types/sinon": "^17.0.4", - "@typescript-eslint/eslint-plugin": "^8.44.0", + "@typescript-eslint/eslint-plugin": "^8.44.1", "@typescript-eslint/parser": "^8.41.0", "ava": "^6.4.1", "esbuild": "^0.25.10", @@ -1248,11 +1248,14 @@ } }, "node_modules/@eslint/compat": { - "version": "1.3.2", - "resolved": "https://registry.npmjs.org/@eslint/compat/-/compat-1.3.2.tgz", - "integrity": "sha512-jRNwzTbd6p2Rw4sZ1CgWRS8YMtqG15YyZf7zvb6gY2rB2u6n+2Z+ELW0GtL0fQgyl0pr4Y/BzBfng/BdsereRA==", + "version": "1.4.0", + "resolved": "https://registry.npmjs.org/@eslint/compat/-/compat-1.4.0.tgz", + "integrity": "sha512-DEzm5dKeDBPm3r08Ixli/0cmxr8LkRdwxMRUIJBlSCpAwSrvFEJpVBzV+66JhDxiaqKxnRzCXhtiMiczF7Hglg==", "dev": true, "license": "Apache-2.0", + "dependencies": { + "@eslint/core": "^0.16.0" + }, "engines": { "node": "^18.18.0 || ^20.9.0 || >=21.1.0" }, @@ -1265,6 +1268,19 @@ } } }, + "node_modules/@eslint/core": { + "version": "0.16.0", + "resolved": "https://registry.npmjs.org/@eslint/core/-/core-0.16.0.tgz", + "integrity": "sha512-nmC8/totwobIiFcGkDza3GIKfAw1+hLiYVrh3I1nIomQ8PEr5cxg34jnkmGawul/ep52wGRAcyeDCNtWKSOj4Q==", + "dev": true, + "license": "Apache-2.0", + "dependencies": { + "@types/json-schema": "^7.0.15" + }, + "engines": { + "node": "^18.18.0 || ^20.9.0 || >=21.1.0" + } + }, "node_modules/@eslint/eslintrc": { "version": "3.3.1", "resolved": "https://registry.npmjs.org/@eslint/eslintrc/-/eslintrc-3.3.1.tgz", @@ -2631,6 +2647,13 @@ "dev": true, "license": "MIT" }, + "node_modules/@types/json-schema": { + "version": "7.0.15", + "resolved": "https://registry.npmjs.org/@types/json-schema/-/json-schema-7.0.15.tgz", + "integrity": "sha512-5+fP8P8MFNC+AyZCDxrB2pkZFPGzqQWUzpSeuuVLvm8VMcorNYavBqoFcxK8bQz4Qsbn4oUEEem4wDLfcysGHA==", + "dev": true, + "license": "MIT" + }, "node_modules/@types/json5": { "version": "0.0.29", "dev": true, @@ -2689,17 +2712,17 @@ "license": "MIT" }, "node_modules/@typescript-eslint/eslint-plugin": { - "version": "8.44.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-8.44.0.tgz", - "integrity": "sha512-EGDAOGX+uwwekcS0iyxVDmRV9HX6FLSM5kzrAToLTsr9OWCIKG/y3lQheCq18yZ5Xh78rRKJiEpP0ZaCs4ryOQ==", + "version": "8.44.1", + "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-8.44.1.tgz", + "integrity": "sha512-molgphGqOBT7t4YKCSkbasmu1tb1MgrZ2szGzHbclF7PNmOkSTQVHy+2jXOSnxvR3+Xe1yySHFZoqMpz3TfQsw==", "dev": true, "license": "MIT", "dependencies": { "@eslint-community/regexpp": "^4.10.0", - "@typescript-eslint/scope-manager": "8.44.0", - "@typescript-eslint/type-utils": "8.44.0", - "@typescript-eslint/utils": "8.44.0", - "@typescript-eslint/visitor-keys": "8.44.0", + "@typescript-eslint/scope-manager": "8.44.1", + "@typescript-eslint/type-utils": "8.44.1", + "@typescript-eslint/utils": "8.44.1", + "@typescript-eslint/visitor-keys": "8.44.1", "graphemer": "^1.4.0", "ignore": "^7.0.0", "natural-compare": "^1.4.0", @@ -2713,20 +2736,20 @@ "url": "https://opencollective.com/typescript-eslint" }, "peerDependencies": { - "@typescript-eslint/parser": "^8.44.0", + "@typescript-eslint/parser": "^8.44.1", "eslint": "^8.57.0 || ^9.0.0", "typescript": ">=4.8.4 <6.0.0" } }, "node_modules/@typescript-eslint/eslint-plugin/node_modules/@typescript-eslint/scope-manager": { - "version": "8.44.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.44.0.tgz", - "integrity": "sha512-87Jv3E+al8wpD+rIdVJm/ItDBe/Im09zXIjFoipOjr5gHUhJmTzfFLuTJ/nPTMc2Srsroy4IBXwcTCHyRR7KzA==", + "version": "8.44.1", + "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.44.1.tgz", + "integrity": "sha512-NdhWHgmynpSvyhchGLXh+w12OMT308Gm25JoRIyTZqEbApiBiQHD/8xgb6LqCWCFcxFtWwaVdFsLPQI3jvhywg==", "dev": true, "license": "MIT", "dependencies": { - "@typescript-eslint/types": "8.44.0", - "@typescript-eslint/visitor-keys": "8.44.0" + "@typescript-eslint/types": "8.44.1", + "@typescript-eslint/visitor-keys": "8.44.1" }, "engines": { "node": "^18.18.0 || ^20.9.0 || >=21.1.0" @@ -2737,9 +2760,9 @@ } }, "node_modules/@typescript-eslint/eslint-plugin/node_modules/@typescript-eslint/types": { - "version": "8.44.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.44.0.tgz", - "integrity": "sha512-ZSl2efn44VsYM0MfDQe68RKzBz75NPgLQXuGypmym6QVOWL5kegTZuZ02xRAT9T+onqvM6T8CdQk0OwYMB6ZvA==", + "version": "8.44.1", + "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.44.1.tgz", + "integrity": "sha512-Lk7uj7y9uQUOEguiDIDLYLJOrYHQa7oBiURYVFqIpGxclAFQ78f6VUOM8lI2XEuNOKNB7XuvM2+2cMXAoq4ALQ==", "dev": true, "license": "MIT", "engines": { @@ -2751,16 +2774,16 @@ } }, "node_modules/@typescript-eslint/eslint-plugin/node_modules/@typescript-eslint/typescript-estree": { - "version": "8.44.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.44.0.tgz", - "integrity": "sha512-lqNj6SgnGcQZwL4/SBJ3xdPEfcBuhCG8zdcwCPgYcmiPLgokiNDKlbPzCwEwu7m279J/lBYWtDYL+87OEfn8Jw==", + "version": "8.44.1", + "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.44.1.tgz", + "integrity": "sha512-qnQJ+mVa7szevdEyvfItbO5Vo+GfZ4/GZWWDRRLjrxYPkhM+6zYB2vRYwCsoJLzqFCdZT4mEqyJoyzkunsZ96A==", "dev": true, "license": "MIT", "dependencies": { - "@typescript-eslint/project-service": "8.44.0", - "@typescript-eslint/tsconfig-utils": "8.44.0", - "@typescript-eslint/types": "8.44.0", - "@typescript-eslint/visitor-keys": "8.44.0", + "@typescript-eslint/project-service": "8.44.1", + "@typescript-eslint/tsconfig-utils": "8.44.1", + "@typescript-eslint/types": "8.44.1", + "@typescript-eslint/visitor-keys": "8.44.1", "debug": "^4.3.4", "fast-glob": "^3.3.2", "is-glob": "^4.0.3", @@ -2780,16 +2803,16 @@ } }, "node_modules/@typescript-eslint/eslint-plugin/node_modules/@typescript-eslint/utils": { - "version": "8.44.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-8.44.0.tgz", - "integrity": "sha512-nktOlVcg3ALo0mYlV+L7sWUD58KG4CMj1rb2HUVOO4aL3K/6wcD+NERqd0rrA5Vg06b42YhF6cFxeixsp9Riqg==", + "version": "8.44.1", + "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-8.44.1.tgz", + "integrity": "sha512-DpX5Fp6edTlocMCwA+mHY8Mra+pPjRZ0TfHkXI8QFelIKcbADQz1LUPNtzOFUriBB2UYqw4Pi9+xV4w9ZczHFg==", "dev": true, "license": "MIT", "dependencies": { "@eslint-community/eslint-utils": "^4.7.0", - "@typescript-eslint/scope-manager": "8.44.0", - "@typescript-eslint/types": "8.44.0", - "@typescript-eslint/typescript-estree": "8.44.0" + "@typescript-eslint/scope-manager": "8.44.1", + "@typescript-eslint/types": "8.44.1", + "@typescript-eslint/typescript-estree": "8.44.1" }, "engines": { "node": "^18.18.0 || ^20.9.0 || >=21.1.0" @@ -2804,13 +2827,13 @@ } }, "node_modules/@typescript-eslint/eslint-plugin/node_modules/@typescript-eslint/visitor-keys": { - "version": "8.44.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.44.0.tgz", - "integrity": "sha512-zaz9u8EJ4GBmnehlrpoKvj/E3dNbuQ7q0ucyZImm3cLqJ8INTc970B1qEqDX/Rzq65r3TvVTN7kHWPBoyW7DWw==", + "version": "8.44.1", + "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.44.1.tgz", + "integrity": "sha512-576+u0QD+Jp3tZzvfRfxon0EA2lzcDt3lhUbsC6Lgzy9x2VR4E+JUiNyGHi5T8vk0TV+fpJ5GLG1JsJuWCaKhw==", "dev": true, "license": "MIT", "dependencies": { - "@typescript-eslint/types": "8.44.0", + "@typescript-eslint/types": "8.44.1", "eslint-visitor-keys": "^4.2.1" }, "engines": { @@ -2883,16 +2906,16 @@ } }, "node_modules/@typescript-eslint/parser": { - "version": "8.44.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-8.44.0.tgz", - "integrity": "sha512-VGMpFQGUQWYT9LfnPcX8ouFojyrZ/2w3K5BucvxL/spdNehccKhB4jUyB1yBCXpr2XFm0jkECxgrpXBW2ipoAw==", + "version": "8.44.1", + "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-8.44.1.tgz", + "integrity": "sha512-EHrrEsyhOhxYt8MTg4zTF+DJMuNBzWwgvvOYNj/zm1vnaD/IC5zCXFehZv94Piqa2cRFfXrTFxIvO95L7Qc/cw==", "dev": true, "license": "MIT", "dependencies": { - "@typescript-eslint/scope-manager": "8.44.0", - "@typescript-eslint/types": "8.44.0", - "@typescript-eslint/typescript-estree": "8.44.0", - "@typescript-eslint/visitor-keys": "8.44.0", + "@typescript-eslint/scope-manager": "8.44.1", + "@typescript-eslint/types": "8.44.1", + "@typescript-eslint/typescript-estree": "8.44.1", + "@typescript-eslint/visitor-keys": "8.44.1", "debug": "^4.3.4" }, "engines": { @@ -2908,14 +2931,14 @@ } }, "node_modules/@typescript-eslint/parser/node_modules/@typescript-eslint/scope-manager": { - "version": "8.44.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.44.0.tgz", - "integrity": "sha512-87Jv3E+al8wpD+rIdVJm/ItDBe/Im09zXIjFoipOjr5gHUhJmTzfFLuTJ/nPTMc2Srsroy4IBXwcTCHyRR7KzA==", + "version": "8.44.1", + "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.44.1.tgz", + "integrity": "sha512-NdhWHgmynpSvyhchGLXh+w12OMT308Gm25JoRIyTZqEbApiBiQHD/8xgb6LqCWCFcxFtWwaVdFsLPQI3jvhywg==", "dev": true, "license": "MIT", "dependencies": { - "@typescript-eslint/types": "8.44.0", - "@typescript-eslint/visitor-keys": "8.44.0" + "@typescript-eslint/types": "8.44.1", + "@typescript-eslint/visitor-keys": "8.44.1" }, "engines": { "node": "^18.18.0 || ^20.9.0 || >=21.1.0" @@ -2926,9 +2949,9 @@ } }, "node_modules/@typescript-eslint/parser/node_modules/@typescript-eslint/types": { - "version": "8.44.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.44.0.tgz", - "integrity": "sha512-ZSl2efn44VsYM0MfDQe68RKzBz75NPgLQXuGypmym6QVOWL5kegTZuZ02xRAT9T+onqvM6T8CdQk0OwYMB6ZvA==", + "version": "8.44.1", + "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.44.1.tgz", + "integrity": "sha512-Lk7uj7y9uQUOEguiDIDLYLJOrYHQa7oBiURYVFqIpGxclAFQ78f6VUOM8lI2XEuNOKNB7XuvM2+2cMXAoq4ALQ==", "dev": true, "license": "MIT", "engines": { @@ -2940,16 +2963,16 @@ } }, "node_modules/@typescript-eslint/parser/node_modules/@typescript-eslint/typescript-estree": { - "version": "8.44.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.44.0.tgz", - "integrity": "sha512-lqNj6SgnGcQZwL4/SBJ3xdPEfcBuhCG8zdcwCPgYcmiPLgokiNDKlbPzCwEwu7m279J/lBYWtDYL+87OEfn8Jw==", + "version": "8.44.1", + "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.44.1.tgz", + "integrity": "sha512-qnQJ+mVa7szevdEyvfItbO5Vo+GfZ4/GZWWDRRLjrxYPkhM+6zYB2vRYwCsoJLzqFCdZT4mEqyJoyzkunsZ96A==", "dev": true, "license": "MIT", "dependencies": { - "@typescript-eslint/project-service": "8.44.0", - "@typescript-eslint/tsconfig-utils": "8.44.0", - "@typescript-eslint/types": "8.44.0", - "@typescript-eslint/visitor-keys": "8.44.0", + "@typescript-eslint/project-service": "8.44.1", + "@typescript-eslint/tsconfig-utils": "8.44.1", + "@typescript-eslint/types": "8.44.1", + "@typescript-eslint/visitor-keys": "8.44.1", "debug": "^4.3.4", "fast-glob": "^3.3.2", "is-glob": "^4.0.3", @@ -2969,13 +2992,13 @@ } }, "node_modules/@typescript-eslint/parser/node_modules/@typescript-eslint/visitor-keys": { - "version": "8.44.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.44.0.tgz", - "integrity": "sha512-zaz9u8EJ4GBmnehlrpoKvj/E3dNbuQ7q0ucyZImm3cLqJ8INTc970B1qEqDX/Rzq65r3TvVTN7kHWPBoyW7DWw==", + "version": "8.44.1", + "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.44.1.tgz", + "integrity": "sha512-576+u0QD+Jp3tZzvfRfxon0EA2lzcDt3lhUbsC6Lgzy9x2VR4E+JUiNyGHi5T8vk0TV+fpJ5GLG1JsJuWCaKhw==", "dev": true, "license": "MIT", "dependencies": { - "@typescript-eslint/types": "8.44.0", + "@typescript-eslint/types": "8.44.1", "eslint-visitor-keys": "^4.2.1" }, "engines": { @@ -3039,14 +3062,14 @@ } }, "node_modules/@typescript-eslint/project-service": { - "version": "8.44.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/project-service/-/project-service-8.44.0.tgz", - "integrity": "sha512-ZeaGNraRsq10GuEohKTo4295Z/SuGcSq2LzfGlqiuEvfArzo/VRrT0ZaJsVPuKZ55lVbNk8U6FcL+ZMH8CoyVA==", + "version": "8.44.1", + "resolved": "https://registry.npmjs.org/@typescript-eslint/project-service/-/project-service-8.44.1.tgz", + "integrity": "sha512-ycSa60eGg8GWAkVsKV4E6Nz33h+HjTXbsDT4FILyL8Obk5/mx4tbvCNsLf9zret3ipSumAOG89UcCs/KRaKYrA==", "dev": true, "license": "MIT", "dependencies": { - "@typescript-eslint/tsconfig-utils": "^8.44.0", - "@typescript-eslint/types": "^8.44.0", + "@typescript-eslint/tsconfig-utils": "^8.44.1", + "@typescript-eslint/types": "^8.44.1", "debug": "^4.3.4" }, "engines": { @@ -3061,9 +3084,9 @@ } }, "node_modules/@typescript-eslint/project-service/node_modules/@typescript-eslint/types": { - "version": "8.44.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.44.0.tgz", - "integrity": "sha512-ZSl2efn44VsYM0MfDQe68RKzBz75NPgLQXuGypmym6QVOWL5kegTZuZ02xRAT9T+onqvM6T8CdQk0OwYMB6ZvA==", + "version": "8.44.1", + "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.44.1.tgz", + "integrity": "sha512-Lk7uj7y9uQUOEguiDIDLYLJOrYHQa7oBiURYVFqIpGxclAFQ78f6VUOM8lI2XEuNOKNB7XuvM2+2cMXAoq4ALQ==", "dev": true, "license": "MIT", "engines": { @@ -3093,9 +3116,9 @@ } }, "node_modules/@typescript-eslint/tsconfig-utils": { - "version": "8.44.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/tsconfig-utils/-/tsconfig-utils-8.44.0.tgz", - "integrity": "sha512-x5Y0+AuEPqAInc6yd0n5DAcvtoQ/vyaGwuX5HE9n6qAefk1GaedqrLQF8kQGylLUb9pnZyLf+iEiL9fr8APDtQ==", + "version": "8.44.1", + "resolved": "https://registry.npmjs.org/@typescript-eslint/tsconfig-utils/-/tsconfig-utils-8.44.1.tgz", + "integrity": "sha512-B5OyACouEjuIvof3o86lRMvyDsFwZm+4fBOqFHccIctYgBjqR3qT39FBYGN87khcgf0ExpdCBeGKpKRhSFTjKQ==", "dev": true, "license": "MIT", "engines": { @@ -3110,15 +3133,15 @@ } }, "node_modules/@typescript-eslint/type-utils": { - "version": "8.44.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/type-utils/-/type-utils-8.44.0.tgz", - "integrity": "sha512-9cwsoSxJ8Sak67Be/hD2RNt/fsqmWnNE1iHohG8lxqLSNY8xNfyY7wloo5zpW3Nu9hxVgURevqfcH6vvKCt6yg==", + "version": "8.44.1", + "resolved": "https://registry.npmjs.org/@typescript-eslint/type-utils/-/type-utils-8.44.1.tgz", + "integrity": "sha512-KdEerZqHWXsRNKjF9NYswNISnFzXfXNDfPxoTh7tqohU/PRIbwTmsjGK6V9/RTYWau7NZvfo52lgVk+sJh0K3g==", "dev": true, "license": "MIT", "dependencies": { - "@typescript-eslint/types": "8.44.0", - "@typescript-eslint/typescript-estree": "8.44.0", - "@typescript-eslint/utils": "8.44.0", + "@typescript-eslint/types": "8.44.1", + "@typescript-eslint/typescript-estree": "8.44.1", + "@typescript-eslint/utils": "8.44.1", "debug": "^4.3.4", "ts-api-utils": "^2.1.0" }, @@ -3135,14 +3158,14 @@ } }, "node_modules/@typescript-eslint/type-utils/node_modules/@typescript-eslint/scope-manager": { - "version": "8.44.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.44.0.tgz", - "integrity": "sha512-87Jv3E+al8wpD+rIdVJm/ItDBe/Im09zXIjFoipOjr5gHUhJmTzfFLuTJ/nPTMc2Srsroy4IBXwcTCHyRR7KzA==", + "version": "8.44.1", + "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.44.1.tgz", + "integrity": "sha512-NdhWHgmynpSvyhchGLXh+w12OMT308Gm25JoRIyTZqEbApiBiQHD/8xgb6LqCWCFcxFtWwaVdFsLPQI3jvhywg==", "dev": true, "license": "MIT", "dependencies": { - "@typescript-eslint/types": "8.44.0", - "@typescript-eslint/visitor-keys": "8.44.0" + "@typescript-eslint/types": "8.44.1", + "@typescript-eslint/visitor-keys": "8.44.1" }, "engines": { "node": "^18.18.0 || ^20.9.0 || >=21.1.0" @@ -3153,9 +3176,9 @@ } }, "node_modules/@typescript-eslint/type-utils/node_modules/@typescript-eslint/types": { - "version": "8.44.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.44.0.tgz", - "integrity": "sha512-ZSl2efn44VsYM0MfDQe68RKzBz75NPgLQXuGypmym6QVOWL5kegTZuZ02xRAT9T+onqvM6T8CdQk0OwYMB6ZvA==", + "version": "8.44.1", + "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.44.1.tgz", + "integrity": "sha512-Lk7uj7y9uQUOEguiDIDLYLJOrYHQa7oBiURYVFqIpGxclAFQ78f6VUOM8lI2XEuNOKNB7XuvM2+2cMXAoq4ALQ==", "dev": true, "license": "MIT", "engines": { @@ -3167,16 +3190,16 @@ } }, "node_modules/@typescript-eslint/type-utils/node_modules/@typescript-eslint/typescript-estree": { - "version": "8.44.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.44.0.tgz", - "integrity": "sha512-lqNj6SgnGcQZwL4/SBJ3xdPEfcBuhCG8zdcwCPgYcmiPLgokiNDKlbPzCwEwu7m279J/lBYWtDYL+87OEfn8Jw==", + "version": "8.44.1", + "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.44.1.tgz", + "integrity": "sha512-qnQJ+mVa7szevdEyvfItbO5Vo+GfZ4/GZWWDRRLjrxYPkhM+6zYB2vRYwCsoJLzqFCdZT4mEqyJoyzkunsZ96A==", "dev": true, "license": "MIT", "dependencies": { - "@typescript-eslint/project-service": "8.44.0", - "@typescript-eslint/tsconfig-utils": "8.44.0", - "@typescript-eslint/types": "8.44.0", - "@typescript-eslint/visitor-keys": "8.44.0", + "@typescript-eslint/project-service": "8.44.1", + "@typescript-eslint/tsconfig-utils": "8.44.1", + "@typescript-eslint/types": "8.44.1", + "@typescript-eslint/visitor-keys": "8.44.1", "debug": "^4.3.4", "fast-glob": "^3.3.2", "is-glob": "^4.0.3", @@ -3196,16 +3219,16 @@ } }, "node_modules/@typescript-eslint/type-utils/node_modules/@typescript-eslint/utils": { - "version": "8.44.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-8.44.0.tgz", - "integrity": "sha512-nktOlVcg3ALo0mYlV+L7sWUD58KG4CMj1rb2HUVOO4aL3K/6wcD+NERqd0rrA5Vg06b42YhF6cFxeixsp9Riqg==", + "version": "8.44.1", + "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-8.44.1.tgz", + "integrity": "sha512-DpX5Fp6edTlocMCwA+mHY8Mra+pPjRZ0TfHkXI8QFelIKcbADQz1LUPNtzOFUriBB2UYqw4Pi9+xV4w9ZczHFg==", "dev": true, "license": "MIT", "dependencies": { "@eslint-community/eslint-utils": "^4.7.0", - "@typescript-eslint/scope-manager": "8.44.0", - "@typescript-eslint/types": "8.44.0", - "@typescript-eslint/typescript-estree": "8.44.0" + "@typescript-eslint/scope-manager": "8.44.1", + "@typescript-eslint/types": "8.44.1", + "@typescript-eslint/typescript-estree": "8.44.1" }, "engines": { "node": "^18.18.0 || ^20.9.0 || >=21.1.0" @@ -3220,13 +3243,13 @@ } }, "node_modules/@typescript-eslint/type-utils/node_modules/@typescript-eslint/visitor-keys": { - "version": "8.44.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.44.0.tgz", - "integrity": "sha512-zaz9u8EJ4GBmnehlrpoKvj/E3dNbuQ7q0ucyZImm3cLqJ8INTc970B1qEqDX/Rzq65r3TvVTN7kHWPBoyW7DWw==", + "version": "8.44.1", + "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.44.1.tgz", + "integrity": "sha512-576+u0QD+Jp3tZzvfRfxon0EA2lzcDt3lhUbsC6Lgzy9x2VR4E+JUiNyGHi5T8vk0TV+fpJ5GLG1JsJuWCaKhw==", "dev": true, "license": "MIT", "dependencies": { - "@typescript-eslint/types": "8.44.0", + "@typescript-eslint/types": "8.44.1", "eslint-visitor-keys": "^4.2.1" }, "engines": { diff --git a/package.json b/package.json index b53112257..e44344054 100644 --- a/package.json +++ b/package.json @@ -52,7 +52,7 @@ }, "devDependencies": { "@ava/typescript": "6.0.0", - "@eslint/compat": "^1.3.2", + "@eslint/compat": "^1.4.0", "@eslint/eslintrc": "^3.3.1", "@eslint/js": "^9.36.0", "@microsoft/eslint-formatter-sarif": "^3.1.0", @@ -65,7 +65,7 @@ "@types/node-forge": "^1.3.14", "@types/semver": "^7.7.1", "@types/sinon": "^17.0.4", - "@typescript-eslint/eslint-plugin": "^8.44.0", + "@typescript-eslint/eslint-plugin": "^8.44.1", "@typescript-eslint/parser": "^8.41.0", "ava": "^6.4.1", "esbuild": "^0.25.10", From f54c1c0b3338f53d976746c9d4fe60264dd89fd4 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Wed, 24 Sep 2025 10:14:58 +0000 Subject: [PATCH 34/53] Rebuild --- lib/analyze-action-post.js | 4 ++-- lib/analyze-action.js | 4 ++-- lib/autobuild-action.js | 4 ++-- lib/init-action-post.js | 4 ++-- lib/init-action.js | 4 ++-- lib/resolve-environment-action.js | 4 ++-- lib/start-proxy-action-post.js | 4 ++-- lib/start-proxy-action.js | 4 ++-- lib/upload-lib.js | 4 ++-- lib/upload-sarif-action-post.js | 4 ++-- lib/upload-sarif-action.js | 4 ++-- 11 files changed, 22 insertions(+), 22 deletions(-) diff --git a/lib/analyze-action-post.js b/lib/analyze-action-post.js index 98c3dd52d..32520e912 100644 --- a/lib/analyze-action-post.js +++ b/lib/analyze-action-post.js @@ -26490,7 +26490,7 @@ var require_package = __commonJS({ }, devDependencies: { "@ava/typescript": "6.0.0", - "@eslint/compat": "^1.3.2", + "@eslint/compat": "^1.4.0", "@eslint/eslintrc": "^3.3.1", "@eslint/js": "^9.36.0", "@microsoft/eslint-formatter-sarif": "^3.1.0", @@ -26503,7 +26503,7 @@ var require_package = __commonJS({ "@types/node-forge": "^1.3.14", "@types/semver": "^7.7.1", "@types/sinon": "^17.0.4", - "@typescript-eslint/eslint-plugin": "^8.44.0", + "@typescript-eslint/eslint-plugin": "^8.44.1", "@typescript-eslint/parser": "^8.41.0", ava: "^6.4.1", esbuild: "^0.25.10", diff --git a/lib/analyze-action.js b/lib/analyze-action.js index 40f7662f3..164ad518f 100644 --- a/lib/analyze-action.js +++ b/lib/analyze-action.js @@ -32339,7 +32339,7 @@ var require_package = __commonJS({ }, devDependencies: { "@ava/typescript": "6.0.0", - "@eslint/compat": "^1.3.2", + "@eslint/compat": "^1.4.0", "@eslint/eslintrc": "^3.3.1", "@eslint/js": "^9.36.0", "@microsoft/eslint-formatter-sarif": "^3.1.0", @@ -32352,7 +32352,7 @@ var require_package = __commonJS({ "@types/node-forge": "^1.3.14", "@types/semver": "^7.7.1", "@types/sinon": "^17.0.4", - "@typescript-eslint/eslint-plugin": "^8.44.0", + "@typescript-eslint/eslint-plugin": "^8.44.1", "@typescript-eslint/parser": "^8.41.0", ava: "^6.4.1", esbuild: "^0.25.10", diff --git a/lib/autobuild-action.js b/lib/autobuild-action.js index 7ebf6a918..ae94e5fc8 100644 --- a/lib/autobuild-action.js +++ b/lib/autobuild-action.js @@ -26490,7 +26490,7 @@ var require_package = __commonJS({ }, devDependencies: { "@ava/typescript": "6.0.0", - "@eslint/compat": "^1.3.2", + "@eslint/compat": "^1.4.0", "@eslint/eslintrc": "^3.3.1", "@eslint/js": "^9.36.0", "@microsoft/eslint-formatter-sarif": "^3.1.0", @@ -26503,7 +26503,7 @@ var require_package = __commonJS({ "@types/node-forge": "^1.3.14", "@types/semver": "^7.7.1", "@types/sinon": "^17.0.4", - "@typescript-eslint/eslint-plugin": "^8.44.0", + "@typescript-eslint/eslint-plugin": "^8.44.1", "@typescript-eslint/parser": "^8.41.0", ava: "^6.4.1", esbuild: "^0.25.10", diff --git a/lib/init-action-post.js b/lib/init-action-post.js index 893fbc0b4..7b156fce4 100644 --- a/lib/init-action-post.js +++ b/lib/init-action-post.js @@ -32339,7 +32339,7 @@ var require_package = __commonJS({ }, devDependencies: { "@ava/typescript": "6.0.0", - "@eslint/compat": "^1.3.2", + "@eslint/compat": "^1.4.0", "@eslint/eslintrc": "^3.3.1", "@eslint/js": "^9.36.0", "@microsoft/eslint-formatter-sarif": "^3.1.0", @@ -32352,7 +32352,7 @@ var require_package = __commonJS({ "@types/node-forge": "^1.3.14", "@types/semver": "^7.7.1", "@types/sinon": "^17.0.4", - "@typescript-eslint/eslint-plugin": "^8.44.0", + "@typescript-eslint/eslint-plugin": "^8.44.1", "@typescript-eslint/parser": "^8.41.0", ava: "^6.4.1", esbuild: "^0.25.10", diff --git a/lib/init-action.js b/lib/init-action.js index 31084d8e8..52b99d631 100644 --- a/lib/init-action.js +++ b/lib/init-action.js @@ -32339,7 +32339,7 @@ var require_package = __commonJS({ }, devDependencies: { "@ava/typescript": "6.0.0", - "@eslint/compat": "^1.3.2", + "@eslint/compat": "^1.4.0", "@eslint/eslintrc": "^3.3.1", "@eslint/js": "^9.36.0", "@microsoft/eslint-formatter-sarif": "^3.1.0", @@ -32352,7 +32352,7 @@ var require_package = __commonJS({ "@types/node-forge": "^1.3.14", "@types/semver": "^7.7.1", "@types/sinon": "^17.0.4", - "@typescript-eslint/eslint-plugin": "^8.44.0", + "@typescript-eslint/eslint-plugin": "^8.44.1", "@typescript-eslint/parser": "^8.41.0", ava: "^6.4.1", esbuild: "^0.25.10", diff --git a/lib/resolve-environment-action.js b/lib/resolve-environment-action.js index aa81b7a90..48be2d053 100644 --- a/lib/resolve-environment-action.js +++ b/lib/resolve-environment-action.js @@ -26490,7 +26490,7 @@ var require_package = __commonJS({ }, devDependencies: { "@ava/typescript": "6.0.0", - "@eslint/compat": "^1.3.2", + "@eslint/compat": "^1.4.0", "@eslint/eslintrc": "^3.3.1", "@eslint/js": "^9.36.0", "@microsoft/eslint-formatter-sarif": "^3.1.0", @@ -26503,7 +26503,7 @@ var require_package = __commonJS({ "@types/node-forge": "^1.3.14", "@types/semver": "^7.7.1", "@types/sinon": "^17.0.4", - "@typescript-eslint/eslint-plugin": "^8.44.0", + "@typescript-eslint/eslint-plugin": "^8.44.1", "@typescript-eslint/parser": "^8.41.0", ava: "^6.4.1", esbuild: "^0.25.10", diff --git a/lib/start-proxy-action-post.js b/lib/start-proxy-action-post.js index ddd00d080..a09a7b664 100644 --- a/lib/start-proxy-action-post.js +++ b/lib/start-proxy-action-post.js @@ -26490,7 +26490,7 @@ var require_package = __commonJS({ }, devDependencies: { "@ava/typescript": "6.0.0", - "@eslint/compat": "^1.3.2", + "@eslint/compat": "^1.4.0", "@eslint/eslintrc": "^3.3.1", "@eslint/js": "^9.36.0", "@microsoft/eslint-formatter-sarif": "^3.1.0", @@ -26503,7 +26503,7 @@ var require_package = __commonJS({ "@types/node-forge": "^1.3.14", "@types/semver": "^7.7.1", "@types/sinon": "^17.0.4", - "@typescript-eslint/eslint-plugin": "^8.44.0", + "@typescript-eslint/eslint-plugin": "^8.44.1", "@typescript-eslint/parser": "^8.41.0", ava: "^6.4.1", esbuild: "^0.25.10", diff --git a/lib/start-proxy-action.js b/lib/start-proxy-action.js index 3a5a85c6b..98ec2e533 100644 --- a/lib/start-proxy-action.js +++ b/lib/start-proxy-action.js @@ -45018,7 +45018,7 @@ var require_package = __commonJS({ }, devDependencies: { "@ava/typescript": "6.0.0", - "@eslint/compat": "^1.3.2", + "@eslint/compat": "^1.4.0", "@eslint/eslintrc": "^3.3.1", "@eslint/js": "^9.36.0", "@microsoft/eslint-formatter-sarif": "^3.1.0", @@ -45031,7 +45031,7 @@ var require_package = __commonJS({ "@types/node-forge": "^1.3.14", "@types/semver": "^7.7.1", "@types/sinon": "^17.0.4", - "@typescript-eslint/eslint-plugin": "^8.44.0", + "@typescript-eslint/eslint-plugin": "^8.44.1", "@typescript-eslint/parser": "^8.41.0", ava: "^6.4.1", esbuild: "^0.25.10", diff --git a/lib/upload-lib.js b/lib/upload-lib.js index 710c4d3e3..d644a7ed4 100644 --- a/lib/upload-lib.js +++ b/lib/upload-lib.js @@ -33636,7 +33636,7 @@ var require_package = __commonJS({ }, devDependencies: { "@ava/typescript": "6.0.0", - "@eslint/compat": "^1.3.2", + "@eslint/compat": "^1.4.0", "@eslint/eslintrc": "^3.3.1", "@eslint/js": "^9.36.0", "@microsoft/eslint-formatter-sarif": "^3.1.0", @@ -33649,7 +33649,7 @@ var require_package = __commonJS({ "@types/node-forge": "^1.3.14", "@types/semver": "^7.7.1", "@types/sinon": "^17.0.4", - "@typescript-eslint/eslint-plugin": "^8.44.0", + "@typescript-eslint/eslint-plugin": "^8.44.1", "@typescript-eslint/parser": "^8.41.0", ava: "^6.4.1", esbuild: "^0.25.10", diff --git a/lib/upload-sarif-action-post.js b/lib/upload-sarif-action-post.js index 87481d864..01c92d982 100644 --- a/lib/upload-sarif-action-post.js +++ b/lib/upload-sarif-action-post.js @@ -26490,7 +26490,7 @@ var require_package = __commonJS({ }, devDependencies: { "@ava/typescript": "6.0.0", - "@eslint/compat": "^1.3.2", + "@eslint/compat": "^1.4.0", "@eslint/eslintrc": "^3.3.1", "@eslint/js": "^9.36.0", "@microsoft/eslint-formatter-sarif": "^3.1.0", @@ -26503,7 +26503,7 @@ var require_package = __commonJS({ "@types/node-forge": "^1.3.14", "@types/semver": "^7.7.1", "@types/sinon": "^17.0.4", - "@typescript-eslint/eslint-plugin": "^8.44.0", + "@typescript-eslint/eslint-plugin": "^8.44.1", "@typescript-eslint/parser": "^8.41.0", ava: "^6.4.1", esbuild: "^0.25.10", diff --git a/lib/upload-sarif-action.js b/lib/upload-sarif-action.js index 2f6e5c0ab..c3ded2faa 100644 --- a/lib/upload-sarif-action.js +++ b/lib/upload-sarif-action.js @@ -32339,7 +32339,7 @@ var require_package = __commonJS({ }, devDependencies: { "@ava/typescript": "6.0.0", - "@eslint/compat": "^1.3.2", + "@eslint/compat": "^1.4.0", "@eslint/eslintrc": "^3.3.1", "@eslint/js": "^9.36.0", "@microsoft/eslint-formatter-sarif": "^3.1.0", @@ -32352,7 +32352,7 @@ var require_package = __commonJS({ "@types/node-forge": "^1.3.14", "@types/semver": "^7.7.1", "@types/sinon": "^17.0.4", - "@typescript-eslint/eslint-plugin": "^8.44.0", + "@typescript-eslint/eslint-plugin": "^8.44.1", "@typescript-eslint/parser": "^8.41.0", ava: "^6.4.1", esbuild: "^0.25.10", From 67a00809333bd1a0e6f33b9185ba2b6dee33600e Mon Sep 17 00:00:00 2001 From: Henry Mercer Date: Wed, 24 Sep 2025 12:36:35 +0200 Subject: [PATCH 35/53] Test all-platform bundle on all platforms --- .github/workflows/__all-platform-bundle.yml | 4 ++++ pr-checks/checks/all-platform-bundle.yml | 1 + 2 files changed, 5 insertions(+) diff --git a/.github/workflows/__all-platform-bundle.yml b/.github/workflows/__all-platform-bundle.yml index 40d6d81c9..d6762100e 100644 --- a/.github/workflows/__all-platform-bundle.yml +++ b/.github/workflows/__all-platform-bundle.yml @@ -48,6 +48,10 @@ jobs: include: - os: ubuntu-latest version: nightly-latest + - os: macos-latest + version: nightly-latest + - os: windows-latest + version: nightly-latest name: All-platform bundle permissions: contents: read diff --git a/pr-checks/checks/all-platform-bundle.yml b/pr-checks/checks/all-platform-bundle.yml index 75c75c8b5..3396be22a 100644 --- a/pr-checks/checks/all-platform-bundle.yml +++ b/pr-checks/checks/all-platform-bundle.yml @@ -1,5 +1,6 @@ name: "All-platform bundle" description: "Tests using an all-platform CodeQL Bundle" +operatingSystems: ["ubuntu", "macos", "windows"] versions: ["nightly-latest"] useAllPlatformBundle: "true" installGo: true From 79bbb1744e64f7d47524ad3ea64f8cdda0087b5c Mon Sep 17 00:00:00 2001 From: Henry Mercer Date: Wed, 24 Sep 2025 12:40:19 +0200 Subject: [PATCH 36/53] Remove PR checks that are now duplicated Direct tracing is now enabled by default. --- .../workflows/__autobuild-direct-tracing.yml | 103 ------------------ .github/workflows/__build-mode-autobuild.yml | 33 +++++- pr-checks/checks/autobuild-direct-tracing.yml | 31 ------ pr-checks/checks/build-mode-autobuild.yml | 12 +- 4 files changed, 42 insertions(+), 137 deletions(-) delete mode 100644 .github/workflows/__autobuild-direct-tracing.yml delete mode 100644 pr-checks/checks/autobuild-direct-tracing.yml diff --git a/.github/workflows/__autobuild-direct-tracing.yml b/.github/workflows/__autobuild-direct-tracing.yml deleted file mode 100644 index aed873e57..000000000 --- a/.github/workflows/__autobuild-direct-tracing.yml +++ /dev/null @@ -1,103 +0,0 @@ -# Warning: This file is generated automatically, and should not be modified. -# Instead, please modify the template in the pr-checks directory and run: -# pr-checks/sync.sh -# to regenerate this file. - -name: PR Check - Autobuild direct tracing -env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - GO111MODULE: auto -on: - push: - branches: - - main - - releases/v* - pull_request: - types: - - opened - - synchronize - - reopened - - ready_for_review - schedule: - - cron: '0 5 * * *' - workflow_dispatch: - inputs: - java-version: - type: string - description: The version of Java to install - required: false - default: '17' - workflow_call: - inputs: - java-version: - type: string - description: The version of Java to install - required: false - default: '17' -defaults: - run: - shell: bash -concurrency: - cancel-in-progress: ${{ github.event_name == 'pull_request' }} - group: ${{ github.workflow }}-${{ github.ref }} -jobs: - autobuild-direct-tracing: - strategy: - fail-fast: false - matrix: - include: - - os: ubuntu-latest - version: linked - - os: windows-latest - version: linked - - os: ubuntu-latest - version: nightly-latest - - os: windows-latest - version: nightly-latest - name: Autobuild direct tracing - permissions: - contents: read - security-events: read - timeout-minutes: 45 - runs-on: ${{ matrix.os }} - steps: - - name: Check out repository - uses: actions/checkout@v5 - - name: Prepare test - id: prepare-test - uses: ./.github/actions/prepare-test - with: - version: ${{ matrix.version }} - use-all-platform-bundle: 'false' - setup-kotlin: 'true' - - name: Install Java - uses: actions/setup-java@v5 - with: - java-version: ${{ inputs.java-version || '17' }} - distribution: temurin - - name: Set up Java test repo configuration - run: | - mv * .github ../action/tests/multi-language-repo/ - mv ../action/tests/multi-language-repo/.github/workflows .github - mv ../action/tests/java-repo/* . - - - uses: ./../action/init - id: init - with: - build-mode: autobuild - db-location: ${{ runner.temp }}/customDbLocation - languages: java - tools: ${{ steps.prepare-test.outputs.tools-url }} - - - name: Check that indirect tracing is disabled - run: | - if [[ ! -z "${CODEQL_RUNNER}" ]]; then - echo "Expected indirect tracing to be disabled, but the" \ - "CODEQL_RUNNER environment variable is set." - exit 1 - fi - - - uses: ./../action/analyze - env: - CODEQL_ACTION_AUTOBUILD_BUILD_MODE_DIRECT_TRACING: true - CODEQL_ACTION_TEST_MODE: true diff --git a/.github/workflows/__build-mode-autobuild.yml b/.github/workflows/__build-mode-autobuild.yml index e24c170cf..07e73d1b6 100644 --- a/.github/workflows/__build-mode-autobuild.yml +++ b/.github/workflows/__build-mode-autobuild.yml @@ -21,9 +21,19 @@ on: schedule: - cron: '0 5 * * *' workflow_dispatch: - inputs: {} + inputs: + java-version: + type: string + description: The version of Java to install + required: false + default: '17' workflow_call: - inputs: {} + inputs: + java-version: + type: string + description: The version of Java to install + required: false + default: '17' defaults: run: shell: bash @@ -37,6 +47,12 @@ jobs: matrix: include: - os: ubuntu-latest + version: linked + - os: windows-latest + version: linked + - os: ubuntu-latest + version: nightly-latest + - os: windows-latest version: nightly-latest name: Build mode autobuild permissions: @@ -54,6 +70,11 @@ jobs: version: ${{ matrix.version }} use-all-platform-bundle: 'false' setup-kotlin: 'true' + - name: Install Java + uses: actions/setup-java@v5 + with: + java-version: ${{ inputs.java-version || '17' }} + distribution: temurin - name: Set up Java test repo configuration run: | mv * .github ../action/tests/multi-language-repo/ @@ -77,6 +98,14 @@ jobs: exit 1 fi + - name: Check that indirect tracing is disabled + run: | + if [[ ! -z "${CODEQL_RUNNER}" ]]; then + echo "Expected indirect tracing to be disabled, but the" \ + "CODEQL_RUNNER environment variable is set." + exit 1 + fi + - uses: ./../action/analyze env: CODEQL_ACTION_TEST_MODE: true diff --git a/pr-checks/checks/autobuild-direct-tracing.yml b/pr-checks/checks/autobuild-direct-tracing.yml deleted file mode 100644 index 1e9d2d900..000000000 --- a/pr-checks/checks/autobuild-direct-tracing.yml +++ /dev/null @@ -1,31 +0,0 @@ -name: "Autobuild direct tracing" -description: "An end-to-end integration test of a Java repository built using 'build-mode: autobuild', with direct tracing enabled" -operatingSystems: ["ubuntu", "windows"] -versions: ["linked", "nightly-latest"] -installJava: "true" -env: - CODEQL_ACTION_AUTOBUILD_BUILD_MODE_DIRECT_TRACING: true -steps: - - name: Set up Java test repo configuration - run: | - mv * .github ../action/tests/multi-language-repo/ - mv ../action/tests/multi-language-repo/.github/workflows .github - mv ../action/tests/java-repo/* . - - - uses: ./../action/init - id: init - with: - build-mode: autobuild - db-location: "${{ runner.temp }}/customDbLocation" - languages: java - tools: ${{ steps.prepare-test.outputs.tools-url }} - - - name: Check that indirect tracing is disabled - run: | - if [[ ! -z "${CODEQL_RUNNER}" ]]; then - echo "Expected indirect tracing to be disabled, but the" \ - "CODEQL_RUNNER environment variable is set." - exit 1 - fi - - - uses: ./../action/analyze diff --git a/pr-checks/checks/build-mode-autobuild.yml b/pr-checks/checks/build-mode-autobuild.yml index 5a5147788..668621490 100644 --- a/pr-checks/checks/build-mode-autobuild.yml +++ b/pr-checks/checks/build-mode-autobuild.yml @@ -1,6 +1,8 @@ name: "Build mode autobuild" description: "An end-to-end integration test of a Java repository built using 'build-mode: autobuild'" -versions: ["nightly-latest"] +operatingSystems: ["ubuntu", "windows"] +versions: ["linked", "nightly-latest"] +installJava: "true" steps: - name: Set up Java test repo configuration run: | @@ -25,4 +27,12 @@ steps: exit 1 fi + - name: Check that indirect tracing is disabled + run: | + if [[ ! -z "${CODEQL_RUNNER}" ]]; then + echo "Expected indirect tracing to be disabled, but the" \ + "CODEQL_RUNNER environment variable is set." + exit 1 + fi + - uses: ./../action/analyze From 8633a151d578ff89ce2a5cc58e0c2c2dfdfc172c Mon Sep 17 00:00:00 2001 From: Henry Mercer Date: Wed, 24 Sep 2025 12:45:10 +0200 Subject: [PATCH 37/53] Remove unnecessary "test" prefix from check names --- ...st-autobuild-working-dir.yml => __autobuild-working-dir.yml} | 2 +- .github/workflows/{__test-proxy.yml => __global-proxy.yml} | 2 +- .../workflows/{__test-local-codeql.yml => __local-bundle.yml} | 2 +- ...test-autobuild-working-dir.yml => autobuild-working-dir.yml} | 0 pr-checks/checks/{test-proxy.yml => global-proxy.yml} | 0 pr-checks/checks/{test-local-codeql.yml => local-bundle.yml} | 0 6 files changed, 3 insertions(+), 3 deletions(-) rename .github/workflows/{__test-autobuild-working-dir.yml => __autobuild-working-dir.yml} (98%) rename .github/workflows/{__test-proxy.yml => __global-proxy.yml} (99%) rename .github/workflows/{__test-local-codeql.yml => __local-bundle.yml} (99%) rename pr-checks/checks/{test-autobuild-working-dir.yml => autobuild-working-dir.yml} (100%) rename pr-checks/checks/{test-proxy.yml => global-proxy.yml} (100%) rename pr-checks/checks/{test-local-codeql.yml => local-bundle.yml} (100%) diff --git a/.github/workflows/__test-autobuild-working-dir.yml b/.github/workflows/__autobuild-working-dir.yml similarity index 98% rename from .github/workflows/__test-autobuild-working-dir.yml rename to .github/workflows/__autobuild-working-dir.yml index 853836cbe..5b1423d0f 100644 --- a/.github/workflows/__test-autobuild-working-dir.yml +++ b/.github/workflows/__autobuild-working-dir.yml @@ -31,7 +31,7 @@ concurrency: cancel-in-progress: ${{ github.event_name == 'pull_request' }} group: ${{ github.workflow }}-${{ github.ref }} jobs: - test-autobuild-working-dir: + autobuild-working-dir: strategy: fail-fast: false matrix: diff --git a/.github/workflows/__test-proxy.yml b/.github/workflows/__global-proxy.yml similarity index 99% rename from .github/workflows/__test-proxy.yml rename to .github/workflows/__global-proxy.yml index 92f333059..575b84385 100644 --- a/.github/workflows/__test-proxy.yml +++ b/.github/workflows/__global-proxy.yml @@ -31,7 +31,7 @@ concurrency: cancel-in-progress: ${{ github.event_name == 'pull_request' }} group: ${{ github.workflow }}-${{ github.ref }} jobs: - test-proxy: + global-proxy: strategy: fail-fast: false matrix: diff --git a/.github/workflows/__test-local-codeql.yml b/.github/workflows/__local-bundle.yml similarity index 99% rename from .github/workflows/__test-local-codeql.yml rename to .github/workflows/__local-bundle.yml index 09e47d922..00b509f54 100644 --- a/.github/workflows/__test-local-codeql.yml +++ b/.github/workflows/__local-bundle.yml @@ -41,7 +41,7 @@ concurrency: cancel-in-progress: ${{ github.event_name == 'pull_request' }} group: ${{ github.workflow }}-${{ github.ref }} jobs: - test-local-codeql: + local-bundle: strategy: fail-fast: false matrix: diff --git a/pr-checks/checks/test-autobuild-working-dir.yml b/pr-checks/checks/autobuild-working-dir.yml similarity index 100% rename from pr-checks/checks/test-autobuild-working-dir.yml rename to pr-checks/checks/autobuild-working-dir.yml diff --git a/pr-checks/checks/test-proxy.yml b/pr-checks/checks/global-proxy.yml similarity index 100% rename from pr-checks/checks/test-proxy.yml rename to pr-checks/checks/global-proxy.yml diff --git a/pr-checks/checks/test-local-codeql.yml b/pr-checks/checks/local-bundle.yml similarity index 100% rename from pr-checks/checks/test-local-codeql.yml rename to pr-checks/checks/local-bundle.yml From ba58de7d6180a03bc7550e8149bbc9746327c10e Mon Sep 17 00:00:00 2001 From: Henry Mercer Date: Wed, 24 Sep 2025 12:51:03 +0200 Subject: [PATCH 38/53] Run resolve environment test against Ubuntu only There isn't really anything platform-specific at the moment. --- .github/workflows/__resolve-environment-action.yml | 12 ------------ pr-checks/checks/resolve-environment-action.yml | 1 - 2 files changed, 13 deletions(-) diff --git a/.github/workflows/__resolve-environment-action.yml b/.github/workflows/__resolve-environment-action.yml index f7ca25276..da2d3c0f9 100644 --- a/.github/workflows/__resolve-environment-action.yml +++ b/.github/workflows/__resolve-environment-action.yml @@ -38,22 +38,10 @@ jobs: include: - os: ubuntu-latest version: default - - os: macos-latest - version: default - - os: windows-latest - version: default - os: ubuntu-latest version: linked - - os: macos-latest - version: linked - - os: windows-latest - version: linked - os: ubuntu-latest version: nightly-latest - - os: macos-latest - version: nightly-latest - - os: windows-latest - version: nightly-latest name: Resolve environment permissions: contents: read diff --git a/pr-checks/checks/resolve-environment-action.yml b/pr-checks/checks/resolve-environment-action.yml index ed78e0bdb..9722b7228 100644 --- a/pr-checks/checks/resolve-environment-action.yml +++ b/pr-checks/checks/resolve-environment-action.yml @@ -1,6 +1,5 @@ name: "Resolve environment" description: "Tests that the resolve-environment action works for Go and JavaScript/TypeScript" -operatingSystems: ["ubuntu", "macos", "windows"] versions: ["default", "linked", "nightly-latest"] steps: - uses: ./../action/init From 86de17c44dbfa3a3dc49064b207eb1e9e22036e3 Mon Sep 17 00:00:00 2001 From: Henry Mercer Date: Wed, 24 Sep 2025 11:54:39 +0100 Subject: [PATCH 39/53] Update Dependabot configuration for GitHub Actions --- .github/dependabot.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index ba65192a2..8953919b9 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -21,8 +21,8 @@ updates: - "*" - package-ecosystem: github-actions directories: - - "/" - - "/.github/actions" # All subdirectories outside of "/.github/workflows" must be explicitly included. + - "/.github/workflows" + - "/.github/actions" schedule: interval: weekly labels: From cec0b17b931a0d2976715952f40ae08890f2fa5b Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Wed, 24 Sep 2025 12:08:05 +0100 Subject: [PATCH 40/53] Skip PR checks for events triggered by Dependabot --- .github/workflows/__all-platform-bundle.yml | 1 + .github/workflows/__analyze-ref-input.yml | 1 + .github/workflows/__autobuild-action.yml | 1 + .../workflows/__autobuild-direct-tracing-with-working-dir.yml | 1 + .github/workflows/__autobuild-direct-tracing.yml | 1 + .github/workflows/__build-mode-autobuild.yml | 1 + .github/workflows/__build-mode-manual.yml | 1 + .github/workflows/__build-mode-none.yml | 1 + .github/workflows/__build-mode-rollback.yml | 1 + .github/workflows/__bundle-toolcache.yml | 1 + .github/workflows/__bundle-zstd.yml | 1 + .github/workflows/__cleanup-db-cluster-dir.yml | 1 + .github/workflows/__config-export.yml | 1 + .github/workflows/__config-input.yml | 1 + .github/workflows/__cpp-deptrace-disabled.yml | 1 + .github/workflows/__cpp-deptrace-enabled-on-macos.yml | 1 + .github/workflows/__cpp-deptrace-enabled.yml | 1 + .github/workflows/__diagnostics-export.yml | 1 + .github/workflows/__export-file-baseline-information.yml | 1 + .github/workflows/__extractor-ram-threads.yml | 1 + .github/workflows/__go-custom-queries.yml | 1 + .../workflows/__go-indirect-tracing-workaround-diagnostic.yml | 1 + .../__go-indirect-tracing-workaround-no-file-program.yml | 1 + .github/workflows/__go-indirect-tracing-workaround.yml | 1 + .github/workflows/__go-tracing-autobuilder.yml | 1 + .github/workflows/__go-tracing-custom-build-steps.yml | 1 + .github/workflows/__go-tracing-legacy-workflow.yml | 1 + .github/workflows/__init-with-registries.yml | 1 + .github/workflows/__javascript-source-root.yml | 1 + .github/workflows/__job-run-uuid-sarif.yml | 1 + .github/workflows/__language-aliases.yml | 1 + .github/workflows/__multi-language-autodetect.yml | 1 + .github/workflows/__overlay-init-fallback.yml | 1 + .github/workflows/__packaging-codescanning-config-inputs-js.yml | 1 + .github/workflows/__packaging-config-inputs-js.yml | 1 + .github/workflows/__packaging-config-js.yml | 1 + .github/workflows/__packaging-inputs-js.yml | 1 + .github/workflows/__quality-queries.yml | 1 + .github/workflows/__remote-config.yml | 1 + .github/workflows/__resolve-environment-action.yml | 1 + .github/workflows/__rubocop-multi-language.yml | 1 + .github/workflows/__ruby.yml | 1 + .github/workflows/__rust.yml | 1 + .github/workflows/__split-workflow.yml | 1 + .github/workflows/__start-proxy.yml | 1 + .github/workflows/__submit-sarif-failure.yml | 1 + .github/workflows/__swift-autobuild.yml | 1 + .github/workflows/__swift-custom-build.yml | 1 + .github/workflows/__test-autobuild-working-dir.yml | 1 + .github/workflows/__test-local-codeql.yml | 1 + .github/workflows/__test-proxy.yml | 1 + .github/workflows/__unset-environment.yml | 1 + .github/workflows/__upload-quality-sarif.yml | 1 + .github/workflows/__upload-ref-sha-input.yml | 1 + .github/workflows/__with-checkout-path.yml | 1 + pr-checks/sync.py | 1 + 56 files changed, 56 insertions(+) diff --git a/.github/workflows/__all-platform-bundle.yml b/.github/workflows/__all-platform-bundle.yml index 4139ede4f..499b12316 100644 --- a/.github/workflows/__all-platform-bundle.yml +++ b/.github/workflows/__all-platform-bundle.yml @@ -49,6 +49,7 @@ jobs: - os: ubuntu-latest version: nightly-latest name: All-platform bundle + if: github.triggering_actor != 'dependabot[bot]' permissions: contents: read security-events: read diff --git a/.github/workflows/__analyze-ref-input.yml b/.github/workflows/__analyze-ref-input.yml index 8f6208b8e..2159072ad 100644 --- a/.github/workflows/__analyze-ref-input.yml +++ b/.github/workflows/__analyze-ref-input.yml @@ -53,6 +53,7 @@ jobs: - os: windows-latest version: default name: "Analyze: 'ref' and 'sha' from inputs" + if: github.triggering_actor != 'dependabot[bot]' permissions: contents: read security-events: read diff --git a/.github/workflows/__autobuild-action.yml b/.github/workflows/__autobuild-action.yml index c623ca25f..c31576339 100644 --- a/.github/workflows/__autobuild-action.yml +++ b/.github/workflows/__autobuild-action.yml @@ -43,6 +43,7 @@ jobs: - os: windows-latest version: linked name: autobuild-action + if: github.triggering_actor != 'dependabot[bot]' permissions: contents: read security-events: read diff --git a/.github/workflows/__autobuild-direct-tracing-with-working-dir.yml b/.github/workflows/__autobuild-direct-tracing-with-working-dir.yml index a0e3d6644..c1de5c19d 100644 --- a/.github/workflows/__autobuild-direct-tracing-with-working-dir.yml +++ b/.github/workflows/__autobuild-direct-tracing-with-working-dir.yml @@ -55,6 +55,7 @@ jobs: - os: windows-latest version: nightly-latest name: Autobuild direct tracing (custom working directory) + if: github.triggering_actor != 'dependabot[bot]' permissions: contents: read security-events: read diff --git a/.github/workflows/__autobuild-direct-tracing.yml b/.github/workflows/__autobuild-direct-tracing.yml index aed873e57..9294edfb8 100644 --- a/.github/workflows/__autobuild-direct-tracing.yml +++ b/.github/workflows/__autobuild-direct-tracing.yml @@ -55,6 +55,7 @@ jobs: - os: windows-latest version: nightly-latest name: Autobuild direct tracing + if: github.triggering_actor != 'dependabot[bot]' permissions: contents: read security-events: read diff --git a/.github/workflows/__build-mode-autobuild.yml b/.github/workflows/__build-mode-autobuild.yml index e24c170cf..a6e880cf0 100644 --- a/.github/workflows/__build-mode-autobuild.yml +++ b/.github/workflows/__build-mode-autobuild.yml @@ -39,6 +39,7 @@ jobs: - os: ubuntu-latest version: nightly-latest name: Build mode autobuild + if: github.triggering_actor != 'dependabot[bot]' permissions: contents: read security-events: read diff --git a/.github/workflows/__build-mode-manual.yml b/.github/workflows/__build-mode-manual.yml index 398b8a831..e0dc25f88 100644 --- a/.github/workflows/__build-mode-manual.yml +++ b/.github/workflows/__build-mode-manual.yml @@ -49,6 +49,7 @@ jobs: - os: ubuntu-latest version: nightly-latest name: Build mode manual + if: github.triggering_actor != 'dependabot[bot]' permissions: contents: read security-events: read diff --git a/.github/workflows/__build-mode-none.yml b/.github/workflows/__build-mode-none.yml index 98f3a2d31..7584f9065 100644 --- a/.github/workflows/__build-mode-none.yml +++ b/.github/workflows/__build-mode-none.yml @@ -41,6 +41,7 @@ jobs: - os: ubuntu-latest version: nightly-latest name: Build mode none + if: github.triggering_actor != 'dependabot[bot]' permissions: contents: read security-events: read diff --git a/.github/workflows/__build-mode-rollback.yml b/.github/workflows/__build-mode-rollback.yml index 64b45fade..c1f3ccd0c 100644 --- a/.github/workflows/__build-mode-rollback.yml +++ b/.github/workflows/__build-mode-rollback.yml @@ -39,6 +39,7 @@ jobs: - os: ubuntu-latest version: nightly-latest name: Build mode rollback + if: github.triggering_actor != 'dependabot[bot]' permissions: contents: read security-events: read diff --git a/.github/workflows/__bundle-toolcache.yml b/.github/workflows/__bundle-toolcache.yml index 0e551b4e1..de3826b65 100644 --- a/.github/workflows/__bundle-toolcache.yml +++ b/.github/workflows/__bundle-toolcache.yml @@ -43,6 +43,7 @@ jobs: - os: windows-latest version: linked name: 'Bundle: Caching checks' + if: github.triggering_actor != 'dependabot[bot]' permissions: contents: read security-events: read diff --git a/.github/workflows/__bundle-zstd.yml b/.github/workflows/__bundle-zstd.yml index 4e4ab2473..0139fdc14 100644 --- a/.github/workflows/__bundle-zstd.yml +++ b/.github/workflows/__bundle-zstd.yml @@ -43,6 +43,7 @@ jobs: - os: windows-latest version: linked name: 'Bundle: Zstandard checks' + if: github.triggering_actor != 'dependabot[bot]' permissions: contents: read security-events: read diff --git a/.github/workflows/__cleanup-db-cluster-dir.yml b/.github/workflows/__cleanup-db-cluster-dir.yml index 6bd5f79b6..dfe53c67c 100644 --- a/.github/workflows/__cleanup-db-cluster-dir.yml +++ b/.github/workflows/__cleanup-db-cluster-dir.yml @@ -39,6 +39,7 @@ jobs: - os: ubuntu-latest version: linked name: Clean up database cluster directory + if: github.triggering_actor != 'dependabot[bot]' permissions: contents: read security-events: read diff --git a/.github/workflows/__config-export.yml b/.github/workflows/__config-export.yml index 6b4bd49b3..1b89d3a18 100644 --- a/.github/workflows/__config-export.yml +++ b/.github/workflows/__config-export.yml @@ -49,6 +49,7 @@ jobs: - os: windows-latest version: nightly-latest name: Config export + if: github.triggering_actor != 'dependabot[bot]' permissions: contents: read security-events: read diff --git a/.github/workflows/__config-input.yml b/.github/workflows/__config-input.yml index aa1ed32ec..30b2cfaec 100644 --- a/.github/workflows/__config-input.yml +++ b/.github/workflows/__config-input.yml @@ -39,6 +39,7 @@ jobs: - os: ubuntu-latest version: linked name: Config input + if: github.triggering_actor != 'dependabot[bot]' permissions: contents: read security-events: read diff --git a/.github/workflows/__cpp-deptrace-disabled.yml b/.github/workflows/__cpp-deptrace-disabled.yml index 92a7635ad..122159236 100644 --- a/.github/workflows/__cpp-deptrace-disabled.yml +++ b/.github/workflows/__cpp-deptrace-disabled.yml @@ -43,6 +43,7 @@ jobs: - os: ubuntu-latest version: nightly-latest name: 'C/C++: disabling autoinstalling dependencies (Linux)' + if: github.triggering_actor != 'dependabot[bot]' permissions: contents: read security-events: read diff --git a/.github/workflows/__cpp-deptrace-enabled-on-macos.yml b/.github/workflows/__cpp-deptrace-enabled-on-macos.yml index 1852b4305..b9669b870 100644 --- a/.github/workflows/__cpp-deptrace-enabled-on-macos.yml +++ b/.github/workflows/__cpp-deptrace-enabled-on-macos.yml @@ -41,6 +41,7 @@ jobs: - os: macos-latest version: nightly-latest name: 'C/C++: autoinstalling dependencies is skipped (macOS)' + if: github.triggering_actor != 'dependabot[bot]' permissions: contents: read security-events: read diff --git a/.github/workflows/__cpp-deptrace-enabled.yml b/.github/workflows/__cpp-deptrace-enabled.yml index 88a79b6a7..bf155a64d 100644 --- a/.github/workflows/__cpp-deptrace-enabled.yml +++ b/.github/workflows/__cpp-deptrace-enabled.yml @@ -43,6 +43,7 @@ jobs: - os: ubuntu-latest version: nightly-latest name: 'C/C++: autoinstalling dependencies (Linux)' + if: github.triggering_actor != 'dependabot[bot]' permissions: contents: read security-events: read diff --git a/.github/workflows/__diagnostics-export.yml b/.github/workflows/__diagnostics-export.yml index 16a31e350..f9f29ff4f 100644 --- a/.github/workflows/__diagnostics-export.yml +++ b/.github/workflows/__diagnostics-export.yml @@ -49,6 +49,7 @@ jobs: - os: windows-latest version: nightly-latest name: Diagnostic export + if: github.triggering_actor != 'dependabot[bot]' permissions: contents: read security-events: read diff --git a/.github/workflows/__export-file-baseline-information.yml b/.github/workflows/__export-file-baseline-information.yml index cc1565b2c..b2d9b72c7 100644 --- a/.github/workflows/__export-file-baseline-information.yml +++ b/.github/workflows/__export-file-baseline-information.yml @@ -53,6 +53,7 @@ jobs: - os: windows-latest version: nightly-latest name: Export file baseline information + if: github.triggering_actor != 'dependabot[bot]' permissions: contents: read security-events: read diff --git a/.github/workflows/__extractor-ram-threads.yml b/.github/workflows/__extractor-ram-threads.yml index df05dff46..2d8316f52 100644 --- a/.github/workflows/__extractor-ram-threads.yml +++ b/.github/workflows/__extractor-ram-threads.yml @@ -39,6 +39,7 @@ jobs: - os: ubuntu-latest version: linked name: Extractor ram and threads options test + if: github.triggering_actor != 'dependabot[bot]' permissions: contents: read security-events: read diff --git a/.github/workflows/__go-custom-queries.yml b/.github/workflows/__go-custom-queries.yml index c124889aa..1b5b7b915 100644 --- a/.github/workflows/__go-custom-queries.yml +++ b/.github/workflows/__go-custom-queries.yml @@ -51,6 +51,7 @@ jobs: - os: ubuntu-latest version: nightly-latest name: 'Go: Custom queries' + if: github.triggering_actor != 'dependabot[bot]' permissions: contents: read security-events: read diff --git a/.github/workflows/__go-indirect-tracing-workaround-diagnostic.yml b/.github/workflows/__go-indirect-tracing-workaround-diagnostic.yml index f7efcc894..061ad4254 100644 --- a/.github/workflows/__go-indirect-tracing-workaround-diagnostic.yml +++ b/.github/workflows/__go-indirect-tracing-workaround-diagnostic.yml @@ -49,6 +49,7 @@ jobs: - os: ubuntu-latest version: default name: 'Go: diagnostic when Go is changed after init step' + if: github.triggering_actor != 'dependabot[bot]' permissions: contents: read security-events: read diff --git a/.github/workflows/__go-indirect-tracing-workaround-no-file-program.yml b/.github/workflows/__go-indirect-tracing-workaround-no-file-program.yml index 978456d8e..0a347c65c 100644 --- a/.github/workflows/__go-indirect-tracing-workaround-no-file-program.yml +++ b/.github/workflows/__go-indirect-tracing-workaround-no-file-program.yml @@ -49,6 +49,7 @@ jobs: - os: ubuntu-latest version: default name: 'Go: diagnostic when `file` is not installed' + if: github.triggering_actor != 'dependabot[bot]' permissions: contents: read security-events: read diff --git a/.github/workflows/__go-indirect-tracing-workaround.yml b/.github/workflows/__go-indirect-tracing-workaround.yml index d43198153..bb811d4d5 100644 --- a/.github/workflows/__go-indirect-tracing-workaround.yml +++ b/.github/workflows/__go-indirect-tracing-workaround.yml @@ -49,6 +49,7 @@ jobs: - os: ubuntu-latest version: default name: 'Go: workaround for indirect tracing' + if: github.triggering_actor != 'dependabot[bot]' permissions: contents: read security-events: read diff --git a/.github/workflows/__go-tracing-autobuilder.yml b/.github/workflows/__go-tracing-autobuilder.yml index 582d6e8b5..6d4cc91cc 100644 --- a/.github/workflows/__go-tracing-autobuilder.yml +++ b/.github/workflows/__go-tracing-autobuilder.yml @@ -83,6 +83,7 @@ jobs: - os: macos-latest version: nightly-latest name: 'Go: tracing with autobuilder step' + if: github.triggering_actor != 'dependabot[bot]' permissions: contents: read security-events: read diff --git a/.github/workflows/__go-tracing-custom-build-steps.yml b/.github/workflows/__go-tracing-custom-build-steps.yml index a0ecd76a3..634b074c0 100644 --- a/.github/workflows/__go-tracing-custom-build-steps.yml +++ b/.github/workflows/__go-tracing-custom-build-steps.yml @@ -83,6 +83,7 @@ jobs: - os: macos-latest version: nightly-latest name: 'Go: tracing with custom build steps' + if: github.triggering_actor != 'dependabot[bot]' permissions: contents: read security-events: read diff --git a/.github/workflows/__go-tracing-legacy-workflow.yml b/.github/workflows/__go-tracing-legacy-workflow.yml index 5deabbd06..8168e3b10 100644 --- a/.github/workflows/__go-tracing-legacy-workflow.yml +++ b/.github/workflows/__go-tracing-legacy-workflow.yml @@ -83,6 +83,7 @@ jobs: - os: macos-latest version: nightly-latest name: 'Go: tracing with legacy workflow' + if: github.triggering_actor != 'dependabot[bot]' permissions: contents: read security-events: read diff --git a/.github/workflows/__init-with-registries.yml b/.github/workflows/__init-with-registries.yml index f570a05e0..5d98643b0 100644 --- a/.github/workflows/__init-with-registries.yml +++ b/.github/workflows/__init-with-registries.yml @@ -55,6 +55,7 @@ jobs: - os: windows-latest version: nightly-latest name: 'Packaging: Download using registries' + if: github.triggering_actor != 'dependabot[bot]' permissions: contents: read packages: read diff --git a/.github/workflows/__javascript-source-root.yml b/.github/workflows/__javascript-source-root.yml index f0e66bf32..e6c883966 100644 --- a/.github/workflows/__javascript-source-root.yml +++ b/.github/workflows/__javascript-source-root.yml @@ -43,6 +43,7 @@ jobs: - os: ubuntu-latest version: nightly-latest name: Custom source root + if: github.triggering_actor != 'dependabot[bot]' permissions: contents: read security-events: read diff --git a/.github/workflows/__job-run-uuid-sarif.yml b/.github/workflows/__job-run-uuid-sarif.yml index 50539d5e9..4df3b0d1c 100644 --- a/.github/workflows/__job-run-uuid-sarif.yml +++ b/.github/workflows/__job-run-uuid-sarif.yml @@ -39,6 +39,7 @@ jobs: - os: ubuntu-latest version: nightly-latest name: Job run UUID added to SARIF + if: github.triggering_actor != 'dependabot[bot]' permissions: contents: read security-events: read diff --git a/.github/workflows/__language-aliases.yml b/.github/workflows/__language-aliases.yml index 99db1af54..5f95caa13 100644 --- a/.github/workflows/__language-aliases.yml +++ b/.github/workflows/__language-aliases.yml @@ -39,6 +39,7 @@ jobs: - os: ubuntu-latest version: linked name: Language aliases + if: github.triggering_actor != 'dependabot[bot]' permissions: contents: read security-events: read diff --git a/.github/workflows/__multi-language-autodetect.yml b/.github/workflows/__multi-language-autodetect.yml index b0f41fcee..ee5d10c81 100644 --- a/.github/workflows/__multi-language-autodetect.yml +++ b/.github/workflows/__multi-language-autodetect.yml @@ -83,6 +83,7 @@ jobs: - os: ubuntu-latest version: nightly-latest name: Multi-language repository + if: github.triggering_actor != 'dependabot[bot]' permissions: contents: read security-events: read diff --git a/.github/workflows/__overlay-init-fallback.yml b/.github/workflows/__overlay-init-fallback.yml index c1fdaaf0a..d85e58aa1 100644 --- a/.github/workflows/__overlay-init-fallback.yml +++ b/.github/workflows/__overlay-init-fallback.yml @@ -41,6 +41,7 @@ jobs: - os: ubuntu-latest version: nightly-latest name: Overlay database init fallback + if: github.triggering_actor != 'dependabot[bot]' permissions: contents: read security-events: read diff --git a/.github/workflows/__packaging-codescanning-config-inputs-js.yml b/.github/workflows/__packaging-codescanning-config-inputs-js.yml index 530a5f2c8..8917e4a0e 100644 --- a/.github/workflows/__packaging-codescanning-config-inputs-js.yml +++ b/.github/workflows/__packaging-codescanning-config-inputs-js.yml @@ -65,6 +65,7 @@ jobs: - os: windows-latest version: nightly-latest name: 'Packaging: Config and input passed to the CLI' + if: github.triggering_actor != 'dependabot[bot]' permissions: contents: read security-events: read diff --git a/.github/workflows/__packaging-config-inputs-js.yml b/.github/workflows/__packaging-config-inputs-js.yml index aa3587022..777683b0f 100644 --- a/.github/workflows/__packaging-config-inputs-js.yml +++ b/.github/workflows/__packaging-config-inputs-js.yml @@ -65,6 +65,7 @@ jobs: - os: windows-latest version: nightly-latest name: 'Packaging: Config and input' + if: github.triggering_actor != 'dependabot[bot]' permissions: contents: read security-events: read diff --git a/.github/workflows/__packaging-config-js.yml b/.github/workflows/__packaging-config-js.yml index 84b731638..d1abda7e3 100644 --- a/.github/workflows/__packaging-config-js.yml +++ b/.github/workflows/__packaging-config-js.yml @@ -65,6 +65,7 @@ jobs: - os: windows-latest version: nightly-latest name: 'Packaging: Config file' + if: github.triggering_actor != 'dependabot[bot]' permissions: contents: read security-events: read diff --git a/.github/workflows/__packaging-inputs-js.yml b/.github/workflows/__packaging-inputs-js.yml index c5017c9b4..711a600bc 100644 --- a/.github/workflows/__packaging-inputs-js.yml +++ b/.github/workflows/__packaging-inputs-js.yml @@ -65,6 +65,7 @@ jobs: - os: windows-latest version: nightly-latest name: 'Packaging: Action input' + if: github.triggering_actor != 'dependabot[bot]' permissions: contents: read security-events: read diff --git a/.github/workflows/__quality-queries.yml b/.github/workflows/__quality-queries.yml index 229bc3387..1b5cd0c39 100644 --- a/.github/workflows/__quality-queries.yml +++ b/.github/workflows/__quality-queries.yml @@ -91,6 +91,7 @@ jobs: version: nightly-latest analysis-kinds: code-scanning,code-quality name: Quality queries input + if: github.triggering_actor != 'dependabot[bot]' permissions: contents: read security-events: read diff --git a/.github/workflows/__remote-config.yml b/.github/workflows/__remote-config.yml index 04c103845..fb76dbc67 100644 --- a/.github/workflows/__remote-config.yml +++ b/.github/workflows/__remote-config.yml @@ -51,6 +51,7 @@ jobs: - os: ubuntu-latest version: nightly-latest name: Remote config file + if: github.triggering_actor != 'dependabot[bot]' permissions: contents: read security-events: read diff --git a/.github/workflows/__resolve-environment-action.yml b/.github/workflows/__resolve-environment-action.yml index f7ca25276..7ddd6e663 100644 --- a/.github/workflows/__resolve-environment-action.yml +++ b/.github/workflows/__resolve-environment-action.yml @@ -55,6 +55,7 @@ jobs: - os: windows-latest version: nightly-latest name: Resolve environment + if: github.triggering_actor != 'dependabot[bot]' permissions: contents: read security-events: read diff --git a/.github/workflows/__rubocop-multi-language.yml b/.github/workflows/__rubocop-multi-language.yml index 200a06b32..48694e902 100644 --- a/.github/workflows/__rubocop-multi-language.yml +++ b/.github/workflows/__rubocop-multi-language.yml @@ -39,6 +39,7 @@ jobs: - os: ubuntu-latest version: default name: RuboCop multi-language + if: github.triggering_actor != 'dependabot[bot]' permissions: contents: read security-events: read diff --git a/.github/workflows/__ruby.yml b/.github/workflows/__ruby.yml index be9fac76e..769a11925 100644 --- a/.github/workflows/__ruby.yml +++ b/.github/workflows/__ruby.yml @@ -49,6 +49,7 @@ jobs: - os: macos-latest version: nightly-latest name: Ruby analysis + if: github.triggering_actor != 'dependabot[bot]' permissions: contents: read security-events: read diff --git a/.github/workflows/__rust.yml b/.github/workflows/__rust.yml index c1254ba2c..d788e5226 100644 --- a/.github/workflows/__rust.yml +++ b/.github/workflows/__rust.yml @@ -47,6 +47,7 @@ jobs: - os: ubuntu-latest version: nightly-latest name: Rust analysis + if: github.triggering_actor != 'dependabot[bot]' permissions: contents: read security-events: read diff --git a/.github/workflows/__split-workflow.yml b/.github/workflows/__split-workflow.yml index 430217853..e916b36cc 100644 --- a/.github/workflows/__split-workflow.yml +++ b/.github/workflows/__split-workflow.yml @@ -59,6 +59,7 @@ jobs: - os: macos-latest version: nightly-latest name: Split workflow + if: github.triggering_actor != 'dependabot[bot]' permissions: contents: read security-events: read diff --git a/.github/workflows/__start-proxy.yml b/.github/workflows/__start-proxy.yml index b42dd061a..26f118460 100644 --- a/.github/workflows/__start-proxy.yml +++ b/.github/workflows/__start-proxy.yml @@ -43,6 +43,7 @@ jobs: - os: windows-latest version: linked name: Start proxy + if: github.triggering_actor != 'dependabot[bot]' permissions: contents: read security-events: read diff --git a/.github/workflows/__submit-sarif-failure.yml b/.github/workflows/__submit-sarif-failure.yml index 3bd3e71cf..7383b52a8 100644 --- a/.github/workflows/__submit-sarif-failure.yml +++ b/.github/workflows/__submit-sarif-failure.yml @@ -43,6 +43,7 @@ jobs: - os: ubuntu-latest version: nightly-latest name: Submit SARIF after failure + if: github.triggering_actor != 'dependabot[bot]' permissions: contents: read security-events: write # needed to upload the SARIF file diff --git a/.github/workflows/__swift-autobuild.yml b/.github/workflows/__swift-autobuild.yml index 00a47fb54..9d18d0c97 100644 --- a/.github/workflows/__swift-autobuild.yml +++ b/.github/workflows/__swift-autobuild.yml @@ -39,6 +39,7 @@ jobs: - os: macos-latest version: nightly-latest name: Swift analysis using autobuild + if: github.triggering_actor != 'dependabot[bot]' permissions: contents: read security-events: read diff --git a/.github/workflows/__swift-custom-build.yml b/.github/workflows/__swift-custom-build.yml index 3384eb863..32ce33a7f 100644 --- a/.github/workflows/__swift-custom-build.yml +++ b/.github/workflows/__swift-custom-build.yml @@ -53,6 +53,7 @@ jobs: - os: macos-latest version: nightly-latest name: Swift analysis using a custom build command + if: github.triggering_actor != 'dependabot[bot]' permissions: contents: read security-events: read diff --git a/.github/workflows/__test-autobuild-working-dir.yml b/.github/workflows/__test-autobuild-working-dir.yml index 853836cbe..b55018c73 100644 --- a/.github/workflows/__test-autobuild-working-dir.yml +++ b/.github/workflows/__test-autobuild-working-dir.yml @@ -39,6 +39,7 @@ jobs: - os: ubuntu-latest version: linked name: Autobuild working directory + if: github.triggering_actor != 'dependabot[bot]' permissions: contents: read security-events: read diff --git a/.github/workflows/__test-local-codeql.yml b/.github/workflows/__test-local-codeql.yml index 43b3e1127..eee756a2a 100644 --- a/.github/workflows/__test-local-codeql.yml +++ b/.github/workflows/__test-local-codeql.yml @@ -49,6 +49,7 @@ jobs: - os: ubuntu-latest version: linked name: Local CodeQL bundle + if: github.triggering_actor != 'dependabot[bot]' permissions: contents: read security-events: read diff --git a/.github/workflows/__test-proxy.yml b/.github/workflows/__test-proxy.yml index 92f333059..8504a4401 100644 --- a/.github/workflows/__test-proxy.yml +++ b/.github/workflows/__test-proxy.yml @@ -41,6 +41,7 @@ jobs: - os: ubuntu-latest version: nightly-latest name: Proxy test + if: github.triggering_actor != 'dependabot[bot]' permissions: contents: read security-events: read diff --git a/.github/workflows/__unset-environment.yml b/.github/workflows/__unset-environment.yml index f47b76242..8b8d15654 100644 --- a/.github/workflows/__unset-environment.yml +++ b/.github/workflows/__unset-environment.yml @@ -51,6 +51,7 @@ jobs: - os: ubuntu-latest version: nightly-latest name: Test unsetting environment variables + if: github.triggering_actor != 'dependabot[bot]' permissions: contents: read security-events: read diff --git a/.github/workflows/__upload-quality-sarif.yml b/.github/workflows/__upload-quality-sarif.yml index 2d88468cc..15bc871d9 100644 --- a/.github/workflows/__upload-quality-sarif.yml +++ b/.github/workflows/__upload-quality-sarif.yml @@ -53,6 +53,7 @@ jobs: - os: windows-latest version: default name: 'Upload-sarif: code quality endpoint' + if: github.triggering_actor != 'dependabot[bot]' permissions: contents: read security-events: read diff --git a/.github/workflows/__upload-ref-sha-input.yml b/.github/workflows/__upload-ref-sha-input.yml index 11f49b4c8..d6970ea18 100644 --- a/.github/workflows/__upload-ref-sha-input.yml +++ b/.github/workflows/__upload-ref-sha-input.yml @@ -53,6 +53,7 @@ jobs: - os: windows-latest version: default name: "Upload-sarif: 'ref' and 'sha' from inputs" + if: github.triggering_actor != 'dependabot[bot]' permissions: contents: read security-events: read diff --git a/.github/workflows/__with-checkout-path.yml b/.github/workflows/__with-checkout-path.yml index 3a7f1c974..aa6c9651d 100644 --- a/.github/workflows/__with-checkout-path.yml +++ b/.github/workflows/__with-checkout-path.yml @@ -53,6 +53,7 @@ jobs: - os: windows-latest version: linked name: Use a custom `checkout_path` + if: github.triggering_actor != 'dependabot[bot]' permissions: contents: read security-events: read diff --git a/pr-checks/sync.py b/pr-checks/sync.py index 565c1ce6f..550953980 100755 --- a/pr-checks/sync.py +++ b/pr-checks/sync.py @@ -211,6 +211,7 @@ for file in sorted((this_dir / 'checks').glob('*.yml')): } }, 'name': checkSpecification['name'], + 'if': 'github.triggering_actor != \'dependabot[bot]\'', 'permissions': { 'contents': 'read', 'security-events': 'read' From 4082f8c39f733490d46a4f6effa3e7caa9d565c2 Mon Sep 17 00:00:00 2001 From: Henry Mercer Date: Wed, 24 Sep 2025 13:24:00 +0200 Subject: [PATCH 41/53] Install yq --- .github/workflows/__build-mode-autobuild.yml | 5 +++++ pr-checks/checks/build-mode-autobuild.yml | 5 +++++ 2 files changed, 10 insertions(+) diff --git a/.github/workflows/__build-mode-autobuild.yml b/.github/workflows/__build-mode-autobuild.yml index 07e73d1b6..9f0997106 100644 --- a/.github/workflows/__build-mode-autobuild.yml +++ b/.github/workflows/__build-mode-autobuild.yml @@ -89,6 +89,11 @@ jobs: languages: java tools: ${{ steps.prepare-test.outputs.tools-url }} + - name: Install yq + if: runner.os == 'Windows' + run: | + choco install yq -y + - name: Validate database build mode run: | metadata_path="$RUNNER_TEMP/customDbLocation/java/codeql-database.yml" diff --git a/pr-checks/checks/build-mode-autobuild.yml b/pr-checks/checks/build-mode-autobuild.yml index 668621490..26b8626f2 100644 --- a/pr-checks/checks/build-mode-autobuild.yml +++ b/pr-checks/checks/build-mode-autobuild.yml @@ -18,6 +18,11 @@ steps: languages: java tools: ${{ steps.prepare-test.outputs.tools-url }} + - name: Install yq + if: runner.os == 'Windows' + run: | + choco install yq -y + - name: Validate database build mode run: | metadata_path="$RUNNER_TEMP/customDbLocation/java/codeql-database.yml" From efcf614b5d8a11ca5489349120abc6d31c9e16a4 Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Wed, 24 Sep 2025 12:40:15 +0100 Subject: [PATCH 42/53] Refactor assembling `Authorization` header value into its own function --- lib/analyze-action.js | 17 +++++++++++++---- lib/init-action-post.js | 17 +++++++++++++---- lib/init-action.js | 17 +++++++++++++---- lib/upload-lib.js | 17 +++++++++++++---- lib/upload-sarif-action.js | 17 +++++++++++++---- src/api-client.ts | 31 ++++++++++++++++++++++++++++++- src/setup-codeql.ts | 12 +++++------- 7 files changed, 100 insertions(+), 28 deletions(-) diff --git a/lib/analyze-action.js b/lib/analyze-action.js index 164ad518f..49f3b4539 100644 --- a/lib/analyze-action.js +++ b/lib/analyze-action.js @@ -90198,6 +90198,14 @@ function getApiDetails() { function getApiClient() { return createApiClientWithDetails(getApiDetails()); } +function getAuthorizationHeaderFor(logger, apiDetails, url2, purpose = "CodeQL tools") { + if (url2.startsWith(`${apiDetails.url}/`) || apiDetails.apiURL && url2.startsWith(`${apiDetails.apiURL}/`)) { + logger.debug(`Providing an authorization token to download ${purpose}.`); + return `token ${apiDetails.auth}`; + } + logger.debug(`Downloading ${purpose} without an authorization token.`); + return void 0; +} var cachedGitHubVersion = void 0; async function getGitHubVersionFromApi(apiClient, apiDetails) { if (parseGitHubUrl(apiDetails.url) === GITHUB_DOTCOM_URL) { @@ -92391,11 +92399,12 @@ var downloadCodeQL = async function(codeqlURL, compressionMethod, maybeBundleVer let authorization = void 0; if (searchParams.has("token")) { logger.debug("CodeQL tools URL contains an authorization token."); - } else if (codeqlURL.startsWith(`${apiDetails.url}/`) || apiDetails.apiURL && codeqlURL.startsWith(`${apiDetails.apiURL}/`)) { - logger.debug("Providing an authorization token to download CodeQL tools."); - authorization = `token ${apiDetails.auth}`; } else { - logger.debug("Downloading CodeQL tools without an authorization token."); + authorization = getAuthorizationHeaderFor( + logger, + apiDetails, + codeqlURL + ); } const toolcacheInfo = getToolcacheDestinationInfo( maybeBundleVersion, diff --git a/lib/init-action-post.js b/lib/init-action-post.js index 7b156fce4..3fb9af143 100644 --- a/lib/init-action-post.js +++ b/lib/init-action-post.js @@ -128417,6 +128417,14 @@ function getApiDetails() { function getApiClient() { return createApiClientWithDetails(getApiDetails()); } +function getAuthorizationHeaderFor(logger, apiDetails, url2, purpose = "CodeQL tools") { + if (url2.startsWith(`${apiDetails.url}/`) || apiDetails.apiURL && url2.startsWith(`${apiDetails.apiURL}/`)) { + logger.debug(`Providing an authorization token to download ${purpose}.`); + return `token ${apiDetails.auth}`; + } + logger.debug(`Downloading ${purpose} without an authorization token.`); + return void 0; +} var cachedGitHubVersion = void 0; async function getGitHubVersionFromApi(apiClient, apiDetails) { if (parseGitHubUrl(apiDetails.url) === GITHUB_DOTCOM_URL) { @@ -130334,11 +130342,12 @@ var downloadCodeQL = async function(codeqlURL, compressionMethod, maybeBundleVer let authorization = void 0; if (searchParams.has("token")) { logger.debug("CodeQL tools URL contains an authorization token."); - } else if (codeqlURL.startsWith(`${apiDetails.url}/`) || apiDetails.apiURL && codeqlURL.startsWith(`${apiDetails.apiURL}/`)) { - logger.debug("Providing an authorization token to download CodeQL tools."); - authorization = `token ${apiDetails.auth}`; } else { - logger.debug("Downloading CodeQL tools without an authorization token."); + authorization = getAuthorizationHeaderFor( + logger, + apiDetails, + codeqlURL + ); } const toolcacheInfo = getToolcacheDestinationInfo( maybeBundleVersion, diff --git a/lib/init-action.js b/lib/init-action.js index 52b99d631..08a67d16e 100644 --- a/lib/init-action.js +++ b/lib/init-action.js @@ -86053,6 +86053,14 @@ function getApiClient() { function getApiClientWithExternalAuth(apiDetails) { return createApiClientWithDetails(apiDetails, { allowExternal: true }); } +function getAuthorizationHeaderFor(logger, apiDetails, url, purpose = "CodeQL tools") { + if (url.startsWith(`${apiDetails.url}/`) || apiDetails.apiURL && url.startsWith(`${apiDetails.apiURL}/`)) { + logger.debug(`Providing an authorization token to download ${purpose}.`); + return `token ${apiDetails.auth}`; + } + logger.debug(`Downloading ${purpose} without an authorization token.`); + return void 0; +} var cachedGitHubVersion = void 0; async function getGitHubVersionFromApi(apiClient, apiDetails) { if (parseGitHubUrl(apiDetails.url) === GITHUB_DOTCOM_URL) { @@ -89163,11 +89171,12 @@ var downloadCodeQL = async function(codeqlURL, compressionMethod, maybeBundleVer let authorization = void 0; if (searchParams.has("token")) { logger.debug("CodeQL tools URL contains an authorization token."); - } else if (codeqlURL.startsWith(`${apiDetails.url}/`) || apiDetails.apiURL && codeqlURL.startsWith(`${apiDetails.apiURL}/`)) { - logger.debug("Providing an authorization token to download CodeQL tools."); - authorization = `token ${apiDetails.auth}`; } else { - logger.debug("Downloading CodeQL tools without an authorization token."); + authorization = getAuthorizationHeaderFor( + logger, + apiDetails, + codeqlURL + ); } const toolcacheInfo = getToolcacheDestinationInfo( maybeBundleVersion, diff --git a/lib/upload-lib.js b/lib/upload-lib.js index d644a7ed4..aee61387c 100644 --- a/lib/upload-lib.js +++ b/lib/upload-lib.js @@ -88544,6 +88544,14 @@ function getApiDetails() { function getApiClient() { return createApiClientWithDetails(getApiDetails()); } +function getAuthorizationHeaderFor(logger, apiDetails, url2, purpose = "CodeQL tools") { + if (url2.startsWith(`${apiDetails.url}/`) || apiDetails.apiURL && url2.startsWith(`${apiDetails.apiURL}/`)) { + logger.debug(`Providing an authorization token to download ${purpose}.`); + return `token ${apiDetails.auth}`; + } + logger.debug(`Downloading ${purpose} without an authorization token.`); + return void 0; +} var cachedGitHubVersion = void 0; async function getGitHubVersionFromApi(apiClient, apiDetails) { if (parseGitHubUrl(apiDetails.url) === GITHUB_DOTCOM_URL) { @@ -90162,11 +90170,12 @@ var downloadCodeQL = async function(codeqlURL, compressionMethod, maybeBundleVer let authorization = void 0; if (searchParams.has("token")) { logger.debug("CodeQL tools URL contains an authorization token."); - } else if (codeqlURL.startsWith(`${apiDetails.url}/`) || apiDetails.apiURL && codeqlURL.startsWith(`${apiDetails.apiURL}/`)) { - logger.debug("Providing an authorization token to download CodeQL tools."); - authorization = `token ${apiDetails.auth}`; } else { - logger.debug("Downloading CodeQL tools without an authorization token."); + authorization = getAuthorizationHeaderFor( + logger, + apiDetails, + codeqlURL + ); } const toolcacheInfo = getToolcacheDestinationInfo( maybeBundleVersion, diff --git a/lib/upload-sarif-action.js b/lib/upload-sarif-action.js index c3ded2faa..f9de677a5 100644 --- a/lib/upload-sarif-action.js +++ b/lib/upload-sarif-action.js @@ -88796,6 +88796,14 @@ function getApiDetails() { function getApiClient() { return createApiClientWithDetails(getApiDetails()); } +function getAuthorizationHeaderFor(logger, apiDetails, url2, purpose = "CodeQL tools") { + if (url2.startsWith(`${apiDetails.url}/`) || apiDetails.apiURL && url2.startsWith(`${apiDetails.apiURL}/`)) { + logger.debug(`Providing an authorization token to download ${purpose}.`); + return `token ${apiDetails.auth}`; + } + logger.debug(`Downloading ${purpose} without an authorization token.`); + return void 0; +} var cachedGitHubVersion = void 0; async function getGitHubVersionFromApi(apiClient, apiDetails) { if (parseGitHubUrl(apiDetails.url) === GITHUB_DOTCOM_URL) { @@ -90863,11 +90871,12 @@ var downloadCodeQL = async function(codeqlURL, compressionMethod, maybeBundleVer let authorization = void 0; if (searchParams.has("token")) { logger.debug("CodeQL tools URL contains an authorization token."); - } else if (codeqlURL.startsWith(`${apiDetails.url}/`) || apiDetails.apiURL && codeqlURL.startsWith(`${apiDetails.apiURL}/`)) { - logger.debug("Providing an authorization token to download CodeQL tools."); - authorization = `token ${apiDetails.auth}`; } else { - logger.debug("Downloading CodeQL tools without an authorization token."); + authorization = getAuthorizationHeaderFor( + logger, + apiDetails, + codeqlURL + ); } const toolcacheInfo = getToolcacheDestinationInfo( maybeBundleVersion, diff --git a/src/api-client.ts b/src/api-client.ts index 8e4a30c57..baef744c9 100644 --- a/src/api-client.ts +++ b/src/api-client.ts @@ -4,6 +4,7 @@ import * as retry from "@octokit/plugin-retry"; import consoleLogLevel from "console-log-level"; import { getActionVersion, getRequiredInput } from "./actions-util"; +import { Logger } from "./logging"; import { getRepositoryNwo, RepositoryNwo } from "./repository"; import { ConfigurationError, @@ -54,7 +55,7 @@ function createApiClientWithDetails( ); } -export function getApiDetails() { +export function getApiDetails(): GitHubApiDetails { return { auth: getRequiredInput("token"), url: getRequiredEnvParam("GITHUB_SERVER_URL"), @@ -72,6 +73,34 @@ export function getApiClientWithExternalAuth( return createApiClientWithDetails(apiDetails, { allowExternal: true }); } +/** + * Gets a value for the `Authorization` header to download `url` or `undefined` if the + * `Authorization` header should not be set for `url`. + * + * @param logger The logger to use for debugging messages. + * @param apiDetails Details of the GitHub API we are using. + * @param url The URL for which we want to add an `Authorization` header. + * @param purpose A description of what we want to download, for debug messages. + * @returns The value for the `Authorization` header or `undefined` if it shouldn't be populated. + */ +export function getAuthorizationHeaderFor( + logger: Logger, + apiDetails: GitHubApiDetails, + url: string, + purpose: string = "CodeQL tools", +): string | undefined { + if ( + url.startsWith(`${apiDetails.url}/`) || + (apiDetails.apiURL && url.startsWith(`${apiDetails.apiURL}/`)) + ) { + logger.debug(`Providing an authorization token to download ${purpose}.`); + return `token ${apiDetails.auth}`; + } + + logger.debug(`Downloading ${purpose} without an authorization token.`); + return undefined; +} + let cachedGitHubVersion: GitHubVersion | undefined = undefined; export async function getGitHubVersionFromApi( diff --git a/src/setup-codeql.ts b/src/setup-codeql.ts index 5a0f671fa..1bdaf8685 100644 --- a/src/setup-codeql.ts +++ b/src/setup-codeql.ts @@ -574,14 +574,12 @@ export const downloadCodeQL = async function ( let authorization: string | undefined = undefined; if (searchParams.has("token")) { logger.debug("CodeQL tools URL contains an authorization token."); - } else if ( - codeqlURL.startsWith(`${apiDetails.url}/`) || - (apiDetails.apiURL && codeqlURL.startsWith(`${apiDetails.apiURL}/`)) - ) { - logger.debug("Providing an authorization token to download CodeQL tools."); - authorization = `token ${apiDetails.auth}`; } else { - logger.debug("Downloading CodeQL tools without an authorization token."); + authorization = api.getAuthorizationHeaderFor( + logger, + apiDetails, + codeqlURL, + ); } const toolcacheInfo = getToolcacheDestinationInfo( From d43f46c39ce20fce7bfa131dd6a604a1ca4009eb Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Wed, 24 Sep 2025 12:40:57 +0100 Subject: [PATCH 43/53] Set `Authorization` header for downloading `update-job-proxy` --- lib/start-proxy-action.js | 37 ++++++++++++++++++++++++++----------- src/start-proxy-action.ts | 13 ++++++++++++- 2 files changed, 38 insertions(+), 12 deletions(-) diff --git a/lib/start-proxy-action.js b/lib/start-proxy-action.js index 98ec2e533..e0568fa95 100644 --- a/lib/start-proxy-action.js +++ b/lib/start-proxy-action.js @@ -49356,17 +49356,8 @@ var persistInputs = function() { core4.saveState(persistedInputsKey, JSON.stringify(inputEnvironmentVariables)); }; -// src/logging.ts -var core5 = __toESM(require_core()); -function getActionsLogger() { - return core5; -} - -// src/start-proxy.ts -var core7 = __toESM(require_core()); - // src/api-client.ts -var core6 = __toESM(require_core()); +var core5 = __toESM(require_core()); var githubUtils = __toESM(require_utils4()); var retry = __toESM(require_dist_node15()); var import_console_log_level = __toESM(require_console_log_level()); @@ -49391,6 +49382,23 @@ function getApiDetails() { function getApiClient() { return createApiClientWithDetails(getApiDetails()); } +function getAuthorizationHeaderFor(logger, apiDetails, url, purpose = "CodeQL tools") { + if (url.startsWith(`${apiDetails.url}/`) || apiDetails.apiURL && url.startsWith(`${apiDetails.apiURL}/`)) { + logger.debug(`Providing an authorization token to download ${purpose}.`); + return `token ${apiDetails.auth}`; + } + logger.debug(`Downloading ${purpose} without an authorization token.`); + return void 0; +} + +// src/logging.ts +var core6 = __toESM(require_core()); +function getActionsLogger() { + return core6; +} + +// src/start-proxy.ts +var core7 = __toESM(require_core()); // src/defaults.json var bundleVersion = "codeql-bundle-v2.23.1"; @@ -49682,10 +49690,17 @@ async function getProxyBinaryPath(logger) { const proxyInfo = await getDownloadUrl(logger); let proxyBin = toolcache.find(proxyFileName, proxyInfo.version); if (!proxyBin) { + const apiDetails = getApiDetails(); + const authorization = getAuthorizationHeaderFor( + logger, + apiDetails, + proxyInfo.url, + "`update-job-proxy`" + ); const temp = await toolcache.downloadTool( proxyInfo.url, void 0, - void 0, + authorization, { accept: "application/octet-stream" } diff --git a/src/start-proxy-action.ts b/src/start-proxy-action.ts index c0a8d3c7f..6413b0b17 100644 --- a/src/start-proxy-action.ts +++ b/src/start-proxy-action.ts @@ -6,6 +6,7 @@ import * as toolcache from "@actions/tool-cache"; import { pki } from "node-forge"; import * as actionsUtil from "./actions-util"; +import { getApiDetails, getAuthorizationHeaderFor } from "./api-client"; import { getActionsLogger, Logger } from "./logging"; import { Credential, @@ -192,10 +193,20 @@ async function getProxyBinaryPath(logger: Logger): Promise { let proxyBin = toolcache.find(proxyFileName, proxyInfo.version); if (!proxyBin) { + // We only want to provide an authorization header if we are downloading + // from the same GitHub instance the Action is running on. + // This avoids leaking Enterprise tokens to dotcom. + const apiDetails = getApiDetails(); + const authorization = getAuthorizationHeaderFor( + logger, + apiDetails, + proxyInfo.url, + "`update-job-proxy`", + ); const temp = await toolcache.downloadTool( proxyInfo.url, undefined, - undefined, + authorization, { accept: "application/octet-stream", }, From 3183e6b8f9f9369721c45c67f1e70bce07e6b96c Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Wed, 24 Sep 2025 12:49:31 +0100 Subject: [PATCH 44/53] Skip non-generated workflows for Dependabot --- .github/workflows/codeql.yml | 3 +++ .github/workflows/codescanning-config-cli.yml | 1 + .github/workflows/debug-artifacts-failure-safe.yml | 2 ++ .github/workflows/debug-artifacts-safe.yml | 2 ++ .github/workflows/pr-checks.yml | 5 +++-- .github/workflows/python312-windows.yml | 1 + .github/workflows/query-filters.yml | 1 + .github/workflows/test-codeql-bundle-all.yml | 3 ++- 8 files changed, 15 insertions(+), 3 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index cc157b15f..1af109a76 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -23,6 +23,7 @@ env: jobs: # Identify the CodeQL tool versions to use in the analysis job. check-codeql-versions: + if: github.triggering_actor != 'dependabot[bot]' runs-on: ubuntu-latest outputs: versions: ${{ steps.compare.outputs.versions }} @@ -75,6 +76,7 @@ jobs: echo "versions=${VERSIONS_JSON}" >> $GITHUB_OUTPUT analyze-javascript: + if: github.triggering_actor != 'dependabot[bot]' needs: [check-codeql-versions] strategy: fail-fast: false @@ -110,6 +112,7 @@ jobs: upload: ${{ (matrix.os == 'ubuntu-24.04' && !matrix.tools && 'always') || 'never' }} analyze-other: + if: github.triggering_actor != 'dependabot[bot]' runs-on: ubuntu-latest strategy: diff --git a/.github/workflows/codescanning-config-cli.yml b/.github/workflows/codescanning-config-cli.yml index 36937b9fb..c11f47971 100644 --- a/.github/workflows/codescanning-config-cli.yml +++ b/.github/workflows/codescanning-config-cli.yml @@ -28,6 +28,7 @@ defaults: jobs: code-scanning-config-tests: + if: github.triggering_actor != 'dependabot[bot]' continue-on-error: true permissions: diff --git a/.github/workflows/debug-artifacts-failure-safe.yml b/.github/workflows/debug-artifacts-failure-safe.yml index 5a8878a23..c938c51e6 100644 --- a/.github/workflows/debug-artifacts-failure-safe.yml +++ b/.github/workflows/debug-artifacts-failure-safe.yml @@ -24,6 +24,7 @@ defaults: jobs: upload-artifacts: + if: github.triggering_actor != 'dependabot[bot]' strategy: fail-fast: false matrix: @@ -70,6 +71,7 @@ jobs: expect-error: true download-and-check-artifacts: name: Download and check debug artifacts after failure in analyze + if: github.triggering_actor != 'dependabot[bot]' needs: upload-artifacts timeout-minutes: 45 permissions: diff --git a/.github/workflows/debug-artifacts-safe.yml b/.github/workflows/debug-artifacts-safe.yml index 22d32dd4f..3e7282f82 100644 --- a/.github/workflows/debug-artifacts-safe.yml +++ b/.github/workflows/debug-artifacts-safe.yml @@ -23,6 +23,7 @@ defaults: jobs: upload-artifacts: + if: github.triggering_actor != 'dependabot[bot]' strategy: fail-fast: false matrix: @@ -64,6 +65,7 @@ jobs: id: analysis download-and-check-artifacts: name: Download and check debug artifacts + if: github.triggering_actor != 'dependabot[bot]' needs: upload-artifacts timeout-minutes: 45 permissions: diff --git a/.github/workflows/pr-checks.yml b/.github/workflows/pr-checks.yml index 6c5e639b2..fa80525f9 100644 --- a/.github/workflows/pr-checks.yml +++ b/.github/workflows/pr-checks.yml @@ -15,6 +15,7 @@ defaults: jobs: unit-tests: name: Unit Tests + if: github.triggering_actor != 'dependabot[bot]' strategy: fail-fast: false matrix: @@ -31,7 +32,7 @@ jobs: run: git config --global core.autocrlf false - uses: actions/checkout@v5 - + - name: Set up Node.js uses: actions/setup-node@v5 with: @@ -75,7 +76,7 @@ jobs: category: eslint check-node-version: - if: github.event.pull_request + if: github.event.pull_request && github.triggering_actor != 'dependabot[bot]' name: Check Action Node versions runs-on: ubuntu-latest timeout-minutes: 45 diff --git a/.github/workflows/python312-windows.yml b/.github/workflows/python312-windows.yml index e8b375d9c..aa2a03420 100644 --- a/.github/workflows/python312-windows.yml +++ b/.github/workflows/python312-windows.yml @@ -18,6 +18,7 @@ defaults: jobs: test-setup-python-scripts: + if: github.triggering_actor != 'dependabot[bot]' env: CODEQL_ACTION_TEST_MODE: true timeout-minutes: 45 diff --git a/.github/workflows/query-filters.yml b/.github/workflows/query-filters.yml index c2182be85..aabcc144b 100644 --- a/.github/workflows/query-filters.yml +++ b/.github/workflows/query-filters.yml @@ -22,6 +22,7 @@ defaults: jobs: query-filters: name: Query Filters Tests + if: github.triggering_actor != 'dependabot[bot]' timeout-minutes: 45 runs-on: ubuntu-latest permissions: diff --git a/.github/workflows/test-codeql-bundle-all.yml b/.github/workflows/test-codeql-bundle-all.yml index 3ccfb4e63..4b7fdca81 100644 --- a/.github/workflows/test-codeql-bundle-all.yml +++ b/.github/workflows/test-codeql-bundle-all.yml @@ -28,6 +28,7 @@ jobs: - os: ubuntu-latest version: nightly-latest name: 'CodeQL Bundle All' + if: github.triggering_actor != 'dependabot[bot]' permissions: contents: read security-events: read @@ -46,7 +47,7 @@ jobs: uses: ./../action/init with: # We manually exclude Swift from the languages list here, as it is not supported on Ubuntu - languages: cpp,csharp,go,java,javascript,python,ruby + languages: cpp,csharp,go,java,javascript,python,ruby tools: ${{ steps.prepare-test.outputs.tools-url }} - name: Build code run: ./build.sh From 4e820a4ca43a039f7a611deeaee1e484f9abd9f2 Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Wed, 24 Sep 2025 15:50:19 +0100 Subject: [PATCH 45/53] Apply review feedback --- lib/analyze-action.js | 6 +++--- lib/init-action-post.js | 6 +++--- lib/init-action.js | 6 +++--- lib/start-proxy-action.js | 9 ++++----- lib/upload-lib.js | 6 +++--- lib/upload-sarif-action.js | 6 +++--- src/api-client.ts | 12 +++++++----- src/setup-codeql.ts | 6 ++---- src/start-proxy-action.ts | 4 ---- 9 files changed, 28 insertions(+), 33 deletions(-) diff --git a/lib/analyze-action.js b/lib/analyze-action.js index 49f3b4539..cb366248c 100644 --- a/lib/analyze-action.js +++ b/lib/analyze-action.js @@ -90198,12 +90198,12 @@ function getApiDetails() { function getApiClient() { return createApiClientWithDetails(getApiDetails()); } -function getAuthorizationHeaderFor(logger, apiDetails, url2, purpose = "CodeQL tools") { +function getAuthorizationHeaderFor(logger, apiDetails, url2) { if (url2.startsWith(`${apiDetails.url}/`) || apiDetails.apiURL && url2.startsWith(`${apiDetails.apiURL}/`)) { - logger.debug(`Providing an authorization token to download ${purpose}.`); + logger.debug(`Providing an authorization token for '${url2}'.`); return `token ${apiDetails.auth}`; } - logger.debug(`Downloading ${purpose} without an authorization token.`); + logger.debug(`Requesting '${url2}' without an authorization token.`); return void 0; } var cachedGitHubVersion = void 0; diff --git a/lib/init-action-post.js b/lib/init-action-post.js index 3fb9af143..6bd6b0666 100644 --- a/lib/init-action-post.js +++ b/lib/init-action-post.js @@ -128417,12 +128417,12 @@ function getApiDetails() { function getApiClient() { return createApiClientWithDetails(getApiDetails()); } -function getAuthorizationHeaderFor(logger, apiDetails, url2, purpose = "CodeQL tools") { +function getAuthorizationHeaderFor(logger, apiDetails, url2) { if (url2.startsWith(`${apiDetails.url}/`) || apiDetails.apiURL && url2.startsWith(`${apiDetails.apiURL}/`)) { - logger.debug(`Providing an authorization token to download ${purpose}.`); + logger.debug(`Providing an authorization token for '${url2}'.`); return `token ${apiDetails.auth}`; } - logger.debug(`Downloading ${purpose} without an authorization token.`); + logger.debug(`Requesting '${url2}' without an authorization token.`); return void 0; } var cachedGitHubVersion = void 0; diff --git a/lib/init-action.js b/lib/init-action.js index 08a67d16e..275814297 100644 --- a/lib/init-action.js +++ b/lib/init-action.js @@ -86053,12 +86053,12 @@ function getApiClient() { function getApiClientWithExternalAuth(apiDetails) { return createApiClientWithDetails(apiDetails, { allowExternal: true }); } -function getAuthorizationHeaderFor(logger, apiDetails, url, purpose = "CodeQL tools") { +function getAuthorizationHeaderFor(logger, apiDetails, url) { if (url.startsWith(`${apiDetails.url}/`) || apiDetails.apiURL && url.startsWith(`${apiDetails.apiURL}/`)) { - logger.debug(`Providing an authorization token to download ${purpose}.`); + logger.debug(`Providing an authorization token for '${url}'.`); return `token ${apiDetails.auth}`; } - logger.debug(`Downloading ${purpose} without an authorization token.`); + logger.debug(`Requesting '${url}' without an authorization token.`); return void 0; } var cachedGitHubVersion = void 0; diff --git a/lib/start-proxy-action.js b/lib/start-proxy-action.js index e0568fa95..cdd24f132 100644 --- a/lib/start-proxy-action.js +++ b/lib/start-proxy-action.js @@ -49382,12 +49382,12 @@ function getApiDetails() { function getApiClient() { return createApiClientWithDetails(getApiDetails()); } -function getAuthorizationHeaderFor(logger, apiDetails, url, purpose = "CodeQL tools") { +function getAuthorizationHeaderFor(logger, apiDetails, url) { if (url.startsWith(`${apiDetails.url}/`) || apiDetails.apiURL && url.startsWith(`${apiDetails.apiURL}/`)) { - logger.debug(`Providing an authorization token to download ${purpose}.`); + logger.debug(`Providing an authorization token for '${url}'.`); return `token ${apiDetails.auth}`; } - logger.debug(`Downloading ${purpose} without an authorization token.`); + logger.debug(`Requesting '${url}' without an authorization token.`); return void 0; } @@ -49694,8 +49694,7 @@ async function getProxyBinaryPath(logger) { const authorization = getAuthorizationHeaderFor( logger, apiDetails, - proxyInfo.url, - "`update-job-proxy`" + proxyInfo.url ); const temp = await toolcache.downloadTool( proxyInfo.url, diff --git a/lib/upload-lib.js b/lib/upload-lib.js index aee61387c..098e658da 100644 --- a/lib/upload-lib.js +++ b/lib/upload-lib.js @@ -88544,12 +88544,12 @@ function getApiDetails() { function getApiClient() { return createApiClientWithDetails(getApiDetails()); } -function getAuthorizationHeaderFor(logger, apiDetails, url2, purpose = "CodeQL tools") { +function getAuthorizationHeaderFor(logger, apiDetails, url2) { if (url2.startsWith(`${apiDetails.url}/`) || apiDetails.apiURL && url2.startsWith(`${apiDetails.apiURL}/`)) { - logger.debug(`Providing an authorization token to download ${purpose}.`); + logger.debug(`Providing an authorization token for '${url2}'.`); return `token ${apiDetails.auth}`; } - logger.debug(`Downloading ${purpose} without an authorization token.`); + logger.debug(`Requesting '${url2}' without an authorization token.`); return void 0; } var cachedGitHubVersion = void 0; diff --git a/lib/upload-sarif-action.js b/lib/upload-sarif-action.js index f9de677a5..fe51a2785 100644 --- a/lib/upload-sarif-action.js +++ b/lib/upload-sarif-action.js @@ -88796,12 +88796,12 @@ function getApiDetails() { function getApiClient() { return createApiClientWithDetails(getApiDetails()); } -function getAuthorizationHeaderFor(logger, apiDetails, url2, purpose = "CodeQL tools") { +function getAuthorizationHeaderFor(logger, apiDetails, url2) { if (url2.startsWith(`${apiDetails.url}/`) || apiDetails.apiURL && url2.startsWith(`${apiDetails.apiURL}/`)) { - logger.debug(`Providing an authorization token to download ${purpose}.`); + logger.debug(`Providing an authorization token for '${url2}'.`); return `token ${apiDetails.auth}`; } - logger.debug(`Downloading ${purpose} without an authorization token.`); + logger.debug(`Requesting '${url2}' without an authorization token.`); return void 0; } var cachedGitHubVersion = void 0; diff --git a/src/api-client.ts b/src/api-client.ts index baef744c9..3ab3db47f 100644 --- a/src/api-client.ts +++ b/src/api-client.ts @@ -74,30 +74,32 @@ export function getApiClientWithExternalAuth( } /** - * Gets a value for the `Authorization` header to download `url` or `undefined` if the + * Gets a value for the `Authorization` header for a request to `url`; or `undefined` if the * `Authorization` header should not be set for `url`. * * @param logger The logger to use for debugging messages. * @param apiDetails Details of the GitHub API we are using. * @param url The URL for which we want to add an `Authorization` header. - * @param purpose A description of what we want to download, for debug messages. + * * @returns The value for the `Authorization` header or `undefined` if it shouldn't be populated. */ export function getAuthorizationHeaderFor( logger: Logger, apiDetails: GitHubApiDetails, url: string, - purpose: string = "CodeQL tools", ): string | undefined { + // We only want to provide an authorization header if we are downloading + // from the same GitHub instance the Action is running on. + // This avoids leaking Enterprise tokens to dotcom. if ( url.startsWith(`${apiDetails.url}/`) || (apiDetails.apiURL && url.startsWith(`${apiDetails.apiURL}/`)) ) { - logger.debug(`Providing an authorization token to download ${purpose}.`); + logger.debug(`Providing an authorization token for '${url}'.`); return `token ${apiDetails.auth}`; } - logger.debug(`Downloading ${purpose} without an authorization token.`); + logger.debug(`Requesting '${url}' without an authorization token.`); return undefined; } diff --git a/src/setup-codeql.ts b/src/setup-codeql.ts index 1bdaf8685..e147a3112 100644 --- a/src/setup-codeql.ts +++ b/src/setup-codeql.ts @@ -567,11 +567,9 @@ export const downloadCodeQL = async function ( const headers: OutgoingHttpHeaders = { accept: "application/octet-stream", }; - // We only want to provide an authorization header if we are downloading - // from the same GitHub instance the Action is running on. - // This avoids leaking Enterprise tokens to dotcom. - // We also don't want to send an authorization header if there's already a token provided in the URL. let authorization: string | undefined = undefined; + + // We don't want to send an authorization header if there's already a token provided in the URL. if (searchParams.has("token")) { logger.debug("CodeQL tools URL contains an authorization token."); } else { diff --git a/src/start-proxy-action.ts b/src/start-proxy-action.ts index 6413b0b17..9592b904b 100644 --- a/src/start-proxy-action.ts +++ b/src/start-proxy-action.ts @@ -193,15 +193,11 @@ async function getProxyBinaryPath(logger: Logger): Promise { let proxyBin = toolcache.find(proxyFileName, proxyInfo.version); if (!proxyBin) { - // We only want to provide an authorization header if we are downloading - // from the same GitHub instance the Action is running on. - // This avoids leaking Enterprise tokens to dotcom. const apiDetails = getApiDetails(); const authorization = getAuthorizationHeaderFor( logger, apiDetails, proxyInfo.url, - "`update-job-proxy`", ); const temp = await toolcache.downloadTool( proxyInfo.url, From 50a31df6baea8e050bfa318999ff195f93878cfc Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 24 Sep 2025 15:12:49 +0000 Subject: [PATCH 46/53] Bump @actions/cache from 4.0.5 to 4.1.0 in the npm group Bumps the npm group with 1 update: [@actions/cache](https://github.com/actions/toolkit/tree/HEAD/packages/cache). Updates `@actions/cache` from 4.0.5 to 4.1.0 - [Changelog](https://github.com/actions/toolkit/blob/main/packages/cache/RELEASES.md) - [Commits](https://github.com/actions/toolkit/commits/HEAD/packages/cache) --- updated-dependencies: - dependency-name: "@actions/cache" dependency-version: 4.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm ... Signed-off-by: dependabot[bot] --- package-lock.json | 8 ++++---- package.json | 2 +- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/package-lock.json b/package-lock.json index a98d6f652..297449464 100644 --- a/package-lock.json +++ b/package-lock.json @@ -11,7 +11,7 @@ "dependencies": { "@actions/artifact": "^2.3.1", "@actions/artifact-legacy": "npm:@actions/artifact@^1.1.2", - "@actions/cache": "^4.0.5", + "@actions/cache": "^4.1.0", "@actions/core": "^1.11.1", "@actions/exec": "^1.1.1", "@actions/github": "^6.0.0", @@ -284,9 +284,9 @@ "integrity": "sha512-9sIH3nSUttelJSXUrmGzl7QUBFul0/mB8HRYl3fOlgHbIWG+WnYDXU3v/2zMtAvuzZ/ed00Ei6on975FhBfzrg==" }, "node_modules/@actions/cache": { - "version": "4.0.5", - "resolved": "https://registry.npmjs.org/@actions/cache/-/cache-4.0.5.tgz", - "integrity": "sha512-RjLz1/vvntOfp3FpkY3wB0MjVRbLq7bfQEuQG9UUTKwdtcYmFrKVmuD+9B6ADbzbkSfHM+dM4sMjdr3R4XIkFg==", + "version": "4.1.0", + "resolved": "https://registry.npmjs.org/@actions/cache/-/cache-4.1.0.tgz", + "integrity": "sha512-z3Opg+P4Y7baq+g1dODXgdtsvPLSewr3ZKpp3U0HQR1A/vWCoJFS52XSezjdngo4SIOdR5oHtyK3a3Arar+X9A==", "license": "MIT", "dependencies": { "@actions/core": "^1.11.1", diff --git a/package.json b/package.json index e44344054..96fe4d3aa 100644 --- a/package.json +++ b/package.json @@ -25,7 +25,7 @@ "dependencies": { "@actions/artifact": "^2.3.1", "@actions/artifact-legacy": "npm:@actions/artifact@^1.1.2", - "@actions/cache": "^4.0.5", + "@actions/cache": "^4.1.0", "@actions/core": "^1.11.1", "@actions/exec": "^1.1.1", "@actions/github": "^6.0.0", From f134e09015e4a98da6c6918634d096f45d8a50e3 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Wed, 24 Sep 2025 15:14:06 +0000 Subject: [PATCH 47/53] Rebuild --- lib/analyze-action-post.js | 58 +++++++++++++++++++++++++------ lib/analyze-action.js | 58 +++++++++++++++++++++++++------ lib/autobuild-action.js | 58 +++++++++++++++++++++++++------ lib/init-action-post.js | 58 +++++++++++++++++++++++++------ lib/init-action.js | 58 +++++++++++++++++++++++++------ lib/resolve-environment-action.js | 58 +++++++++++++++++++++++++------ lib/start-proxy-action-post.js | 58 +++++++++++++++++++++++++------ lib/start-proxy-action.js | 2 +- lib/upload-lib.js | 58 +++++++++++++++++++++++++------ lib/upload-sarif-action-post.js | 58 +++++++++++++++++++++++++------ lib/upload-sarif-action.js | 58 +++++++++++++++++++++++++------ 11 files changed, 481 insertions(+), 101 deletions(-) diff --git a/lib/analyze-action-post.js b/lib/analyze-action-post.js index 32520e912..4a0151104 100644 --- a/lib/analyze-action-post.js +++ b/lib/analyze-action-post.js @@ -26463,7 +26463,7 @@ var require_package = __commonJS({ dependencies: { "@actions/artifact": "^2.3.1", "@actions/artifact-legacy": "npm:@actions/artifact@^1.1.2", - "@actions/cache": "^4.0.5", + "@actions/cache": "^4.1.0", "@actions/core": "^1.11.1", "@actions/exec": "^1.1.1", "@actions/github": "^6.0.0", @@ -67282,7 +67282,7 @@ var require_package2 = __commonJS({ "node_modules/@actions/cache/package.json"(exports2, module2) { module2.exports = { name: "@actions/cache", - version: "4.0.5", + version: "4.1.0", preview: true, description: "Actions cache lib", keywords: [ @@ -72091,11 +72091,18 @@ var require_cache2 = __commonJS({ kind: "scalar", T: 9 /*ScalarType.STRING*/ + }, + { + no: 3, + name: "message", + kind: "scalar", + T: 9 + /*ScalarType.STRING*/ } ]); } create(value) { - const message = { ok: false, signedUploadUrl: "" }; + const message = { ok: false, signedUploadUrl: "", message: "" }; globalThis.Object.defineProperty(message, runtime_4.MESSAGE_TYPE, { enumerable: false, value: this }); if (value !== void 0) (0, runtime_3.reflectionMergePartial)(this, message, value); @@ -72114,6 +72121,10 @@ var require_cache2 = __commonJS({ 2: message.signedUploadUrl = reader.string(); break; + case /* string message */ + 3: + message.message = reader.string(); + break; default: let u = options.readUnknownField; if (u === "throw") @@ -72130,6 +72141,8 @@ var require_cache2 = __commonJS({ writer.tag(1, runtime_1.WireType.Varint).bool(message.ok); if (message.signedUploadUrl !== "") writer.tag(2, runtime_1.WireType.LengthDelimited).string(message.signedUploadUrl); + if (message.message !== "") + writer.tag(3, runtime_1.WireType.LengthDelimited).string(message.message); let u = options.writeUnknownFields; if (u !== false) (u == true ? runtime_2.UnknownFieldHandler.onWrite : u)(this.typeName, message, writer); @@ -72235,11 +72248,18 @@ var require_cache2 = __commonJS({ kind: "scalar", T: 3 /*ScalarType.INT64*/ + }, + { + no: 3, + name: "message", + kind: "scalar", + T: 9 + /*ScalarType.STRING*/ } ]); } create(value) { - const message = { ok: false, entryId: "0" }; + const message = { ok: false, entryId: "0", message: "" }; globalThis.Object.defineProperty(message, runtime_4.MESSAGE_TYPE, { enumerable: false, value: this }); if (value !== void 0) (0, runtime_3.reflectionMergePartial)(this, message, value); @@ -72258,6 +72278,10 @@ var require_cache2 = __commonJS({ 2: message.entryId = reader.int64().toString(); break; + case /* string message */ + 3: + message.message = reader.string(); + break; default: let u = options.readUnknownField; if (u === "throw") @@ -72274,6 +72298,8 @@ var require_cache2 = __commonJS({ writer.tag(1, runtime_1.WireType.Varint).bool(message.ok); if (message.entryId !== "0") writer.tag(2, runtime_1.WireType.Varint).int64(message.entryId); + if (message.message !== "") + writer.tag(3, runtime_1.WireType.LengthDelimited).string(message.message); let u = options.writeUnknownFields; if (u !== false) (u == true ? runtime_2.UnknownFieldHandler.onWrite : u)(this.typeName, message, writer); @@ -73037,7 +73063,7 @@ var require_cache3 = __commonJS({ }); }; Object.defineProperty(exports2, "__esModule", { value: true }); - exports2.saveCache = exports2.restoreCache = exports2.isFeatureAvailable = exports2.ReserveCacheError = exports2.ValidationError = void 0; + exports2.saveCache = exports2.restoreCache = exports2.isFeatureAvailable = exports2.FinalizeCacheError = exports2.ReserveCacheError = exports2.ValidationError = void 0; var core14 = __importStar4(require_core()); var path6 = __importStar4(require("path")); var utils = __importStar4(require_cacheUtils()); @@ -73045,7 +73071,6 @@ var require_cache3 = __commonJS({ var cacheTwirpClient = __importStar4(require_cacheTwirpClient()); var config_1 = require_config(); var tar_1 = require_tar(); - var constants_1 = require_constants7(); var http_client_1 = require_lib(); var ValidationError = class _ValidationError extends Error { constructor(message) { @@ -73063,6 +73088,14 @@ var require_cache3 = __commonJS({ } }; exports2.ReserveCacheError = ReserveCacheError2; + var FinalizeCacheError = class _FinalizeCacheError extends Error { + constructor(message) { + super(message); + this.name = "FinalizeCacheError"; + Object.setPrototypeOf(this, _FinalizeCacheError.prototype); + } + }; + exports2.FinalizeCacheError = FinalizeCacheError; function checkPaths(paths) { if (!paths || paths.length === 0) { throw new ValidationError(`Path Validation Error: At least one directory or file path is required`); @@ -73334,9 +73367,6 @@ var require_cache3 = __commonJS({ } const archiveFileSize = utils.getArchiveFileSizeInBytes(archivePath); core14.debug(`File Size: ${archiveFileSize}`); - if (archiveFileSize > constants_1.CacheFileSizeLimit && !(0, config_1.isGhes)()) { - throw new Error(`Cache size of ~${Math.round(archiveFileSize / (1024 * 1024))} MB (${archiveFileSize} B) is over the 10GB limit, not saving cache.`); - } options.archiveSizeBytes = archiveFileSize; core14.debug("Reserving Cache"); const version = utils.getCacheVersion(paths, compressionMethod, enableCrossOsArchive); @@ -73348,7 +73378,10 @@ var require_cache3 = __commonJS({ try { const response = yield twirpClient.CreateCacheEntry(request); if (!response.ok) { - throw new Error("Response was not ok"); + if (response.message) { + core14.warning(`Cache reservation failed: ${response.message}`); + } + throw new Error(response.message || "Response was not ok"); } signedUploadUrl = response.signedUploadUrl; } catch (error2) { @@ -73365,6 +73398,9 @@ var require_cache3 = __commonJS({ const finalizeResponse = yield twirpClient.FinalizeCacheEntryUpload(finalizeRequest); core14.debug(`FinalizeCacheEntryUploadResponse: ${finalizeResponse.ok}`); if (!finalizeResponse.ok) { + if (finalizeResponse.message) { + throw new FinalizeCacheError(finalizeResponse.message); + } throw new Error(`Unable to finalize cache with key ${key}, another job may be finalizing this cache.`); } cacheId = parseInt(finalizeResponse.entryId); @@ -73374,6 +73410,8 @@ var require_cache3 = __commonJS({ throw error2; } else if (typedError.name === ReserveCacheError2.name) { core14.info(`Failed to save: ${typedError.message}`); + } else if (typedError.name === FinalizeCacheError.name) { + core14.warning(typedError.message); } else { if (typedError instanceof http_client_1.HttpClientError && typeof typedError.statusCode === "number" && typedError.statusCode >= 500) { core14.error(`Failed to save: ${typedError.message}`); diff --git a/lib/analyze-action.js b/lib/analyze-action.js index 164ad518f..824999309 100644 --- a/lib/analyze-action.js +++ b/lib/analyze-action.js @@ -32312,7 +32312,7 @@ var require_package = __commonJS({ dependencies: { "@actions/artifact": "^2.3.1", "@actions/artifact-legacy": "npm:@actions/artifact@^1.1.2", - "@actions/cache": "^4.0.5", + "@actions/cache": "^4.1.0", "@actions/core": "^1.11.1", "@actions/exec": "^1.1.1", "@actions/github": "^6.0.0", @@ -73131,7 +73131,7 @@ var require_package2 = __commonJS({ "node_modules/@actions/cache/package.json"(exports2, module2) { module2.exports = { name: "@actions/cache", - version: "4.0.5", + version: "4.1.0", preview: true, description: "Actions cache lib", keywords: [ @@ -77940,11 +77940,18 @@ var require_cache2 = __commonJS({ kind: "scalar", T: 9 /*ScalarType.STRING*/ + }, + { + no: 3, + name: "message", + kind: "scalar", + T: 9 + /*ScalarType.STRING*/ } ]); } create(value) { - const message = { ok: false, signedUploadUrl: "" }; + const message = { ok: false, signedUploadUrl: "", message: "" }; globalThis.Object.defineProperty(message, runtime_4.MESSAGE_TYPE, { enumerable: false, value: this }); if (value !== void 0) (0, runtime_3.reflectionMergePartial)(this, message, value); @@ -77963,6 +77970,10 @@ var require_cache2 = __commonJS({ 2: message.signedUploadUrl = reader.string(); break; + case /* string message */ + 3: + message.message = reader.string(); + break; default: let u = options.readUnknownField; if (u === "throw") @@ -77979,6 +77990,8 @@ var require_cache2 = __commonJS({ writer.tag(1, runtime_1.WireType.Varint).bool(message.ok); if (message.signedUploadUrl !== "") writer.tag(2, runtime_1.WireType.LengthDelimited).string(message.signedUploadUrl); + if (message.message !== "") + writer.tag(3, runtime_1.WireType.LengthDelimited).string(message.message); let u = options.writeUnknownFields; if (u !== false) (u == true ? runtime_2.UnknownFieldHandler.onWrite : u)(this.typeName, message, writer); @@ -78084,11 +78097,18 @@ var require_cache2 = __commonJS({ kind: "scalar", T: 3 /*ScalarType.INT64*/ + }, + { + no: 3, + name: "message", + kind: "scalar", + T: 9 + /*ScalarType.STRING*/ } ]); } create(value) { - const message = { ok: false, entryId: "0" }; + const message = { ok: false, entryId: "0", message: "" }; globalThis.Object.defineProperty(message, runtime_4.MESSAGE_TYPE, { enumerable: false, value: this }); if (value !== void 0) (0, runtime_3.reflectionMergePartial)(this, message, value); @@ -78107,6 +78127,10 @@ var require_cache2 = __commonJS({ 2: message.entryId = reader.int64().toString(); break; + case /* string message */ + 3: + message.message = reader.string(); + break; default: let u = options.readUnknownField; if (u === "throw") @@ -78123,6 +78147,8 @@ var require_cache2 = __commonJS({ writer.tag(1, runtime_1.WireType.Varint).bool(message.ok); if (message.entryId !== "0") writer.tag(2, runtime_1.WireType.Varint).int64(message.entryId); + if (message.message !== "") + writer.tag(3, runtime_1.WireType.LengthDelimited).string(message.message); let u = options.writeUnknownFields; if (u !== false) (u == true ? runtime_2.UnknownFieldHandler.onWrite : u)(this.typeName, message, writer); @@ -78886,7 +78912,7 @@ var require_cache3 = __commonJS({ }); }; Object.defineProperty(exports2, "__esModule", { value: true }); - exports2.saveCache = exports2.restoreCache = exports2.isFeatureAvailable = exports2.ReserveCacheError = exports2.ValidationError = void 0; + exports2.saveCache = exports2.restoreCache = exports2.isFeatureAvailable = exports2.FinalizeCacheError = exports2.ReserveCacheError = exports2.ValidationError = void 0; var core15 = __importStar4(require_core()); var path20 = __importStar4(require("path")); var utils = __importStar4(require_cacheUtils()); @@ -78894,7 +78920,6 @@ var require_cache3 = __commonJS({ var cacheTwirpClient = __importStar4(require_cacheTwirpClient()); var config_1 = require_config(); var tar_1 = require_tar(); - var constants_1 = require_constants10(); var http_client_1 = require_lib(); var ValidationError = class _ValidationError extends Error { constructor(message) { @@ -78912,6 +78937,14 @@ var require_cache3 = __commonJS({ } }; exports2.ReserveCacheError = ReserveCacheError2; + var FinalizeCacheError = class _FinalizeCacheError extends Error { + constructor(message) { + super(message); + this.name = "FinalizeCacheError"; + Object.setPrototypeOf(this, _FinalizeCacheError.prototype); + } + }; + exports2.FinalizeCacheError = FinalizeCacheError; function checkPaths(paths) { if (!paths || paths.length === 0) { throw new ValidationError(`Path Validation Error: At least one directory or file path is required`); @@ -79183,9 +79216,6 @@ var require_cache3 = __commonJS({ } const archiveFileSize = utils.getArchiveFileSizeInBytes(archivePath); core15.debug(`File Size: ${archiveFileSize}`); - if (archiveFileSize > constants_1.CacheFileSizeLimit && !(0, config_1.isGhes)()) { - throw new Error(`Cache size of ~${Math.round(archiveFileSize / (1024 * 1024))} MB (${archiveFileSize} B) is over the 10GB limit, not saving cache.`); - } options.archiveSizeBytes = archiveFileSize; core15.debug("Reserving Cache"); const version = utils.getCacheVersion(paths, compressionMethod, enableCrossOsArchive); @@ -79197,7 +79227,10 @@ var require_cache3 = __commonJS({ try { const response = yield twirpClient.CreateCacheEntry(request); if (!response.ok) { - throw new Error("Response was not ok"); + if (response.message) { + core15.warning(`Cache reservation failed: ${response.message}`); + } + throw new Error(response.message || "Response was not ok"); } signedUploadUrl = response.signedUploadUrl; } catch (error2) { @@ -79214,6 +79247,9 @@ var require_cache3 = __commonJS({ const finalizeResponse = yield twirpClient.FinalizeCacheEntryUpload(finalizeRequest); core15.debug(`FinalizeCacheEntryUploadResponse: ${finalizeResponse.ok}`); if (!finalizeResponse.ok) { + if (finalizeResponse.message) { + throw new FinalizeCacheError(finalizeResponse.message); + } throw new Error(`Unable to finalize cache with key ${key}, another job may be finalizing this cache.`); } cacheId = parseInt(finalizeResponse.entryId); @@ -79223,6 +79259,8 @@ var require_cache3 = __commonJS({ throw error2; } else if (typedError.name === ReserveCacheError2.name) { core15.info(`Failed to save: ${typedError.message}`); + } else if (typedError.name === FinalizeCacheError.name) { + core15.warning(typedError.message); } else { if (typedError instanceof http_client_1.HttpClientError && typeof typedError.statusCode === "number" && typedError.statusCode >= 500) { core15.error(`Failed to save: ${typedError.message}`); diff --git a/lib/autobuild-action.js b/lib/autobuild-action.js index ae94e5fc8..f6a3cdd90 100644 --- a/lib/autobuild-action.js +++ b/lib/autobuild-action.js @@ -26463,7 +26463,7 @@ var require_package = __commonJS({ dependencies: { "@actions/artifact": "^2.3.1", "@actions/artifact-legacy": "npm:@actions/artifact@^1.1.2", - "@actions/cache": "^4.0.5", + "@actions/cache": "^4.1.0", "@actions/core": "^1.11.1", "@actions/exec": "^1.1.1", "@actions/github": "^6.0.0", @@ -67282,7 +67282,7 @@ var require_package2 = __commonJS({ "node_modules/@actions/cache/package.json"(exports2, module2) { module2.exports = { name: "@actions/cache", - version: "4.0.5", + version: "4.1.0", preview: true, description: "Actions cache lib", keywords: [ @@ -72091,11 +72091,18 @@ var require_cache2 = __commonJS({ kind: "scalar", T: 9 /*ScalarType.STRING*/ + }, + { + no: 3, + name: "message", + kind: "scalar", + T: 9 + /*ScalarType.STRING*/ } ]); } create(value) { - const message = { ok: false, signedUploadUrl: "" }; + const message = { ok: false, signedUploadUrl: "", message: "" }; globalThis.Object.defineProperty(message, runtime_4.MESSAGE_TYPE, { enumerable: false, value: this }); if (value !== void 0) (0, runtime_3.reflectionMergePartial)(this, message, value); @@ -72114,6 +72121,10 @@ var require_cache2 = __commonJS({ 2: message.signedUploadUrl = reader.string(); break; + case /* string message */ + 3: + message.message = reader.string(); + break; default: let u = options.readUnknownField; if (u === "throw") @@ -72130,6 +72141,8 @@ var require_cache2 = __commonJS({ writer.tag(1, runtime_1.WireType.Varint).bool(message.ok); if (message.signedUploadUrl !== "") writer.tag(2, runtime_1.WireType.LengthDelimited).string(message.signedUploadUrl); + if (message.message !== "") + writer.tag(3, runtime_1.WireType.LengthDelimited).string(message.message); let u = options.writeUnknownFields; if (u !== false) (u == true ? runtime_2.UnknownFieldHandler.onWrite : u)(this.typeName, message, writer); @@ -72235,11 +72248,18 @@ var require_cache2 = __commonJS({ kind: "scalar", T: 3 /*ScalarType.INT64*/ + }, + { + no: 3, + name: "message", + kind: "scalar", + T: 9 + /*ScalarType.STRING*/ } ]); } create(value) { - const message = { ok: false, entryId: "0" }; + const message = { ok: false, entryId: "0", message: "" }; globalThis.Object.defineProperty(message, runtime_4.MESSAGE_TYPE, { enumerable: false, value: this }); if (value !== void 0) (0, runtime_3.reflectionMergePartial)(this, message, value); @@ -72258,6 +72278,10 @@ var require_cache2 = __commonJS({ 2: message.entryId = reader.int64().toString(); break; + case /* string message */ + 3: + message.message = reader.string(); + break; default: let u = options.readUnknownField; if (u === "throw") @@ -72274,6 +72298,8 @@ var require_cache2 = __commonJS({ writer.tag(1, runtime_1.WireType.Varint).bool(message.ok); if (message.entryId !== "0") writer.tag(2, runtime_1.WireType.Varint).int64(message.entryId); + if (message.message !== "") + writer.tag(3, runtime_1.WireType.LengthDelimited).string(message.message); let u = options.writeUnknownFields; if (u !== false) (u == true ? runtime_2.UnknownFieldHandler.onWrite : u)(this.typeName, message, writer); @@ -73037,7 +73063,7 @@ var require_cache3 = __commonJS({ }); }; Object.defineProperty(exports2, "__esModule", { value: true }); - exports2.saveCache = exports2.restoreCache = exports2.isFeatureAvailable = exports2.ReserveCacheError = exports2.ValidationError = void 0; + exports2.saveCache = exports2.restoreCache = exports2.isFeatureAvailable = exports2.FinalizeCacheError = exports2.ReserveCacheError = exports2.ValidationError = void 0; var core14 = __importStar4(require_core()); var path7 = __importStar4(require("path")); var utils = __importStar4(require_cacheUtils()); @@ -73045,7 +73071,6 @@ var require_cache3 = __commonJS({ var cacheTwirpClient = __importStar4(require_cacheTwirpClient()); var config_1 = require_config(); var tar_1 = require_tar(); - var constants_1 = require_constants7(); var http_client_1 = require_lib(); var ValidationError = class _ValidationError extends Error { constructor(message) { @@ -73063,6 +73088,14 @@ var require_cache3 = __commonJS({ } }; exports2.ReserveCacheError = ReserveCacheError; + var FinalizeCacheError = class _FinalizeCacheError extends Error { + constructor(message) { + super(message); + this.name = "FinalizeCacheError"; + Object.setPrototypeOf(this, _FinalizeCacheError.prototype); + } + }; + exports2.FinalizeCacheError = FinalizeCacheError; function checkPaths(paths) { if (!paths || paths.length === 0) { throw new ValidationError(`Path Validation Error: At least one directory or file path is required`); @@ -73334,9 +73367,6 @@ var require_cache3 = __commonJS({ } const archiveFileSize = utils.getArchiveFileSizeInBytes(archivePath); core14.debug(`File Size: ${archiveFileSize}`); - if (archiveFileSize > constants_1.CacheFileSizeLimit && !(0, config_1.isGhes)()) { - throw new Error(`Cache size of ~${Math.round(archiveFileSize / (1024 * 1024))} MB (${archiveFileSize} B) is over the 10GB limit, not saving cache.`); - } options.archiveSizeBytes = archiveFileSize; core14.debug("Reserving Cache"); const version = utils.getCacheVersion(paths, compressionMethod, enableCrossOsArchive); @@ -73348,7 +73378,10 @@ var require_cache3 = __commonJS({ try { const response = yield twirpClient.CreateCacheEntry(request); if (!response.ok) { - throw new Error("Response was not ok"); + if (response.message) { + core14.warning(`Cache reservation failed: ${response.message}`); + } + throw new Error(response.message || "Response was not ok"); } signedUploadUrl = response.signedUploadUrl; } catch (error2) { @@ -73365,6 +73398,9 @@ var require_cache3 = __commonJS({ const finalizeResponse = yield twirpClient.FinalizeCacheEntryUpload(finalizeRequest); core14.debug(`FinalizeCacheEntryUploadResponse: ${finalizeResponse.ok}`); if (!finalizeResponse.ok) { + if (finalizeResponse.message) { + throw new FinalizeCacheError(finalizeResponse.message); + } throw new Error(`Unable to finalize cache with key ${key}, another job may be finalizing this cache.`); } cacheId = parseInt(finalizeResponse.entryId); @@ -73374,6 +73410,8 @@ var require_cache3 = __commonJS({ throw error2; } else if (typedError.name === ReserveCacheError.name) { core14.info(`Failed to save: ${typedError.message}`); + } else if (typedError.name === FinalizeCacheError.name) { + core14.warning(typedError.message); } else { if (typedError instanceof http_client_1.HttpClientError && typeof typedError.statusCode === "number" && typedError.statusCode >= 500) { core14.error(`Failed to save: ${typedError.message}`); diff --git a/lib/init-action-post.js b/lib/init-action-post.js index 7b156fce4..95092c298 100644 --- a/lib/init-action-post.js +++ b/lib/init-action-post.js @@ -32312,7 +32312,7 @@ var require_package = __commonJS({ dependencies: { "@actions/artifact": "^2.3.1", "@actions/artifact-legacy": "npm:@actions/artifact@^1.1.2", - "@actions/cache": "^4.0.5", + "@actions/cache": "^4.1.0", "@actions/core": "^1.11.1", "@actions/exec": "^1.1.1", "@actions/github": "^6.0.0", @@ -73131,7 +73131,7 @@ var require_package2 = __commonJS({ "node_modules/@actions/cache/package.json"(exports2, module2) { module2.exports = { name: "@actions/cache", - version: "4.0.5", + version: "4.1.0", preview: true, description: "Actions cache lib", keywords: [ @@ -77940,11 +77940,18 @@ var require_cache2 = __commonJS({ kind: "scalar", T: 9 /*ScalarType.STRING*/ + }, + { + no: 3, + name: "message", + kind: "scalar", + T: 9 + /*ScalarType.STRING*/ } ]); } create(value) { - const message = { ok: false, signedUploadUrl: "" }; + const message = { ok: false, signedUploadUrl: "", message: "" }; globalThis.Object.defineProperty(message, runtime_4.MESSAGE_TYPE, { enumerable: false, value: this }); if (value !== void 0) (0, runtime_3.reflectionMergePartial)(this, message, value); @@ -77963,6 +77970,10 @@ var require_cache2 = __commonJS({ 2: message.signedUploadUrl = reader.string(); break; + case /* string message */ + 3: + message.message = reader.string(); + break; default: let u = options.readUnknownField; if (u === "throw") @@ -77979,6 +77990,8 @@ var require_cache2 = __commonJS({ writer.tag(1, runtime_1.WireType.Varint).bool(message.ok); if (message.signedUploadUrl !== "") writer.tag(2, runtime_1.WireType.LengthDelimited).string(message.signedUploadUrl); + if (message.message !== "") + writer.tag(3, runtime_1.WireType.LengthDelimited).string(message.message); let u = options.writeUnknownFields; if (u !== false) (u == true ? runtime_2.UnknownFieldHandler.onWrite : u)(this.typeName, message, writer); @@ -78084,11 +78097,18 @@ var require_cache2 = __commonJS({ kind: "scalar", T: 3 /*ScalarType.INT64*/ + }, + { + no: 3, + name: "message", + kind: "scalar", + T: 9 + /*ScalarType.STRING*/ } ]); } create(value) { - const message = { ok: false, entryId: "0" }; + const message = { ok: false, entryId: "0", message: "" }; globalThis.Object.defineProperty(message, runtime_4.MESSAGE_TYPE, { enumerable: false, value: this }); if (value !== void 0) (0, runtime_3.reflectionMergePartial)(this, message, value); @@ -78107,6 +78127,10 @@ var require_cache2 = __commonJS({ 2: message.entryId = reader.int64().toString(); break; + case /* string message */ + 3: + message.message = reader.string(); + break; default: let u = options.readUnknownField; if (u === "throw") @@ -78123,6 +78147,8 @@ var require_cache2 = __commonJS({ writer.tag(1, runtime_1.WireType.Varint).bool(message.ok); if (message.entryId !== "0") writer.tag(2, runtime_1.WireType.Varint).int64(message.entryId); + if (message.message !== "") + writer.tag(3, runtime_1.WireType.LengthDelimited).string(message.message); let u = options.writeUnknownFields; if (u !== false) (u == true ? runtime_2.UnknownFieldHandler.onWrite : u)(this.typeName, message, writer); @@ -78886,7 +78912,7 @@ var require_cache3 = __commonJS({ }); }; Object.defineProperty(exports2, "__esModule", { value: true }); - exports2.saveCache = exports2.restoreCache = exports2.isFeatureAvailable = exports2.ReserveCacheError = exports2.ValidationError = void 0; + exports2.saveCache = exports2.restoreCache = exports2.isFeatureAvailable = exports2.FinalizeCacheError = exports2.ReserveCacheError = exports2.ValidationError = void 0; var core18 = __importStar4(require_core()); var path19 = __importStar4(require("path")); var utils = __importStar4(require_cacheUtils()); @@ -78894,7 +78920,6 @@ var require_cache3 = __commonJS({ var cacheTwirpClient = __importStar4(require_cacheTwirpClient()); var config_1 = require_config(); var tar_1 = require_tar(); - var constants_1 = require_constants10(); var http_client_1 = require_lib(); var ValidationError = class _ValidationError extends Error { constructor(message) { @@ -78912,6 +78937,14 @@ var require_cache3 = __commonJS({ } }; exports2.ReserveCacheError = ReserveCacheError2; + var FinalizeCacheError = class _FinalizeCacheError extends Error { + constructor(message) { + super(message); + this.name = "FinalizeCacheError"; + Object.setPrototypeOf(this, _FinalizeCacheError.prototype); + } + }; + exports2.FinalizeCacheError = FinalizeCacheError; function checkPaths(paths) { if (!paths || paths.length === 0) { throw new ValidationError(`Path Validation Error: At least one directory or file path is required`); @@ -79183,9 +79216,6 @@ var require_cache3 = __commonJS({ } const archiveFileSize = utils.getArchiveFileSizeInBytes(archivePath); core18.debug(`File Size: ${archiveFileSize}`); - if (archiveFileSize > constants_1.CacheFileSizeLimit && !(0, config_1.isGhes)()) { - throw new Error(`Cache size of ~${Math.round(archiveFileSize / (1024 * 1024))} MB (${archiveFileSize} B) is over the 10GB limit, not saving cache.`); - } options.archiveSizeBytes = archiveFileSize; core18.debug("Reserving Cache"); const version = utils.getCacheVersion(paths, compressionMethod, enableCrossOsArchive); @@ -79197,7 +79227,10 @@ var require_cache3 = __commonJS({ try { const response = yield twirpClient.CreateCacheEntry(request); if (!response.ok) { - throw new Error("Response was not ok"); + if (response.message) { + core18.warning(`Cache reservation failed: ${response.message}`); + } + throw new Error(response.message || "Response was not ok"); } signedUploadUrl = response.signedUploadUrl; } catch (error2) { @@ -79214,6 +79247,9 @@ var require_cache3 = __commonJS({ const finalizeResponse = yield twirpClient.FinalizeCacheEntryUpload(finalizeRequest); core18.debug(`FinalizeCacheEntryUploadResponse: ${finalizeResponse.ok}`); if (!finalizeResponse.ok) { + if (finalizeResponse.message) { + throw new FinalizeCacheError(finalizeResponse.message); + } throw new Error(`Unable to finalize cache with key ${key}, another job may be finalizing this cache.`); } cacheId = parseInt(finalizeResponse.entryId); @@ -79223,6 +79259,8 @@ var require_cache3 = __commonJS({ throw error2; } else if (typedError.name === ReserveCacheError2.name) { core18.info(`Failed to save: ${typedError.message}`); + } else if (typedError.name === FinalizeCacheError.name) { + core18.warning(typedError.message); } else { if (typedError instanceof http_client_1.HttpClientError && typeof typedError.statusCode === "number" && typedError.statusCode >= 500) { core18.error(`Failed to save: ${typedError.message}`); diff --git a/lib/init-action.js b/lib/init-action.js index 52b99d631..6e66bea73 100644 --- a/lib/init-action.js +++ b/lib/init-action.js @@ -32312,7 +32312,7 @@ var require_package = __commonJS({ dependencies: { "@actions/artifact": "^2.3.1", "@actions/artifact-legacy": "npm:@actions/artifact@^1.1.2", - "@actions/cache": "^4.0.5", + "@actions/cache": "^4.1.0", "@actions/core": "^1.11.1", "@actions/exec": "^1.1.1", "@actions/github": "^6.0.0", @@ -73131,7 +73131,7 @@ var require_package2 = __commonJS({ "node_modules/@actions/cache/package.json"(exports2, module2) { module2.exports = { name: "@actions/cache", - version: "4.0.5", + version: "4.1.0", preview: true, description: "Actions cache lib", keywords: [ @@ -77940,11 +77940,18 @@ var require_cache2 = __commonJS({ kind: "scalar", T: 9 /*ScalarType.STRING*/ + }, + { + no: 3, + name: "message", + kind: "scalar", + T: 9 + /*ScalarType.STRING*/ } ]); } create(value) { - const message = { ok: false, signedUploadUrl: "" }; + const message = { ok: false, signedUploadUrl: "", message: "" }; globalThis.Object.defineProperty(message, runtime_4.MESSAGE_TYPE, { enumerable: false, value: this }); if (value !== void 0) (0, runtime_3.reflectionMergePartial)(this, message, value); @@ -77963,6 +77970,10 @@ var require_cache2 = __commonJS({ 2: message.signedUploadUrl = reader.string(); break; + case /* string message */ + 3: + message.message = reader.string(); + break; default: let u = options.readUnknownField; if (u === "throw") @@ -77979,6 +77990,8 @@ var require_cache2 = __commonJS({ writer.tag(1, runtime_1.WireType.Varint).bool(message.ok); if (message.signedUploadUrl !== "") writer.tag(2, runtime_1.WireType.LengthDelimited).string(message.signedUploadUrl); + if (message.message !== "") + writer.tag(3, runtime_1.WireType.LengthDelimited).string(message.message); let u = options.writeUnknownFields; if (u !== false) (u == true ? runtime_2.UnknownFieldHandler.onWrite : u)(this.typeName, message, writer); @@ -78084,11 +78097,18 @@ var require_cache2 = __commonJS({ kind: "scalar", T: 3 /*ScalarType.INT64*/ + }, + { + no: 3, + name: "message", + kind: "scalar", + T: 9 + /*ScalarType.STRING*/ } ]); } create(value) { - const message = { ok: false, entryId: "0" }; + const message = { ok: false, entryId: "0", message: "" }; globalThis.Object.defineProperty(message, runtime_4.MESSAGE_TYPE, { enumerable: false, value: this }); if (value !== void 0) (0, runtime_3.reflectionMergePartial)(this, message, value); @@ -78107,6 +78127,10 @@ var require_cache2 = __commonJS({ 2: message.entryId = reader.int64().toString(); break; + case /* string message */ + 3: + message.message = reader.string(); + break; default: let u = options.readUnknownField; if (u === "throw") @@ -78123,6 +78147,8 @@ var require_cache2 = __commonJS({ writer.tag(1, runtime_1.WireType.Varint).bool(message.ok); if (message.entryId !== "0") writer.tag(2, runtime_1.WireType.Varint).int64(message.entryId); + if (message.message !== "") + writer.tag(3, runtime_1.WireType.LengthDelimited).string(message.message); let u = options.writeUnknownFields; if (u !== false) (u == true ? runtime_2.UnknownFieldHandler.onWrite : u)(this.typeName, message, writer); @@ -78886,7 +78912,7 @@ var require_cache3 = __commonJS({ }); }; Object.defineProperty(exports2, "__esModule", { value: true }); - exports2.saveCache = exports2.restoreCache = exports2.isFeatureAvailable = exports2.ReserveCacheError = exports2.ValidationError = void 0; + exports2.saveCache = exports2.restoreCache = exports2.isFeatureAvailable = exports2.FinalizeCacheError = exports2.ReserveCacheError = exports2.ValidationError = void 0; var core14 = __importStar4(require_core()); var path20 = __importStar4(require("path")); var utils = __importStar4(require_cacheUtils()); @@ -78894,7 +78920,6 @@ var require_cache3 = __commonJS({ var cacheTwirpClient = __importStar4(require_cacheTwirpClient()); var config_1 = require_config(); var tar_1 = require_tar(); - var constants_1 = require_constants10(); var http_client_1 = require_lib(); var ValidationError = class _ValidationError extends Error { constructor(message) { @@ -78912,6 +78937,14 @@ var require_cache3 = __commonJS({ } }; exports2.ReserveCacheError = ReserveCacheError2; + var FinalizeCacheError = class _FinalizeCacheError extends Error { + constructor(message) { + super(message); + this.name = "FinalizeCacheError"; + Object.setPrototypeOf(this, _FinalizeCacheError.prototype); + } + }; + exports2.FinalizeCacheError = FinalizeCacheError; function checkPaths(paths) { if (!paths || paths.length === 0) { throw new ValidationError(`Path Validation Error: At least one directory or file path is required`); @@ -79183,9 +79216,6 @@ var require_cache3 = __commonJS({ } const archiveFileSize = utils.getArchiveFileSizeInBytes(archivePath); core14.debug(`File Size: ${archiveFileSize}`); - if (archiveFileSize > constants_1.CacheFileSizeLimit && !(0, config_1.isGhes)()) { - throw new Error(`Cache size of ~${Math.round(archiveFileSize / (1024 * 1024))} MB (${archiveFileSize} B) is over the 10GB limit, not saving cache.`); - } options.archiveSizeBytes = archiveFileSize; core14.debug("Reserving Cache"); const version = utils.getCacheVersion(paths, compressionMethod, enableCrossOsArchive); @@ -79197,7 +79227,10 @@ var require_cache3 = __commonJS({ try { const response = yield twirpClient.CreateCacheEntry(request); if (!response.ok) { - throw new Error("Response was not ok"); + if (response.message) { + core14.warning(`Cache reservation failed: ${response.message}`); + } + throw new Error(response.message || "Response was not ok"); } signedUploadUrl = response.signedUploadUrl; } catch (error2) { @@ -79214,6 +79247,9 @@ var require_cache3 = __commonJS({ const finalizeResponse = yield twirpClient.FinalizeCacheEntryUpload(finalizeRequest); core14.debug(`FinalizeCacheEntryUploadResponse: ${finalizeResponse.ok}`); if (!finalizeResponse.ok) { + if (finalizeResponse.message) { + throw new FinalizeCacheError(finalizeResponse.message); + } throw new Error(`Unable to finalize cache with key ${key}, another job may be finalizing this cache.`); } cacheId = parseInt(finalizeResponse.entryId); @@ -79223,6 +79259,8 @@ var require_cache3 = __commonJS({ throw error2; } else if (typedError.name === ReserveCacheError2.name) { core14.info(`Failed to save: ${typedError.message}`); + } else if (typedError.name === FinalizeCacheError.name) { + core14.warning(typedError.message); } else { if (typedError instanceof http_client_1.HttpClientError && typeof typedError.statusCode === "number" && typedError.statusCode >= 500) { core14.error(`Failed to save: ${typedError.message}`); diff --git a/lib/resolve-environment-action.js b/lib/resolve-environment-action.js index 48be2d053..f63ac2468 100644 --- a/lib/resolve-environment-action.js +++ b/lib/resolve-environment-action.js @@ -26463,7 +26463,7 @@ var require_package = __commonJS({ dependencies: { "@actions/artifact": "^2.3.1", "@actions/artifact-legacy": "npm:@actions/artifact@^1.1.2", - "@actions/cache": "^4.0.5", + "@actions/cache": "^4.1.0", "@actions/core": "^1.11.1", "@actions/exec": "^1.1.1", "@actions/github": "^6.0.0", @@ -67282,7 +67282,7 @@ var require_package2 = __commonJS({ "node_modules/@actions/cache/package.json"(exports2, module2) { module2.exports = { name: "@actions/cache", - version: "4.0.5", + version: "4.1.0", preview: true, description: "Actions cache lib", keywords: [ @@ -72091,11 +72091,18 @@ var require_cache2 = __commonJS({ kind: "scalar", T: 9 /*ScalarType.STRING*/ + }, + { + no: 3, + name: "message", + kind: "scalar", + T: 9 + /*ScalarType.STRING*/ } ]); } create(value) { - const message = { ok: false, signedUploadUrl: "" }; + const message = { ok: false, signedUploadUrl: "", message: "" }; globalThis.Object.defineProperty(message, runtime_4.MESSAGE_TYPE, { enumerable: false, value: this }); if (value !== void 0) (0, runtime_3.reflectionMergePartial)(this, message, value); @@ -72114,6 +72121,10 @@ var require_cache2 = __commonJS({ 2: message.signedUploadUrl = reader.string(); break; + case /* string message */ + 3: + message.message = reader.string(); + break; default: let u = options.readUnknownField; if (u === "throw") @@ -72130,6 +72141,8 @@ var require_cache2 = __commonJS({ writer.tag(1, runtime_1.WireType.Varint).bool(message.ok); if (message.signedUploadUrl !== "") writer.tag(2, runtime_1.WireType.LengthDelimited).string(message.signedUploadUrl); + if (message.message !== "") + writer.tag(3, runtime_1.WireType.LengthDelimited).string(message.message); let u = options.writeUnknownFields; if (u !== false) (u == true ? runtime_2.UnknownFieldHandler.onWrite : u)(this.typeName, message, writer); @@ -72235,11 +72248,18 @@ var require_cache2 = __commonJS({ kind: "scalar", T: 3 /*ScalarType.INT64*/ + }, + { + no: 3, + name: "message", + kind: "scalar", + T: 9 + /*ScalarType.STRING*/ } ]); } create(value) { - const message = { ok: false, entryId: "0" }; + const message = { ok: false, entryId: "0", message: "" }; globalThis.Object.defineProperty(message, runtime_4.MESSAGE_TYPE, { enumerable: false, value: this }); if (value !== void 0) (0, runtime_3.reflectionMergePartial)(this, message, value); @@ -72258,6 +72278,10 @@ var require_cache2 = __commonJS({ 2: message.entryId = reader.int64().toString(); break; + case /* string message */ + 3: + message.message = reader.string(); + break; default: let u = options.readUnknownField; if (u === "throw") @@ -72274,6 +72298,8 @@ var require_cache2 = __commonJS({ writer.tag(1, runtime_1.WireType.Varint).bool(message.ok); if (message.entryId !== "0") writer.tag(2, runtime_1.WireType.Varint).int64(message.entryId); + if (message.message !== "") + writer.tag(3, runtime_1.WireType.LengthDelimited).string(message.message); let u = options.writeUnknownFields; if (u !== false) (u == true ? runtime_2.UnknownFieldHandler.onWrite : u)(this.typeName, message, writer); @@ -73037,7 +73063,7 @@ var require_cache3 = __commonJS({ }); }; Object.defineProperty(exports2, "__esModule", { value: true }); - exports2.saveCache = exports2.restoreCache = exports2.isFeatureAvailable = exports2.ReserveCacheError = exports2.ValidationError = void 0; + exports2.saveCache = exports2.restoreCache = exports2.isFeatureAvailable = exports2.FinalizeCacheError = exports2.ReserveCacheError = exports2.ValidationError = void 0; var core13 = __importStar4(require_core()); var path5 = __importStar4(require("path")); var utils = __importStar4(require_cacheUtils()); @@ -73045,7 +73071,6 @@ var require_cache3 = __commonJS({ var cacheTwirpClient = __importStar4(require_cacheTwirpClient()); var config_1 = require_config(); var tar_1 = require_tar(); - var constants_1 = require_constants7(); var http_client_1 = require_lib(); var ValidationError = class _ValidationError extends Error { constructor(message) { @@ -73063,6 +73088,14 @@ var require_cache3 = __commonJS({ } }; exports2.ReserveCacheError = ReserveCacheError; + var FinalizeCacheError = class _FinalizeCacheError extends Error { + constructor(message) { + super(message); + this.name = "FinalizeCacheError"; + Object.setPrototypeOf(this, _FinalizeCacheError.prototype); + } + }; + exports2.FinalizeCacheError = FinalizeCacheError; function checkPaths(paths) { if (!paths || paths.length === 0) { throw new ValidationError(`Path Validation Error: At least one directory or file path is required`); @@ -73334,9 +73367,6 @@ var require_cache3 = __commonJS({ } const archiveFileSize = utils.getArchiveFileSizeInBytes(archivePath); core13.debug(`File Size: ${archiveFileSize}`); - if (archiveFileSize > constants_1.CacheFileSizeLimit && !(0, config_1.isGhes)()) { - throw new Error(`Cache size of ~${Math.round(archiveFileSize / (1024 * 1024))} MB (${archiveFileSize} B) is over the 10GB limit, not saving cache.`); - } options.archiveSizeBytes = archiveFileSize; core13.debug("Reserving Cache"); const version = utils.getCacheVersion(paths, compressionMethod, enableCrossOsArchive); @@ -73348,7 +73378,10 @@ var require_cache3 = __commonJS({ try { const response = yield twirpClient.CreateCacheEntry(request); if (!response.ok) { - throw new Error("Response was not ok"); + if (response.message) { + core13.warning(`Cache reservation failed: ${response.message}`); + } + throw new Error(response.message || "Response was not ok"); } signedUploadUrl = response.signedUploadUrl; } catch (error2) { @@ -73365,6 +73398,9 @@ var require_cache3 = __commonJS({ const finalizeResponse = yield twirpClient.FinalizeCacheEntryUpload(finalizeRequest); core13.debug(`FinalizeCacheEntryUploadResponse: ${finalizeResponse.ok}`); if (!finalizeResponse.ok) { + if (finalizeResponse.message) { + throw new FinalizeCacheError(finalizeResponse.message); + } throw new Error(`Unable to finalize cache with key ${key}, another job may be finalizing this cache.`); } cacheId = parseInt(finalizeResponse.entryId); @@ -73374,6 +73410,8 @@ var require_cache3 = __commonJS({ throw error2; } else if (typedError.name === ReserveCacheError.name) { core13.info(`Failed to save: ${typedError.message}`); + } else if (typedError.name === FinalizeCacheError.name) { + core13.warning(typedError.message); } else { if (typedError instanceof http_client_1.HttpClientError && typeof typedError.statusCode === "number" && typedError.statusCode >= 500) { core13.error(`Failed to save: ${typedError.message}`); diff --git a/lib/start-proxy-action-post.js b/lib/start-proxy-action-post.js index a09a7b664..8507bab0e 100644 --- a/lib/start-proxy-action-post.js +++ b/lib/start-proxy-action-post.js @@ -26463,7 +26463,7 @@ var require_package = __commonJS({ dependencies: { "@actions/artifact": "^2.3.1", "@actions/artifact-legacy": "npm:@actions/artifact@^1.1.2", - "@actions/cache": "^4.0.5", + "@actions/cache": "^4.1.0", "@actions/core": "^1.11.1", "@actions/exec": "^1.1.1", "@actions/github": "^6.0.0", @@ -67282,7 +67282,7 @@ var require_package2 = __commonJS({ "node_modules/@actions/cache/package.json"(exports2, module2) { module2.exports = { name: "@actions/cache", - version: "4.0.5", + version: "4.1.0", preview: true, description: "Actions cache lib", keywords: [ @@ -72091,11 +72091,18 @@ var require_cache2 = __commonJS({ kind: "scalar", T: 9 /*ScalarType.STRING*/ + }, + { + no: 3, + name: "message", + kind: "scalar", + T: 9 + /*ScalarType.STRING*/ } ]); } create(value) { - const message = { ok: false, signedUploadUrl: "" }; + const message = { ok: false, signedUploadUrl: "", message: "" }; globalThis.Object.defineProperty(message, runtime_4.MESSAGE_TYPE, { enumerable: false, value: this }); if (value !== void 0) (0, runtime_3.reflectionMergePartial)(this, message, value); @@ -72114,6 +72121,10 @@ var require_cache2 = __commonJS({ 2: message.signedUploadUrl = reader.string(); break; + case /* string message */ + 3: + message.message = reader.string(); + break; default: let u = options.readUnknownField; if (u === "throw") @@ -72130,6 +72141,8 @@ var require_cache2 = __commonJS({ writer.tag(1, runtime_1.WireType.Varint).bool(message.ok); if (message.signedUploadUrl !== "") writer.tag(2, runtime_1.WireType.LengthDelimited).string(message.signedUploadUrl); + if (message.message !== "") + writer.tag(3, runtime_1.WireType.LengthDelimited).string(message.message); let u = options.writeUnknownFields; if (u !== false) (u == true ? runtime_2.UnknownFieldHandler.onWrite : u)(this.typeName, message, writer); @@ -72235,11 +72248,18 @@ var require_cache2 = __commonJS({ kind: "scalar", T: 3 /*ScalarType.INT64*/ + }, + { + no: 3, + name: "message", + kind: "scalar", + T: 9 + /*ScalarType.STRING*/ } ]); } create(value) { - const message = { ok: false, entryId: "0" }; + const message = { ok: false, entryId: "0", message: "" }; globalThis.Object.defineProperty(message, runtime_4.MESSAGE_TYPE, { enumerable: false, value: this }); if (value !== void 0) (0, runtime_3.reflectionMergePartial)(this, message, value); @@ -72258,6 +72278,10 @@ var require_cache2 = __commonJS({ 2: message.entryId = reader.int64().toString(); break; + case /* string message */ + 3: + message.message = reader.string(); + break; default: let u = options.readUnknownField; if (u === "throw") @@ -72274,6 +72298,8 @@ var require_cache2 = __commonJS({ writer.tag(1, runtime_1.WireType.Varint).bool(message.ok); if (message.entryId !== "0") writer.tag(2, runtime_1.WireType.Varint).int64(message.entryId); + if (message.message !== "") + writer.tag(3, runtime_1.WireType.LengthDelimited).string(message.message); let u = options.writeUnknownFields; if (u !== false) (u == true ? runtime_2.UnknownFieldHandler.onWrite : u)(this.typeName, message, writer); @@ -73037,7 +73063,7 @@ var require_cache3 = __commonJS({ }); }; Object.defineProperty(exports2, "__esModule", { value: true }); - exports2.saveCache = exports2.restoreCache = exports2.isFeatureAvailable = exports2.ReserveCacheError = exports2.ValidationError = void 0; + exports2.saveCache = exports2.restoreCache = exports2.isFeatureAvailable = exports2.FinalizeCacheError = exports2.ReserveCacheError = exports2.ValidationError = void 0; var core14 = __importStar4(require_core()); var path2 = __importStar4(require("path")); var utils = __importStar4(require_cacheUtils()); @@ -73045,7 +73071,6 @@ var require_cache3 = __commonJS({ var cacheTwirpClient = __importStar4(require_cacheTwirpClient()); var config_1 = require_config(); var tar_1 = require_tar(); - var constants_1 = require_constants7(); var http_client_1 = require_lib(); var ValidationError = class _ValidationError extends Error { constructor(message) { @@ -73063,6 +73088,14 @@ var require_cache3 = __commonJS({ } }; exports2.ReserveCacheError = ReserveCacheError2; + var FinalizeCacheError = class _FinalizeCacheError extends Error { + constructor(message) { + super(message); + this.name = "FinalizeCacheError"; + Object.setPrototypeOf(this, _FinalizeCacheError.prototype); + } + }; + exports2.FinalizeCacheError = FinalizeCacheError; function checkPaths(paths) { if (!paths || paths.length === 0) { throw new ValidationError(`Path Validation Error: At least one directory or file path is required`); @@ -73334,9 +73367,6 @@ var require_cache3 = __commonJS({ } const archiveFileSize = utils.getArchiveFileSizeInBytes(archivePath); core14.debug(`File Size: ${archiveFileSize}`); - if (archiveFileSize > constants_1.CacheFileSizeLimit && !(0, config_1.isGhes)()) { - throw new Error(`Cache size of ~${Math.round(archiveFileSize / (1024 * 1024))} MB (${archiveFileSize} B) is over the 10GB limit, not saving cache.`); - } options.archiveSizeBytes = archiveFileSize; core14.debug("Reserving Cache"); const version = utils.getCacheVersion(paths, compressionMethod, enableCrossOsArchive); @@ -73348,7 +73378,10 @@ var require_cache3 = __commonJS({ try { const response = yield twirpClient.CreateCacheEntry(request); if (!response.ok) { - throw new Error("Response was not ok"); + if (response.message) { + core14.warning(`Cache reservation failed: ${response.message}`); + } + throw new Error(response.message || "Response was not ok"); } signedUploadUrl = response.signedUploadUrl; } catch (error2) { @@ -73365,6 +73398,9 @@ var require_cache3 = __commonJS({ const finalizeResponse = yield twirpClient.FinalizeCacheEntryUpload(finalizeRequest); core14.debug(`FinalizeCacheEntryUploadResponse: ${finalizeResponse.ok}`); if (!finalizeResponse.ok) { + if (finalizeResponse.message) { + throw new FinalizeCacheError(finalizeResponse.message); + } throw new Error(`Unable to finalize cache with key ${key}, another job may be finalizing this cache.`); } cacheId = parseInt(finalizeResponse.entryId); @@ -73374,6 +73410,8 @@ var require_cache3 = __commonJS({ throw error2; } else if (typedError.name === ReserveCacheError2.name) { core14.info(`Failed to save: ${typedError.message}`); + } else if (typedError.name === FinalizeCacheError.name) { + core14.warning(typedError.message); } else { if (typedError instanceof http_client_1.HttpClientError && typeof typedError.statusCode === "number" && typedError.statusCode >= 500) { core14.error(`Failed to save: ${typedError.message}`); diff --git a/lib/start-proxy-action.js b/lib/start-proxy-action.js index 98ec2e533..236373615 100644 --- a/lib/start-proxy-action.js +++ b/lib/start-proxy-action.js @@ -44991,7 +44991,7 @@ var require_package = __commonJS({ dependencies: { "@actions/artifact": "^2.3.1", "@actions/artifact-legacy": "npm:@actions/artifact@^1.1.2", - "@actions/cache": "^4.0.5", + "@actions/cache": "^4.1.0", "@actions/core": "^1.11.1", "@actions/exec": "^1.1.1", "@actions/github": "^6.0.0", diff --git a/lib/upload-lib.js b/lib/upload-lib.js index d644a7ed4..e44738503 100644 --- a/lib/upload-lib.js +++ b/lib/upload-lib.js @@ -33609,7 +33609,7 @@ var require_package = __commonJS({ dependencies: { "@actions/artifact": "^2.3.1", "@actions/artifact-legacy": "npm:@actions/artifact@^1.1.2", - "@actions/cache": "^4.0.5", + "@actions/cache": "^4.1.0", "@actions/core": "^1.11.1", "@actions/exec": "^1.1.1", "@actions/github": "^6.0.0", @@ -74428,7 +74428,7 @@ var require_package2 = __commonJS({ "node_modules/@actions/cache/package.json"(exports2, module2) { module2.exports = { name: "@actions/cache", - version: "4.0.5", + version: "4.1.0", preview: true, description: "Actions cache lib", keywords: [ @@ -79237,11 +79237,18 @@ var require_cache2 = __commonJS({ kind: "scalar", T: 9 /*ScalarType.STRING*/ + }, + { + no: 3, + name: "message", + kind: "scalar", + T: 9 + /*ScalarType.STRING*/ } ]); } create(value) { - const message = { ok: false, signedUploadUrl: "" }; + const message = { ok: false, signedUploadUrl: "", message: "" }; globalThis.Object.defineProperty(message, runtime_4.MESSAGE_TYPE, { enumerable: false, value: this }); if (value !== void 0) (0, runtime_3.reflectionMergePartial)(this, message, value); @@ -79260,6 +79267,10 @@ var require_cache2 = __commonJS({ 2: message.signedUploadUrl = reader.string(); break; + case /* string message */ + 3: + message.message = reader.string(); + break; default: let u = options.readUnknownField; if (u === "throw") @@ -79276,6 +79287,8 @@ var require_cache2 = __commonJS({ writer.tag(1, runtime_1.WireType.Varint).bool(message.ok); if (message.signedUploadUrl !== "") writer.tag(2, runtime_1.WireType.LengthDelimited).string(message.signedUploadUrl); + if (message.message !== "") + writer.tag(3, runtime_1.WireType.LengthDelimited).string(message.message); let u = options.writeUnknownFields; if (u !== false) (u == true ? runtime_2.UnknownFieldHandler.onWrite : u)(this.typeName, message, writer); @@ -79381,11 +79394,18 @@ var require_cache2 = __commonJS({ kind: "scalar", T: 3 /*ScalarType.INT64*/ + }, + { + no: 3, + name: "message", + kind: "scalar", + T: 9 + /*ScalarType.STRING*/ } ]); } create(value) { - const message = { ok: false, entryId: "0" }; + const message = { ok: false, entryId: "0", message: "" }; globalThis.Object.defineProperty(message, runtime_4.MESSAGE_TYPE, { enumerable: false, value: this }); if (value !== void 0) (0, runtime_3.reflectionMergePartial)(this, message, value); @@ -79404,6 +79424,10 @@ var require_cache2 = __commonJS({ 2: message.entryId = reader.int64().toString(); break; + case /* string message */ + 3: + message.message = reader.string(); + break; default: let u = options.readUnknownField; if (u === "throw") @@ -79420,6 +79444,8 @@ var require_cache2 = __commonJS({ writer.tag(1, runtime_1.WireType.Varint).bool(message.ok); if (message.entryId !== "0") writer.tag(2, runtime_1.WireType.Varint).int64(message.entryId); + if (message.message !== "") + writer.tag(3, runtime_1.WireType.LengthDelimited).string(message.message); let u = options.writeUnknownFields; if (u !== false) (u == true ? runtime_2.UnknownFieldHandler.onWrite : u)(this.typeName, message, writer); @@ -80183,7 +80209,7 @@ var require_cache3 = __commonJS({ }); }; Object.defineProperty(exports2, "__esModule", { value: true }); - exports2.saveCache = exports2.restoreCache = exports2.isFeatureAvailable = exports2.ReserveCacheError = exports2.ValidationError = void 0; + exports2.saveCache = exports2.restoreCache = exports2.isFeatureAvailable = exports2.FinalizeCacheError = exports2.ReserveCacheError = exports2.ValidationError = void 0; var core12 = __importStar4(require_core()); var path15 = __importStar4(require("path")); var utils = __importStar4(require_cacheUtils()); @@ -80191,7 +80217,6 @@ var require_cache3 = __commonJS({ var cacheTwirpClient = __importStar4(require_cacheTwirpClient()); var config_1 = require_config(); var tar_1 = require_tar(); - var constants_1 = require_constants10(); var http_client_1 = require_lib(); var ValidationError = class _ValidationError extends Error { constructor(message) { @@ -80209,6 +80234,14 @@ var require_cache3 = __commonJS({ } }; exports2.ReserveCacheError = ReserveCacheError; + var FinalizeCacheError = class _FinalizeCacheError extends Error { + constructor(message) { + super(message); + this.name = "FinalizeCacheError"; + Object.setPrototypeOf(this, _FinalizeCacheError.prototype); + } + }; + exports2.FinalizeCacheError = FinalizeCacheError; function checkPaths(paths) { if (!paths || paths.length === 0) { throw new ValidationError(`Path Validation Error: At least one directory or file path is required`); @@ -80480,9 +80513,6 @@ var require_cache3 = __commonJS({ } const archiveFileSize = utils.getArchiveFileSizeInBytes(archivePath); core12.debug(`File Size: ${archiveFileSize}`); - if (archiveFileSize > constants_1.CacheFileSizeLimit && !(0, config_1.isGhes)()) { - throw new Error(`Cache size of ~${Math.round(archiveFileSize / (1024 * 1024))} MB (${archiveFileSize} B) is over the 10GB limit, not saving cache.`); - } options.archiveSizeBytes = archiveFileSize; core12.debug("Reserving Cache"); const version = utils.getCacheVersion(paths, compressionMethod, enableCrossOsArchive); @@ -80494,7 +80524,10 @@ var require_cache3 = __commonJS({ try { const response = yield twirpClient.CreateCacheEntry(request); if (!response.ok) { - throw new Error("Response was not ok"); + if (response.message) { + core12.warning(`Cache reservation failed: ${response.message}`); + } + throw new Error(response.message || "Response was not ok"); } signedUploadUrl = response.signedUploadUrl; } catch (error2) { @@ -80511,6 +80544,9 @@ var require_cache3 = __commonJS({ const finalizeResponse = yield twirpClient.FinalizeCacheEntryUpload(finalizeRequest); core12.debug(`FinalizeCacheEntryUploadResponse: ${finalizeResponse.ok}`); if (!finalizeResponse.ok) { + if (finalizeResponse.message) { + throw new FinalizeCacheError(finalizeResponse.message); + } throw new Error(`Unable to finalize cache with key ${key}, another job may be finalizing this cache.`); } cacheId = parseInt(finalizeResponse.entryId); @@ -80520,6 +80556,8 @@ var require_cache3 = __commonJS({ throw error2; } else if (typedError.name === ReserveCacheError.name) { core12.info(`Failed to save: ${typedError.message}`); + } else if (typedError.name === FinalizeCacheError.name) { + core12.warning(typedError.message); } else { if (typedError instanceof http_client_1.HttpClientError && typeof typedError.statusCode === "number" && typedError.statusCode >= 500) { core12.error(`Failed to save: ${typedError.message}`); diff --git a/lib/upload-sarif-action-post.js b/lib/upload-sarif-action-post.js index 01c92d982..95ddd5307 100644 --- a/lib/upload-sarif-action-post.js +++ b/lib/upload-sarif-action-post.js @@ -26463,7 +26463,7 @@ var require_package = __commonJS({ dependencies: { "@actions/artifact": "^2.3.1", "@actions/artifact-legacy": "npm:@actions/artifact@^1.1.2", - "@actions/cache": "^4.0.5", + "@actions/cache": "^4.1.0", "@actions/core": "^1.11.1", "@actions/exec": "^1.1.1", "@actions/github": "^6.0.0", @@ -109984,7 +109984,7 @@ var require_package3 = __commonJS({ "node_modules/@actions/cache/package.json"(exports2, module2) { module2.exports = { name: "@actions/cache", - version: "4.0.5", + version: "4.1.0", preview: true, description: "Actions cache lib", keywords: [ @@ -110567,11 +110567,18 @@ var require_cache2 = __commonJS({ kind: "scalar", T: 9 /*ScalarType.STRING*/ + }, + { + no: 3, + name: "message", + kind: "scalar", + T: 9 + /*ScalarType.STRING*/ } ]); } create(value) { - const message = { ok: false, signedUploadUrl: "" }; + const message = { ok: false, signedUploadUrl: "", message: "" }; globalThis.Object.defineProperty(message, runtime_4.MESSAGE_TYPE, { enumerable: false, value: this }); if (value !== void 0) (0, runtime_3.reflectionMergePartial)(this, message, value); @@ -110590,6 +110597,10 @@ var require_cache2 = __commonJS({ 2: message.signedUploadUrl = reader.string(); break; + case /* string message */ + 3: + message.message = reader.string(); + break; default: let u = options.readUnknownField; if (u === "throw") @@ -110606,6 +110617,8 @@ var require_cache2 = __commonJS({ writer.tag(1, runtime_1.WireType.Varint).bool(message.ok); if (message.signedUploadUrl !== "") writer.tag(2, runtime_1.WireType.LengthDelimited).string(message.signedUploadUrl); + if (message.message !== "") + writer.tag(3, runtime_1.WireType.LengthDelimited).string(message.message); let u = options.writeUnknownFields; if (u !== false) (u == true ? runtime_2.UnknownFieldHandler.onWrite : u)(this.typeName, message, writer); @@ -110711,11 +110724,18 @@ var require_cache2 = __commonJS({ kind: "scalar", T: 3 /*ScalarType.INT64*/ + }, + { + no: 3, + name: "message", + kind: "scalar", + T: 9 + /*ScalarType.STRING*/ } ]); } create(value) { - const message = { ok: false, entryId: "0" }; + const message = { ok: false, entryId: "0", message: "" }; globalThis.Object.defineProperty(message, runtime_4.MESSAGE_TYPE, { enumerable: false, value: this }); if (value !== void 0) (0, runtime_3.reflectionMergePartial)(this, message, value); @@ -110734,6 +110754,10 @@ var require_cache2 = __commonJS({ 2: message.entryId = reader.int64().toString(); break; + case /* string message */ + 3: + message.message = reader.string(); + break; default: let u = options.readUnknownField; if (u === "throw") @@ -110750,6 +110774,8 @@ var require_cache2 = __commonJS({ writer.tag(1, runtime_1.WireType.Varint).bool(message.ok); if (message.entryId !== "0") writer.tag(2, runtime_1.WireType.Varint).int64(message.entryId); + if (message.message !== "") + writer.tag(3, runtime_1.WireType.LengthDelimited).string(message.message); let u = options.writeUnknownFields; if (u !== false) (u == true ? runtime_2.UnknownFieldHandler.onWrite : u)(this.typeName, message, writer); @@ -111513,7 +111539,7 @@ var require_cache3 = __commonJS({ }); }; Object.defineProperty(exports2, "__esModule", { value: true }); - exports2.saveCache = exports2.restoreCache = exports2.isFeatureAvailable = exports2.ReserveCacheError = exports2.ValidationError = void 0; + exports2.saveCache = exports2.restoreCache = exports2.isFeatureAvailable = exports2.FinalizeCacheError = exports2.ReserveCacheError = exports2.ValidationError = void 0; var core14 = __importStar4(require_core()); var path2 = __importStar4(require("path")); var utils = __importStar4(require_cacheUtils()); @@ -111521,7 +111547,6 @@ var require_cache3 = __commonJS({ var cacheTwirpClient = __importStar4(require_cacheTwirpClient()); var config_1 = require_config2(); var tar_1 = require_tar2(); - var constants_1 = require_constants10(); var http_client_1 = require_lib(); var ValidationError = class _ValidationError extends Error { constructor(message) { @@ -111539,6 +111564,14 @@ var require_cache3 = __commonJS({ } }; exports2.ReserveCacheError = ReserveCacheError2; + var FinalizeCacheError = class _FinalizeCacheError extends Error { + constructor(message) { + super(message); + this.name = "FinalizeCacheError"; + Object.setPrototypeOf(this, _FinalizeCacheError.prototype); + } + }; + exports2.FinalizeCacheError = FinalizeCacheError; function checkPaths(paths) { if (!paths || paths.length === 0) { throw new ValidationError(`Path Validation Error: At least one directory or file path is required`); @@ -111810,9 +111843,6 @@ var require_cache3 = __commonJS({ } const archiveFileSize = utils.getArchiveFileSizeInBytes(archivePath); core14.debug(`File Size: ${archiveFileSize}`); - if (archiveFileSize > constants_1.CacheFileSizeLimit && !(0, config_1.isGhes)()) { - throw new Error(`Cache size of ~${Math.round(archiveFileSize / (1024 * 1024))} MB (${archiveFileSize} B) is over the 10GB limit, not saving cache.`); - } options.archiveSizeBytes = archiveFileSize; core14.debug("Reserving Cache"); const version = utils.getCacheVersion(paths, compressionMethod, enableCrossOsArchive); @@ -111824,7 +111854,10 @@ var require_cache3 = __commonJS({ try { const response = yield twirpClient.CreateCacheEntry(request); if (!response.ok) { - throw new Error("Response was not ok"); + if (response.message) { + core14.warning(`Cache reservation failed: ${response.message}`); + } + throw new Error(response.message || "Response was not ok"); } signedUploadUrl = response.signedUploadUrl; } catch (error2) { @@ -111841,6 +111874,9 @@ var require_cache3 = __commonJS({ const finalizeResponse = yield twirpClient.FinalizeCacheEntryUpload(finalizeRequest); core14.debug(`FinalizeCacheEntryUploadResponse: ${finalizeResponse.ok}`); if (!finalizeResponse.ok) { + if (finalizeResponse.message) { + throw new FinalizeCacheError(finalizeResponse.message); + } throw new Error(`Unable to finalize cache with key ${key}, another job may be finalizing this cache.`); } cacheId = parseInt(finalizeResponse.entryId); @@ -111850,6 +111886,8 @@ var require_cache3 = __commonJS({ throw error2; } else if (typedError.name === ReserveCacheError2.name) { core14.info(`Failed to save: ${typedError.message}`); + } else if (typedError.name === FinalizeCacheError.name) { + core14.warning(typedError.message); } else { if (typedError instanceof http_client_1.HttpClientError && typeof typedError.statusCode === "number" && typedError.statusCode >= 500) { core14.error(`Failed to save: ${typedError.message}`); diff --git a/lib/upload-sarif-action.js b/lib/upload-sarif-action.js index c3ded2faa..a08877c14 100644 --- a/lib/upload-sarif-action.js +++ b/lib/upload-sarif-action.js @@ -32312,7 +32312,7 @@ var require_package = __commonJS({ dependencies: { "@actions/artifact": "^2.3.1", "@actions/artifact-legacy": "npm:@actions/artifact@^1.1.2", - "@actions/cache": "^4.0.5", + "@actions/cache": "^4.1.0", "@actions/core": "^1.11.1", "@actions/exec": "^1.1.1", "@actions/github": "^6.0.0", @@ -73131,7 +73131,7 @@ var require_package2 = __commonJS({ "node_modules/@actions/cache/package.json"(exports2, module2) { module2.exports = { name: "@actions/cache", - version: "4.0.5", + version: "4.1.0", preview: true, description: "Actions cache lib", keywords: [ @@ -77940,11 +77940,18 @@ var require_cache2 = __commonJS({ kind: "scalar", T: 9 /*ScalarType.STRING*/ + }, + { + no: 3, + name: "message", + kind: "scalar", + T: 9 + /*ScalarType.STRING*/ } ]); } create(value) { - const message = { ok: false, signedUploadUrl: "" }; + const message = { ok: false, signedUploadUrl: "", message: "" }; globalThis.Object.defineProperty(message, runtime_4.MESSAGE_TYPE, { enumerable: false, value: this }); if (value !== void 0) (0, runtime_3.reflectionMergePartial)(this, message, value); @@ -77963,6 +77970,10 @@ var require_cache2 = __commonJS({ 2: message.signedUploadUrl = reader.string(); break; + case /* string message */ + 3: + message.message = reader.string(); + break; default: let u = options.readUnknownField; if (u === "throw") @@ -77979,6 +77990,8 @@ var require_cache2 = __commonJS({ writer.tag(1, runtime_1.WireType.Varint).bool(message.ok); if (message.signedUploadUrl !== "") writer.tag(2, runtime_1.WireType.LengthDelimited).string(message.signedUploadUrl); + if (message.message !== "") + writer.tag(3, runtime_1.WireType.LengthDelimited).string(message.message); let u = options.writeUnknownFields; if (u !== false) (u == true ? runtime_2.UnknownFieldHandler.onWrite : u)(this.typeName, message, writer); @@ -78084,11 +78097,18 @@ var require_cache2 = __commonJS({ kind: "scalar", T: 3 /*ScalarType.INT64*/ + }, + { + no: 3, + name: "message", + kind: "scalar", + T: 9 + /*ScalarType.STRING*/ } ]); } create(value) { - const message = { ok: false, entryId: "0" }; + const message = { ok: false, entryId: "0", message: "" }; globalThis.Object.defineProperty(message, runtime_4.MESSAGE_TYPE, { enumerable: false, value: this }); if (value !== void 0) (0, runtime_3.reflectionMergePartial)(this, message, value); @@ -78107,6 +78127,10 @@ var require_cache2 = __commonJS({ 2: message.entryId = reader.int64().toString(); break; + case /* string message */ + 3: + message.message = reader.string(); + break; default: let u = options.readUnknownField; if (u === "throw") @@ -78123,6 +78147,8 @@ var require_cache2 = __commonJS({ writer.tag(1, runtime_1.WireType.Varint).bool(message.ok); if (message.entryId !== "0") writer.tag(2, runtime_1.WireType.Varint).int64(message.entryId); + if (message.message !== "") + writer.tag(3, runtime_1.WireType.LengthDelimited).string(message.message); let u = options.writeUnknownFields; if (u !== false) (u == true ? runtime_2.UnknownFieldHandler.onWrite : u)(this.typeName, message, writer); @@ -78886,7 +78912,7 @@ var require_cache3 = __commonJS({ }); }; Object.defineProperty(exports2, "__esModule", { value: true }); - exports2.saveCache = exports2.restoreCache = exports2.isFeatureAvailable = exports2.ReserveCacheError = exports2.ValidationError = void 0; + exports2.saveCache = exports2.restoreCache = exports2.isFeatureAvailable = exports2.FinalizeCacheError = exports2.ReserveCacheError = exports2.ValidationError = void 0; var core14 = __importStar4(require_core()); var path16 = __importStar4(require("path")); var utils = __importStar4(require_cacheUtils()); @@ -78894,7 +78920,6 @@ var require_cache3 = __commonJS({ var cacheTwirpClient = __importStar4(require_cacheTwirpClient()); var config_1 = require_config(); var tar_1 = require_tar(); - var constants_1 = require_constants10(); var http_client_1 = require_lib(); var ValidationError = class _ValidationError extends Error { constructor(message) { @@ -78912,6 +78937,14 @@ var require_cache3 = __commonJS({ } }; exports2.ReserveCacheError = ReserveCacheError; + var FinalizeCacheError = class _FinalizeCacheError extends Error { + constructor(message) { + super(message); + this.name = "FinalizeCacheError"; + Object.setPrototypeOf(this, _FinalizeCacheError.prototype); + } + }; + exports2.FinalizeCacheError = FinalizeCacheError; function checkPaths(paths) { if (!paths || paths.length === 0) { throw new ValidationError(`Path Validation Error: At least one directory or file path is required`); @@ -79183,9 +79216,6 @@ var require_cache3 = __commonJS({ } const archiveFileSize = utils.getArchiveFileSizeInBytes(archivePath); core14.debug(`File Size: ${archiveFileSize}`); - if (archiveFileSize > constants_1.CacheFileSizeLimit && !(0, config_1.isGhes)()) { - throw new Error(`Cache size of ~${Math.round(archiveFileSize / (1024 * 1024))} MB (${archiveFileSize} B) is over the 10GB limit, not saving cache.`); - } options.archiveSizeBytes = archiveFileSize; core14.debug("Reserving Cache"); const version = utils.getCacheVersion(paths, compressionMethod, enableCrossOsArchive); @@ -79197,7 +79227,10 @@ var require_cache3 = __commonJS({ try { const response = yield twirpClient.CreateCacheEntry(request); if (!response.ok) { - throw new Error("Response was not ok"); + if (response.message) { + core14.warning(`Cache reservation failed: ${response.message}`); + } + throw new Error(response.message || "Response was not ok"); } signedUploadUrl = response.signedUploadUrl; } catch (error2) { @@ -79214,6 +79247,9 @@ var require_cache3 = __commonJS({ const finalizeResponse = yield twirpClient.FinalizeCacheEntryUpload(finalizeRequest); core14.debug(`FinalizeCacheEntryUploadResponse: ${finalizeResponse.ok}`); if (!finalizeResponse.ok) { + if (finalizeResponse.message) { + throw new FinalizeCacheError(finalizeResponse.message); + } throw new Error(`Unable to finalize cache with key ${key}, another job may be finalizing this cache.`); } cacheId = parseInt(finalizeResponse.entryId); @@ -79223,6 +79259,8 @@ var require_cache3 = __commonJS({ throw error2; } else if (typedError.name === ReserveCacheError.name) { core14.info(`Failed to save: ${typedError.message}`); + } else if (typedError.name === FinalizeCacheError.name) { + core14.warning(typedError.message); } else { if (typedError instanceof http_client_1.HttpClientError && typeof typedError.statusCode === "number" && typedError.statusCode >= 500) { core14.error(`Failed to save: ${typedError.message}`); From 6ccec2ac145855dc9503368583b43c58419687af Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Wed, 24 Sep 2025 18:54:49 +0100 Subject: [PATCH 48/53] Remove `url` from log messages --- lib/analyze-action.js | 4 ++-- lib/init-action-post.js | 4 ++-- lib/init-action.js | 4 ++-- lib/start-proxy-action.js | 4 ++-- lib/upload-lib.js | 4 ++-- lib/upload-sarif-action.js | 4 ++-- src/api-client.ts | 4 ++-- 7 files changed, 14 insertions(+), 14 deletions(-) diff --git a/lib/analyze-action.js b/lib/analyze-action.js index cb366248c..1f1f3c853 100644 --- a/lib/analyze-action.js +++ b/lib/analyze-action.js @@ -90200,10 +90200,10 @@ function getApiClient() { } function getAuthorizationHeaderFor(logger, apiDetails, url2) { if (url2.startsWith(`${apiDetails.url}/`) || apiDetails.apiURL && url2.startsWith(`${apiDetails.apiURL}/`)) { - logger.debug(`Providing an authorization token for '${url2}'.`); + logger.debug(`Providing an authorization token.`); return `token ${apiDetails.auth}`; } - logger.debug(`Requesting '${url2}' without an authorization token.`); + logger.debug(`Not using an authorization token.`); return void 0; } var cachedGitHubVersion = void 0; diff --git a/lib/init-action-post.js b/lib/init-action-post.js index 6bd6b0666..7a7ce67f6 100644 --- a/lib/init-action-post.js +++ b/lib/init-action-post.js @@ -128419,10 +128419,10 @@ function getApiClient() { } function getAuthorizationHeaderFor(logger, apiDetails, url2) { if (url2.startsWith(`${apiDetails.url}/`) || apiDetails.apiURL && url2.startsWith(`${apiDetails.apiURL}/`)) { - logger.debug(`Providing an authorization token for '${url2}'.`); + logger.debug(`Providing an authorization token.`); return `token ${apiDetails.auth}`; } - logger.debug(`Requesting '${url2}' without an authorization token.`); + logger.debug(`Not using an authorization token.`); return void 0; } var cachedGitHubVersion = void 0; diff --git a/lib/init-action.js b/lib/init-action.js index 275814297..1ebc7eaa3 100644 --- a/lib/init-action.js +++ b/lib/init-action.js @@ -86055,10 +86055,10 @@ function getApiClientWithExternalAuth(apiDetails) { } function getAuthorizationHeaderFor(logger, apiDetails, url) { if (url.startsWith(`${apiDetails.url}/`) || apiDetails.apiURL && url.startsWith(`${apiDetails.apiURL}/`)) { - logger.debug(`Providing an authorization token for '${url}'.`); + logger.debug(`Providing an authorization token.`); return `token ${apiDetails.auth}`; } - logger.debug(`Requesting '${url}' without an authorization token.`); + logger.debug(`Not using an authorization token.`); return void 0; } var cachedGitHubVersion = void 0; diff --git a/lib/start-proxy-action.js b/lib/start-proxy-action.js index cdd24f132..87f808a68 100644 --- a/lib/start-proxy-action.js +++ b/lib/start-proxy-action.js @@ -49384,10 +49384,10 @@ function getApiClient() { } function getAuthorizationHeaderFor(logger, apiDetails, url) { if (url.startsWith(`${apiDetails.url}/`) || apiDetails.apiURL && url.startsWith(`${apiDetails.apiURL}/`)) { - logger.debug(`Providing an authorization token for '${url}'.`); + logger.debug(`Providing an authorization token.`); return `token ${apiDetails.auth}`; } - logger.debug(`Requesting '${url}' without an authorization token.`); + logger.debug(`Not using an authorization token.`); return void 0; } diff --git a/lib/upload-lib.js b/lib/upload-lib.js index 098e658da..dee977055 100644 --- a/lib/upload-lib.js +++ b/lib/upload-lib.js @@ -88546,10 +88546,10 @@ function getApiClient() { } function getAuthorizationHeaderFor(logger, apiDetails, url2) { if (url2.startsWith(`${apiDetails.url}/`) || apiDetails.apiURL && url2.startsWith(`${apiDetails.apiURL}/`)) { - logger.debug(`Providing an authorization token for '${url2}'.`); + logger.debug(`Providing an authorization token.`); return `token ${apiDetails.auth}`; } - logger.debug(`Requesting '${url2}' without an authorization token.`); + logger.debug(`Not using an authorization token.`); return void 0; } var cachedGitHubVersion = void 0; diff --git a/lib/upload-sarif-action.js b/lib/upload-sarif-action.js index fe51a2785..abec389a6 100644 --- a/lib/upload-sarif-action.js +++ b/lib/upload-sarif-action.js @@ -88798,10 +88798,10 @@ function getApiClient() { } function getAuthorizationHeaderFor(logger, apiDetails, url2) { if (url2.startsWith(`${apiDetails.url}/`) || apiDetails.apiURL && url2.startsWith(`${apiDetails.apiURL}/`)) { - logger.debug(`Providing an authorization token for '${url2}'.`); + logger.debug(`Providing an authorization token.`); return `token ${apiDetails.auth}`; } - logger.debug(`Requesting '${url2}' without an authorization token.`); + logger.debug(`Not using an authorization token.`); return void 0; } var cachedGitHubVersion = void 0; diff --git a/src/api-client.ts b/src/api-client.ts index 3ab3db47f..86134b7f8 100644 --- a/src/api-client.ts +++ b/src/api-client.ts @@ -95,11 +95,11 @@ export function getAuthorizationHeaderFor( url.startsWith(`${apiDetails.url}/`) || (apiDetails.apiURL && url.startsWith(`${apiDetails.apiURL}/`)) ) { - logger.debug(`Providing an authorization token for '${url}'.`); + logger.debug(`Providing an authorization token.`); return `token ${apiDetails.auth}`; } - logger.debug(`Requesting '${url}' without an authorization token.`); + logger.debug(`Not using an authorization token.`); return undefined; } From 1e725567143ebc7888f891e70a71aab18d8d126c Mon Sep 17 00:00:00 2001 From: Chuan-kai Lin Date: Wed, 24 Sep 2025 11:10:24 -0700 Subject: [PATCH 49/53] build: use --serial in 'just test_file' Some tests require the --serial flag to pass. --- justfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/justfile b/justfile index f146ed9b4..c951b4b06 100644 --- a/justfile +++ b/justfile @@ -22,7 +22,7 @@ test: build # Run the tests for a single file test_file filename: build - npx ava --verbose {{filename}} + npx ava --serial --verbose {{filename}} [doc("Refresh the .js build artefacts in the lib directory")] [confirm] From 333a6738095d79d08551002eec9df209a4c120d7 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Thu, 25 Sep 2025 09:54:23 +0000 Subject: [PATCH 50/53] Update changelog for v3.30.4 --- CHANGELOG.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 3c84102a4..c9e4e8a18 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,7 +2,7 @@ See the [releases page](https://github.com/github/codeql-action/releases) for the relevant changes to the CodeQL CLI and language packs. -## [UNRELEASED] +## 3.30.4 - 25 Sep 2025 - We have improved the CodeQL Action's ability to validate that the workflow it is used in does not use different versions of the CodeQL Action for different workflow steps. Mixing different versions of the CodeQL Action in the same workflow is unsupported and can lead to unpredictable results. A warning will now be emitted from the `codeql-action/init` step if different versions of the CodeQL Action are detected in the workflow file. Additionally, an error will now be thrown by the other CodeQL Action steps if they load a configuration file that was generated by a different version of the `codeql-action/init` step. [#3099](https://github.com/github/codeql-action/pull/3099) and [#3100](https://github.com/github/codeql-action/pull/3100) - We added support for reducing the size of dependency caches for Java analyses, which will reduce cache usage and speed up workflows. This will be enabled automatically at a later time. [#3107](https://github.com/github/codeql-action/pull/3107) From 0a3e31778d645861be7b47588d40429f308bcf3b Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Thu, 25 Sep 2025 10:19:26 +0000 Subject: [PATCH 51/53] Update changelog and version after v3.30.4 --- CHANGELOG.md | 4 ++++ package-lock.json | 4 ++-- package.json | 2 +- 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index c9e4e8a18..d2e5bd94a 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,10 @@ See the [releases page](https://github.com/github/codeql-action/releases) for the relevant changes to the CodeQL CLI and language packs. +## [UNRELEASED] + +No user facing changes. + ## 3.30.4 - 25 Sep 2025 - We have improved the CodeQL Action's ability to validate that the workflow it is used in does not use different versions of the CodeQL Action for different workflow steps. Mixing different versions of the CodeQL Action in the same workflow is unsupported and can lead to unpredictable results. A warning will now be emitted from the `codeql-action/init` step if different versions of the CodeQL Action are detected in the workflow file. Additionally, an error will now be thrown by the other CodeQL Action steps if they load a configuration file that was generated by a different version of the `codeql-action/init` step. [#3099](https://github.com/github/codeql-action/pull/3099) and [#3100](https://github.com/github/codeql-action/pull/3100) diff --git a/package-lock.json b/package-lock.json index 297449464..b6da79aac 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,12 +1,12 @@ { "name": "codeql", - "version": "3.30.4", + "version": "3.30.5", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "codeql", - "version": "3.30.4", + "version": "3.30.5", "license": "MIT", "dependencies": { "@actions/artifact": "^2.3.1", diff --git a/package.json b/package.json index 96fe4d3aa..8920aacd1 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "codeql", - "version": "3.30.4", + "version": "3.30.5", "private": true, "description": "CodeQL action", "scripts": { From 4d32274da69afda36c1c37b0343e38fa77cb0ece Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Thu, 25 Sep 2025 10:50:17 +0000 Subject: [PATCH 52/53] Rebuild --- lib/analyze-action-post.js | 2 +- lib/analyze-action.js | 2 +- lib/autobuild-action.js | 2 +- lib/init-action-post.js | 2 +- lib/init-action.js | 2 +- lib/resolve-environment-action.js | 2 +- lib/start-proxy-action-post.js | 2 +- lib/start-proxy-action.js | 2 +- lib/upload-lib.js | 2 +- lib/upload-sarif-action-post.js | 2 +- lib/upload-sarif-action.js | 2 +- 11 files changed, 11 insertions(+), 11 deletions(-) diff --git a/lib/analyze-action-post.js b/lib/analyze-action-post.js index 4a0151104..4c38451e8 100644 --- a/lib/analyze-action-post.js +++ b/lib/analyze-action-post.js @@ -26438,7 +26438,7 @@ var require_package = __commonJS({ "package.json"(exports2, module2) { module2.exports = { name: "codeql", - version: "3.30.4", + version: "3.30.5", private: true, description: "CodeQL action", scripts: { diff --git a/lib/analyze-action.js b/lib/analyze-action.js index c7e6b7b1a..4b25ff443 100644 --- a/lib/analyze-action.js +++ b/lib/analyze-action.js @@ -32287,7 +32287,7 @@ var require_package = __commonJS({ "package.json"(exports2, module2) { module2.exports = { name: "codeql", - version: "3.30.4", + version: "3.30.5", private: true, description: "CodeQL action", scripts: { diff --git a/lib/autobuild-action.js b/lib/autobuild-action.js index f6a3cdd90..0ec50725c 100644 --- a/lib/autobuild-action.js +++ b/lib/autobuild-action.js @@ -26438,7 +26438,7 @@ var require_package = __commonJS({ "package.json"(exports2, module2) { module2.exports = { name: "codeql", - version: "3.30.4", + version: "3.30.5", private: true, description: "CodeQL action", scripts: { diff --git a/lib/init-action-post.js b/lib/init-action-post.js index 65dadeb7d..27a7a1682 100644 --- a/lib/init-action-post.js +++ b/lib/init-action-post.js @@ -32287,7 +32287,7 @@ var require_package = __commonJS({ "package.json"(exports2, module2) { module2.exports = { name: "codeql", - version: "3.30.4", + version: "3.30.5", private: true, description: "CodeQL action", scripts: { diff --git a/lib/init-action.js b/lib/init-action.js index e8cd76dc9..5bd9f385a 100644 --- a/lib/init-action.js +++ b/lib/init-action.js @@ -32287,7 +32287,7 @@ var require_package = __commonJS({ "package.json"(exports2, module2) { module2.exports = { name: "codeql", - version: "3.30.4", + version: "3.30.5", private: true, description: "CodeQL action", scripts: { diff --git a/lib/resolve-environment-action.js b/lib/resolve-environment-action.js index f63ac2468..41d3e68bb 100644 --- a/lib/resolve-environment-action.js +++ b/lib/resolve-environment-action.js @@ -26438,7 +26438,7 @@ var require_package = __commonJS({ "package.json"(exports2, module2) { module2.exports = { name: "codeql", - version: "3.30.4", + version: "3.30.5", private: true, description: "CodeQL action", scripts: { diff --git a/lib/start-proxy-action-post.js b/lib/start-proxy-action-post.js index 8507bab0e..484ceb79e 100644 --- a/lib/start-proxy-action-post.js +++ b/lib/start-proxy-action-post.js @@ -26438,7 +26438,7 @@ var require_package = __commonJS({ "package.json"(exports2, module2) { module2.exports = { name: "codeql", - version: "3.30.4", + version: "3.30.5", private: true, description: "CodeQL action", scripts: { diff --git a/lib/start-proxy-action.js b/lib/start-proxy-action.js index 32691c1cc..21508de07 100644 --- a/lib/start-proxy-action.js +++ b/lib/start-proxy-action.js @@ -44966,7 +44966,7 @@ var require_package = __commonJS({ "package.json"(exports2, module2) { module2.exports = { name: "codeql", - version: "3.30.4", + version: "3.30.5", private: true, description: "CodeQL action", scripts: { diff --git a/lib/upload-lib.js b/lib/upload-lib.js index 78ccf503c..934d9c7e5 100644 --- a/lib/upload-lib.js +++ b/lib/upload-lib.js @@ -33584,7 +33584,7 @@ var require_package = __commonJS({ "package.json"(exports2, module2) { module2.exports = { name: "codeql", - version: "3.30.4", + version: "3.30.5", private: true, description: "CodeQL action", scripts: { diff --git a/lib/upload-sarif-action-post.js b/lib/upload-sarif-action-post.js index 95ddd5307..0e1dd2992 100644 --- a/lib/upload-sarif-action-post.js +++ b/lib/upload-sarif-action-post.js @@ -26438,7 +26438,7 @@ var require_package = __commonJS({ "package.json"(exports2, module2) { module2.exports = { name: "codeql", - version: "3.30.4", + version: "3.30.5", private: true, description: "CodeQL action", scripts: { diff --git a/lib/upload-sarif-action.js b/lib/upload-sarif-action.js index 88e26e3ca..5cc12ec1b 100644 --- a/lib/upload-sarif-action.js +++ b/lib/upload-sarif-action.js @@ -32287,7 +32287,7 @@ var require_package = __commonJS({ "package.json"(exports2, module2) { module2.exports = { name: "codeql", - version: "3.30.4", + version: "3.30.5", private: true, description: "CodeQL action", scripts: { From c5ce5e5d1c11324097adc5a2c65c9d8cf97755be Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Thu, 25 Sep 2025 12:12:42 +0100 Subject: [PATCH 53/53] Don't dry-run `rollback-release` workflow on release branches --- .github/workflows/rollback-release.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/rollback-release.yml b/.github/workflows/rollback-release.yml index 937c413f9..8d8e872fa 100644 --- a/.github/workflows/rollback-release.yml +++ b/.github/workflows/rollback-release.yml @@ -10,6 +10,10 @@ on: required: true # Only for dry-runs of changes to the workflow. push: + # Don't run dry-run on release branches, to avoid an issue where the + # "new" tag determined by the "Prepare release" job already exists. + branches-ignore: + - releases/v* paths: - .github/workflows/rollback-release.yml - .github/actions/prepare-mergeback-branch/**