github/codeql-action
1
0
Fork 0
mirror of https://github.com/github/codeql-action.git synced 2026-11-05 20:49:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge remote-tracking branch 'origin/releases/v4' into backport-v3.39.2-1fc58d04a

Browse Source
This commit is contained in:
github-actions[bot]
2026-11-03 10:50:39 +00:00
parent 733fb50a06 1fc58d04a4
commit cbf5ab6130
172 changed files with 19870 additions and 9116 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
.github/actions/prepare-test/action.yml vendored
View File

@@ -6,11 +6,11 @@ inputs:
required: true
use-all-platform-bundle:
description: "If true, we output a tools URL with codeql-bundle.tar.gz file rather than platform-specific URL"
default: 'false'
default: "false"
required: false
setup-kotlin:
description: "If true, we setup kotlin"
default: 'true'
default: "true"
required: true
outputs:
tools-url:
@@ -73,7 +73,10 @@ runs:
exit 1
fi
- uses: fwilhe2/setup-kotlin@9c245a6425255f5e98ba1ce6c15d31fce7eca9da
- uses: fwilhe2/setup-kotlin@b325539ca8f6e1d9ee04efed06f49bdbf5426dbb # v2.1
if: ${{ inputs.setup-kotlin == 'true' }}
with:
version: 1.8.21
# Kotlin is installed on the runners by default, but the version that is pre-installed is too new
# to be supported by CodeQL. This Kotlin version is selected to be compatible with both the default Java
# version on the `ubuntu-latest` runners and CodeQL.
version: 2.1.20

2
.github/actions/release-initialise/action.yml vendored
View File

@@ -16,7 +16,7 @@ runs:
shell: bash
- name: Set up Node
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
with:
node-version: 24
cache: 'npm'

10
.github/dependabot.yml vendored
View File

@@ -16,6 +16,14 @@ updates:
# This might be fixed when we move to eslint v9.
- dependency-name: "eslint-plugin-import"
versions: [">=2.30.0"]
# Some of our dependencies are lagging behind with support for new versions of
# `undici` which is why we have to override it in `package.json`. Dependabot
# workflows fail when they try to update a dependency that is explicitly
# overriden. Since this happens somewhat routinely at the moment, we are
# excluding `undici` here and have to manually update it when needed.
- dependency-name: "undici"
versions: [">=7.30.1"]
groups:
npm-minor:
patterns:
@@ -26,7 +34,7 @@ updates:
- package-ecosystem: github-actions
directories:
- "/.github/workflows"
- "/.github/actions"
- "/.github/actions/*/"
schedule:
interval: weekly
cooldown:

6
.github/workflows/__all-platform-bundle.yml generated vendored
View File

@@ -54,11 +54,11 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: nightly-latest
- os: macos-latest-xlarge
- os: macos-26-xlarge
version: nightly-latest
- os: windows-latest
- os: windows-2025
version: nightly-latest
name: All-platform bundle
if: github.triggering_actor != 'dependabot[bot]'

16
.github/workflows/__analysis-kinds.yml generated vendored
View File

@@ -34,28 +34,28 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
analysis-kinds: code-scanning
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
analysis-kinds: code-quality
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
analysis-kinds: code-scanning,code-quality
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
analysis-kinds: risk-assessment
- os: ubuntu-latest
- os: ubuntu-26.04
version: nightly-latest
analysis-kinds: code-scanning
- os: ubuntu-latest
- os: ubuntu-26.04
version: nightly-latest
analysis-kinds: code-quality
- os: ubuntu-latest
- os: ubuntu-26.04
version: nightly-latest
analysis-kinds: code-scanning,code-quality
- os: ubuntu-latest
- os: ubuntu-26.04
version: nightly-latest
analysis-kinds: risk-assessment
name: Analysis kinds

2
.github/workflows/__analyze-ref-input.yml generated vendored
View File

@@ -54,7 +54,7 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: default
name: "Analyze: 'ref' and 'sha' from inputs"
if: github.triggering_actor != 'dependabot[bot]'

6
.github/workflows/__autobuild-action.yml generated vendored
View File

@@ -44,11 +44,11 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
- os: macos-latest
- os: macos-26
version: linked
- os: windows-latest
- os: windows-2025
version: linked
name: autobuild-action
if: github.triggering_actor != 'dependabot[bot]'

10
.github/workflows/__autobuild-direct-tracing-with-working-dir.yml generated vendored
View File

@@ -44,13 +44,13 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
- os: windows-latest
- os: windows-2025
version: linked
- os: ubuntu-latest
- os: ubuntu-26.04
version: nightly-latest
- os: windows-latest
- os: windows-2025
version: nightly-latest
name: Autobuild direct tracing (custom working directory)
if: github.triggering_actor != 'dependabot[bot]'
@@ -63,7 +63,7 @@ jobs:
- name: Check out repository
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Install Java
uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
with:
java-version: ${{ inputs.java-version || '17' }}
distribution: temurin

2
.github/workflows/__autobuild-working-dir.yml generated vendored
View File

@@ -34,7 +34,7 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
name: Autobuild working directory
if: github.triggering_actor != 'dependabot[bot]'

10
.github/workflows/__build-mode-autobuild.yml generated vendored
View File

@@ -44,13 +44,13 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
- os: windows-latest
- os: windows-2025
version: linked
- os: ubuntu-latest
- os: ubuntu-26.04
version: nightly-latest
- os: windows-latest
- os: windows-2025
version: nightly-latest
name: Build mode autobuild
if: github.triggering_actor != 'dependabot[bot]'
@@ -63,7 +63,7 @@ jobs:
- name: Check out repository
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Install Java
uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
with:
java-version: ${{ inputs.java-version || '17' }}
distribution: temurin

2
.github/workflows/__build-mode-manual.yml generated vendored
View File

@@ -54,7 +54,7 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: nightly-latest
name: Build mode manual
if: github.triggering_actor != 'dependabot[bot]'

4
.github/workflows/__build-mode-none.yml generated vendored
View File

@@ -34,9 +34,9 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
- os: ubuntu-latest
- os: ubuntu-26.04
version: nightly-latest
name: Build mode none
if: github.triggering_actor != 'dependabot[bot]'

2
.github/workflows/__build-mode-rollback.yml generated vendored
View File

@@ -34,7 +34,7 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: nightly-latest
name: Build mode rollback
if: github.triggering_actor != 'dependabot[bot]'

2
.github/workflows/__bundle-from-nightly.yml generated vendored
View File

@@ -34,7 +34,7 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
name: 'Bundle: From nightly'
if: github.triggering_actor != 'dependabot[bot]'

38
.github/workflows/__bundle-from-toolcache.yml generated vendored
View File

@@ -34,7 +34,7 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: toolcache
name: 'Bundle: From toolcache'
if: github.triggering_actor != 'dependabot[bot]'
@@ -46,6 +46,15 @@ jobs:
steps:
- name: Check out repository
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Install Node.js
uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
with:
node-version: 20.x
cache: npm
- name: Install newer npm
run: npm install -g npm@11.19.1
- name: Install dependencies
run: npm ci
- name: Prepare test
id: prepare-test
uses: ./.github/actions/prepare-test
@@ -53,31 +62,20 @@ jobs:
version: ${{ matrix.version }}
use-all-platform-bundle: 'false'
setup-kotlin: 'true'
- name: Install @actions/tool-cache
run: npm install @actions/tool-cache@3
- name: Check toolcache contains CodeQL
continue-on-error: true
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
with:
script: |
const toolcache = require('@actions/tool-cache');
const allCodeqlVersions = toolcache.findAllVersions('CodeQL');
if (allCodeqlVersions.length === 0) {
throw new Error(`CodeQL could not be found in the toolcache`);
}
run: |
cd ./../action
npx tsx ./pr-checks/toolcache.ts installed
- id: setup-codeql
uses: ./../action/setup-codeql
with:
tools: ${{ steps.prepare-test.outputs.tools-url }}
- name: Check CodeQL is installed within the toolcache
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
with:
script: |
const toolcache = require('@actions/tool-cache');
const allCodeqlVersions = toolcache.findAllVersions('CodeQL');
console.log(`Found CodeQL versions: ${allCodeqlVersions}`);
if (allCodeqlVersions.length === 0) {
throw new Error('CodeQL not found in toolcache');
}
run: |
cd ./../action
npx tsx ./pr-checks/toolcache.ts installed
env:
CODEQL_ACTION_TEST_MODE: true

58
.github/workflows/__bundle-toolcache.yml generated vendored
View File

@@ -34,11 +34,11 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
- os: macos-latest
- os: macos-26
version: linked
- os: windows-latest
- os: windows-2025
version: linked
name: 'Bundle: Caching checks'
if: github.triggering_actor != 'dependabot[bot]'
@@ -50,6 +50,15 @@ jobs:
steps:
- name: Check out repository
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Install Node.js
uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
with:
node-version: 20.x
cache: npm
- name: Install newer npm
run: npm install -g npm@11.19.1
- name: Install dependencies
run: npm ci
- name: Prepare test
id: prepare-test
uses: ./.github/actions/prepare-test
@@ -58,47 +67,30 @@ jobs:
use-all-platform-bundle: 'false'
setup-kotlin: 'true'
- name: Remove CodeQL from toolcache
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
with:
script: |
const fs = require('fs');
const path = require('path');
const codeqlPath = path.join(process.env['RUNNER_TOOL_CACHE'], 'CodeQL');
fs.rmdirSync(codeqlPath, { recursive: true });
- name: Install @actions/tool-cache
run: npm install @actions/tool-cache@3
run: |
cd ./../action
npx tsx ./pr-checks/toolcache.ts clear
- name: Check toolcache does not contain CodeQL
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
with:
script: |
const toolcache = require('@actions/tool-cache');
const allCodeqlVersions = toolcache.findAllVersions('CodeQL');
if (allCodeqlVersions.length !== 0) {
throw new Error(`CodeQL should not be found in the toolcache, but found ${allCodeqlVersions}`);
}
console.log('No versions of CodeQL found in the toolcache');
run: |
cd ./../action
npx tsx ./pr-checks/toolcache.ts absent
- id: init
uses: ./../action/init
with:
# Request multiple languages so this check uses the combined bundle.
languages: javascript,python
tools: ${{ steps.prepare-test.outputs.tools-url }}
- uses: ./../action/analyze
with:
output: ${{ runner.temp }}/results
upload-database: false
- name: Check CodeQL is installed within the toolcache
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
with:
script: |
const toolcache = require('@actions/tool-cache');
const allCodeqlVersions = toolcache.findAllVersions('CodeQL');
console.log(`Found CodeQL versions: ${allCodeqlVersions}`);
if (allCodeqlVersions.length === 0) {
throw new Error('CodeQL not found in toolcache');
}
if (allCodeqlVersions.length > 1) {
throw new Error('Multiple CodeQL versions found in toolcache');
}
run: |
cd ./../action
npx tsx ./pr-checks/toolcache.ts installed -n 1
env:
CODEQL_ACTION_TEST_MODE: true

2
.github/workflows/__cleanup-db-cluster-dir.yml generated vendored
View File

@@ -34,7 +34,7 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
name: Clean up database cluster directory
if: github.triggering_actor != 'dependabot[bot]'

4
.github/workflows/__config-export.yml generated vendored
View File

@@ -34,9 +34,9 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
- os: ubuntu-latest
- os: ubuntu-26.04
version: nightly-latest
name: Config export
if: github.triggering_actor != 'dependabot[bot]'

2
.github/workflows/__config-input.yml generated vendored
View File

@@ -34,7 +34,7 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
name: Config input
if: github.triggering_actor != 'dependabot[bot]'

6
.github/workflows/__cpp-deptrace-disabled.yml generated vendored
View File

@@ -34,11 +34,11 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
- os: ubuntu-latest
- os: ubuntu-26.04
version: default
- os: ubuntu-latest
- os: ubuntu-26.04
version: nightly-latest
name: 'C/C++: disabling autoinstalling dependencies (Linux)'
if: github.triggering_actor != 'dependabot[bot]'

4
.github/workflows/__cpp-deptrace-enabled-on-macos.yml generated vendored
View File

@@ -34,9 +34,9 @@ jobs:
fail-fast: false
matrix:
include:
- os: macos-latest
- os: macos-26
version: linked
- os: macos-latest
- os: macos-26
version: nightly-latest
name: 'C/C++: autoinstalling dependencies is skipped (macOS)'
if: github.triggering_actor != 'dependabot[bot]'

6
.github/workflows/__cpp-deptrace-enabled.yml generated vendored
View File

@@ -34,11 +34,11 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
- os: ubuntu-latest
- os: ubuntu-26.04
version: default
- os: ubuntu-latest
- os: ubuntu-26.04
version: nightly-latest
name: 'C/C++: autoinstalling dependencies (Linux)'
if: github.triggering_actor != 'dependabot[bot]'

4
.github/workflows/__diagnostics-export.yml generated vendored
View File

@@ -34,9 +34,9 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
- os: ubuntu-latest
- os: ubuntu-26.04
version: nightly-latest
name: Diagnostic export
if: github.triggering_actor != 'dependabot[bot]'

143
.github/workflows/__diagnostics-without-db.yml generated vendored Normal file
View File

@@ -0,0 +1,143 @@
# Warning: This file is generated automatically, and should not be modified.
# Instead, please modify the template in the pr-checks directory and run:
# pr-checks/sync.sh
# to regenerate this file.
name: PR Check - Diagnostic export without database
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
GO111MODULE: auto
on:
push:
branches:
- main
- releases/v*
pull_request: {}
merge_group:
types:
- checks_requested
schedule:
- cron: '0 5 * * *'
workflow_dispatch:
inputs: {}
workflow_call:
inputs: {}
defaults:
run:
shell: bash
concurrency:
cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
group: diagnostics-without-db-${{github.ref}}
jobs:
diagnostics-without-db:
strategy:
fail-fast: false
matrix:
include:
- os: ubuntu-26.04
version: linked
name: Diagnostic export without database
if: github.triggering_actor != 'dependabot[bot]'
permissions:
contents: read
security-events: read
timeout-minutes: 45
runs-on: ${{ matrix.os }}
steps:
# We deliberately need to make this step fail before the database is initialised, but after
# some diagnostic has been produced. The simplest way to do that right now is to:
#
# - Produce a diagnostic before the db is initialised by forcing the use of a nightly release
# with the `CODEQL_ACTION_FORCE_NIGHTLY` feature flag.
# - Cause `init` to abort because we are attempting to analyse Swift on a non-macOS runner.
#
- name: Check out repository
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Install Node.js
uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
with:
node-version: 20.x
cache: npm
- name: Install newer npm
run: npm install -g npm@11.19.1
- name: Install dependencies
run: npm ci
- name: Prepare test
id: prepare-test
uses: ./.github/actions/prepare-test
with:
version: ${{ matrix.version }}
use-all-platform-bundle: 'false'
setup-kotlin: 'true'
- name: Initialise failing analysis
id: init
uses: ./../action/init
continue-on-error: true
env:
CODEQL_ACTION_FORCE_NIGHTLY: true
with:
languages: swift
tools: ${{ steps.prepare-test.outputs.tools-url }}
- name: Analyze
uses: ./analyze
# In a real workflow, this step wouldn't run. Since we used `continue-on-error`
# above, we manually disable it with an `if` condition. Having this step is required
# for the init post-action because it checks the workflow definition for e.g. the
# `category` input. Without this step, that part of the init post-action would fail.
if: false
with:
category: '/test-codeql-version:${{ matrix.version }}'
- name: Check diagnostics appear on disk
env:
DIAGNOSTICS_DIR: '${{ runner.temp }}/codeql-action-temp-diagnostics/'
run: |
cd ../action
npx tsx ./pr-checks/diagnostics-without-db.ts
env:
CODEQL_ACTION_SKIP_GENERATE_FAILED_SARIF: false
CODEQL_ACTION_SKIP_SARIF_UPLOAD: true
CODEQL_ACTION_TESTING_ENVIRONMENT: codeql-action-pr-checks
CODEQL_ACTION_TEST_MODE: true
diagnostics-without-db-validation:
if: github.triggering_actor != 'dependabot[bot]'
needs:
- diagnostics-without-db
permissions:
contents: read
security-events: read
timeout-minutes: 5
runs-on: ubuntu-26.04
steps:
- name: Check out repository
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Install Node.js
uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
with:
node-version: 20.x
cache: npm
- name: Install newer npm
run: npm install -g npm@11.19.1
- name: Install dependencies
run: npm ci
- name: Download workflow artifact
uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
with:
pattern: test-mode-sarif-*
path: sarif
- name: List artifact contents
run: ls -laR ./sarif
- name: Check diagnostics appear in SARIF
env:
SARIF_PATH: "./sarif/codeql-failed-run.sarif"
DIAGNOSTIC_ID: "codeql-action/forced-nightly-cli"
DIAGNOSTIC_NAME: "A nightly release of CodeQL was used"
EXPECTED_LOCATIONS: "0"
EXPECTED_MESSAGE: |
GitHub configured this analysis to use a nightly release of CodeQL to allow you to preview changes from an upcoming release.
run: npx tsx ./pr-checks/check-diagnostics.ts
env:
CODEQL_ACTION_TEST_MODE: true

12
.github/workflows/__export-file-baseline-information.yml generated vendored
View File

@@ -54,11 +54,11 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: nightly-latest
- os: macos-latest
- os: macos-26
version: nightly-latest
- os: windows-latest
- os: windows-2025
version: nightly-latest
name: Export file baseline information
if: github.triggering_actor != 'dependabot[bot]'
@@ -91,6 +91,11 @@ jobs:
with:
languages: javascript
tools: ${{ steps.prepare-test.outputs.tools-url }}
# To balance speed and coverage, analyze only JavaScript but use the combined bundle so
# baseline information is reported for every language in the multi-language repository. A
# custom configuration prevents per-language bundles from being used.
config: |
paths-ignore: []
- name: Build code
run: ./build.sh
- uses: ./../action/analyze
@@ -124,5 +129,4 @@ jobs:
env:
CODEQL_ACTION_SKIP_FILE_COVERAGE_ON_PRS: false
CODEQL_ACTION_SUBLANGUAGE_FILE_COVERAGE: true
CODEQL_ACTION_PER_LANGUAGE_BUNDLES: false
CODEQL_ACTION_TEST_MODE: true

2
.github/workflows/__extractor-ram-threads.yml generated vendored
View File

@@ -34,7 +34,7 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
name: Extractor ram and threads options test
if: github.triggering_actor != 'dependabot[bot]'

4
.github/workflows/__global-proxy.yml generated vendored
View File

@@ -34,9 +34,9 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
- os: ubuntu-latest
- os: ubuntu-26.04
version: nightly-latest
name: Proxy test
if: github.triggering_actor != 'dependabot[bot]'

4
.github/workflows/__go-custom-queries.yml generated vendored
View File

@@ -54,9 +54,9 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
- os: ubuntu-latest
- os: ubuntu-26.04
version: nightly-latest
name: 'Go: Custom queries'
if: github.triggering_actor != 'dependabot[bot]'

2
.github/workflows/__go-indirect-tracing-workaround-diagnostic.yml generated vendored
View File

@@ -44,7 +44,7 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: default
name: 'Go: diagnostic when Go is changed after init step'
if: github.triggering_actor != 'dependabot[bot]'

2
.github/workflows/__go-indirect-tracing-workaround-no-file-program.yml generated vendored
View File

@@ -44,7 +44,7 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: default
name: 'Go: diagnostic when `file` is not installed'
if: github.triggering_actor != 'dependabot[bot]'

2
.github/workflows/__go-indirect-tracing-workaround.yml generated vendored
View File

@@ -44,7 +44,7 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: default
name: 'Go: workaround for indirect tracing'
if: github.triggering_actor != 'dependabot[bot]'

22
.github/workflows/__go-tracing-autobuilder.yml generated vendored
View File

@@ -44,27 +44,27 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-24.04
version: stable-v2.20.7
- os: ubuntu-latest
- os: ubuntu-26.04
version: stable-v2.21.4
- os: ubuntu-latest
- os: ubuntu-26.04
version: stable-v2.22.4
- os: ubuntu-latest
- os: ubuntu-26.04
version: stable-v2.23.9
- os: ubuntu-latest
- os: ubuntu-26.04
version: stable-v2.24.3
- os: ubuntu-latest
- os: ubuntu-26.04
version: stable-v2.25.6
- os: ubuntu-latest
- os: ubuntu-26.04
version: default
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
- os: macos-latest
- os: macos-26
version: linked
- os: ubuntu-latest
- os: ubuntu-26.04
version: nightly-latest
- os: macos-latest
- os: macos-26
version: nightly-latest
name: 'Go: tracing with autobuilder step'
if: github.triggering_actor != 'dependabot[bot]'

22
.github/workflows/__go-tracing-custom-build-steps.yml generated vendored
View File

@@ -44,27 +44,27 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-24.04
version: stable-v2.20.7
- os: ubuntu-latest
- os: ubuntu-26.04
version: stable-v2.21.4
- os: ubuntu-latest
- os: ubuntu-26.04
version: stable-v2.22.4
- os: ubuntu-latest
- os: ubuntu-26.04
version: stable-v2.23.9
- os: ubuntu-latest
- os: ubuntu-26.04
version: stable-v2.24.3
- os: ubuntu-latest
- os: ubuntu-26.04
version: stable-v2.25.6
- os: ubuntu-latest
- os: ubuntu-26.04
version: default
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
- os: macos-latest
- os: macos-26
version: linked
- os: ubuntu-latest
- os: ubuntu-26.04
version: nightly-latest
- os: macos-latest
- os: macos-26
version: nightly-latest
name: 'Go: tracing with custom build steps'
if: github.triggering_actor != 'dependabot[bot]'

22
.github/workflows/__go-tracing-legacy-workflow.yml generated vendored
View File

@@ -44,27 +44,27 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-24.04
version: stable-v2.20.7
- os: ubuntu-latest
- os: ubuntu-26.04
version: stable-v2.21.4
- os: ubuntu-latest
- os: ubuntu-26.04
version: stable-v2.22.4
- os: ubuntu-latest
- os: ubuntu-26.04
version: stable-v2.23.9
- os: ubuntu-latest
- os: ubuntu-26.04
version: stable-v2.24.3
- os: ubuntu-latest
- os: ubuntu-26.04
version: stable-v2.25.6
- os: ubuntu-latest
- os: ubuntu-26.04
version: default
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
- os: macos-latest
- os: macos-26
version: linked
- os: ubuntu-latest
- os: ubuntu-26.04
version: nightly-latest
- os: macos-latest
- os: macos-26
version: nightly-latest
name: 'Go: tracing with legacy workflow'
if: github.triggering_actor != 'dependabot[bot]'

6
.github/workflows/__init-with-registries.yml generated vendored
View File

@@ -34,11 +34,11 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: default
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
- os: ubuntu-latest
- os: ubuntu-26.04
version: nightly-latest
name: 'Packaging: Download using registries'
if: github.triggering_actor != 'dependabot[bot]'

6
.github/workflows/__javascript-source-root.yml generated vendored
View File

@@ -34,11 +34,11 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
- os: ubuntu-latest
- os: ubuntu-26.04
version: default
- os: ubuntu-latest
- os: ubuntu-26.04
version: nightly-latest
name: Custom source root
if: github.triggering_actor != 'dependabot[bot]'

2
.github/workflows/__job-run-uuid-sarif.yml generated vendored
View File

@@ -34,7 +34,7 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: nightly-latest
name: Job run UUID added to SARIF
if: github.triggering_actor != 'dependabot[bot]'

2
.github/workflows/__language-aliases.yml generated vendored
View File

@@ -34,7 +34,7 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
name: Language aliases
if: github.triggering_actor != 'dependabot[bot]'

2
.github/workflows/__local-bundle.yml generated vendored
View File

@@ -54,7 +54,7 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
name: Local CodeQL bundle
if: github.triggering_actor != 'dependabot[bot]'

32
.github/workflows/__multi-language-autodetect.yml generated vendored
View File

@@ -54,41 +54,41 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-24.04
version: stable-v2.20.7
- os: macos-15-xlarge
version: stable-v2.20.7
- os: ubuntu-latest
- os: ubuntu-26.04
version: stable-v2.21.4
- os: macos-15-xlarge
version: stable-v2.21.4
- os: ubuntu-latest
- os: ubuntu-26.04
version: stable-v2.22.4
- os: macos-15-xlarge
version: stable-v2.22.4
- os: ubuntu-latest
- os: ubuntu-26.04
version: stable-v2.23.9
- os: macos-latest-xlarge
- os: macos-26-xlarge
version: stable-v2.23.9
- os: ubuntu-latest
- os: ubuntu-26.04
version: stable-v2.24.3
- os: macos-latest-xlarge
- os: macos-26-xlarge
version: stable-v2.24.3
- os: ubuntu-latest
- os: ubuntu-26.04
version: stable-v2.25.6
- os: macos-latest-xlarge
- os: macos-26-xlarge
version: stable-v2.25.6
- os: ubuntu-latest
- os: ubuntu-26.04
version: default
- os: macos-latest-xlarge
- os: macos-26-xlarge
version: default
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
- os: macos-latest-xlarge
- os: macos-26-xlarge
version: linked
- os: ubuntu-latest
- os: ubuntu-26.04
version: nightly-latest
- os: macos-latest-xlarge
- os: macos-26-xlarge
version: nightly-latest
name: Multi-language repository
if: github.triggering_actor != 'dependabot[bot]'
@@ -121,7 +121,7 @@ jobs:
# imports `importlib._bootstrap._ERR_MSG`, which those Python versions no longer define.
# See https://github.com/github/codeql-action/pull/3212
if: matrix.version != 'nightly-latest' && matrix.version != 'linked'
uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
with:
python-version: '3.13.15'

4
.github/workflows/__overlay-init-fallback.yml generated vendored
View File

@@ -34,9 +34,9 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
- os: ubuntu-latest
- os: ubuntu-26.04
version: nightly-latest
name: Overlay database init fallback
if: github.triggering_actor != 'dependabot[bot]'

6
.github/workflows/__packaging-codescanning-config-inputs-js.yml generated vendored
View File

@@ -54,11 +54,11 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
- os: ubuntu-latest
- os: ubuntu-26.04
version: default
- os: ubuntu-latest
- os: ubuntu-26.04
version: nightly-latest
name: 'Packaging: Config and input passed to the CLI'
if: github.triggering_actor != 'dependabot[bot]'

6
.github/workflows/__packaging-config-inputs-js.yml generated vendored
View File

@@ -54,11 +54,11 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
- os: ubuntu-latest
- os: ubuntu-26.04
version: default
- os: ubuntu-latest
- os: ubuntu-26.04
version: nightly-latest
name: 'Packaging: Config and input'
if: github.triggering_actor != 'dependabot[bot]'

6
.github/workflows/__packaging-config-js.yml generated vendored
View File

@@ -54,11 +54,11 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
- os: ubuntu-latest
- os: ubuntu-26.04
version: default
- os: ubuntu-latest
- os: ubuntu-26.04
version: nightly-latest
name: 'Packaging: Config file'
if: github.triggering_actor != 'dependabot[bot]'

6
.github/workflows/__packaging-inputs-js.yml generated vendored
View File

@@ -54,11 +54,11 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
- os: ubuntu-latest
- os: ubuntu-26.04
version: default
- os: ubuntu-latest
- os: ubuntu-26.04
version: nightly-latest
name: 'Packaging: Action input'
if: github.triggering_actor != 'dependabot[bot]'

59
.github/workflows/__per-language-bundle-validation.yml generated vendored
View File

@@ -35,41 +35,41 @@ jobs:
matrix:
include:
- language: actions
os: ubuntu-latest
version: nightly-latest
os: ubuntu-26.04
version: linked
expected-extractors: actions javascript
- language: cpp
os: ubuntu-latest
version: nightly-latest
os: ubuntu-26.04
version: linked
build-mode: manual
build-command: gcc -o main main.c
- language: csharp
os: ubuntu-latest
version: nightly-latest
os: ubuntu-26.04
version: linked
build-mode: none
- language: go
os: ubuntu-latest
version: nightly-latest
os: ubuntu-26.04
version: linked
build-mode: autobuild
- language: java
os: ubuntu-latest
version: nightly-latest
os: ubuntu-26.04
version: linked
build-mode: none
- language: javascript
os: ubuntu-latest
version: nightly-latest
os: ubuntu-26.04
version: linked
- language: python
os: ubuntu-latest
version: nightly-latest
os: ubuntu-26.04
version: linked
- language: ruby
os: ubuntu-latest
version: nightly-latest
os: ubuntu-26.04
version: linked
- language: rust
os: ubuntu-latest
version: nightly-latest
os: ubuntu-26.04
version: linked
- language: swift
os: macos-latest-xlarge
version: nightly-latest
os: macos-26-xlarge
version: linked
build-mode: autobuild
name: Per-language bundles
if: github.triggering_actor != 'dependabot[bot]'
@@ -81,6 +81,15 @@ jobs:
steps:
- name: Check out repository
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Install Node.js
uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
with:
node-version: 20.x
cache: npm
- name: Install newer npm
run: npm install -g npm@11.19.1
- name: Install dependencies
run: npm ci
- name: Prepare test
id: prepare-test
uses: ./.github/actions/prepare-test
@@ -88,6 +97,10 @@ jobs:
version: ${{ matrix.version }}
use-all-platform-bundle: 'false'
setup-kotlin: 'true'
- name: Remove CodeQL from toolcache
run: |
cd ./../action
npx tsx ./pr-checks/toolcache.ts clear
- uses: ./../action/init
id: init
with:
@@ -128,9 +141,8 @@ jobs:
CODEQL_PATH: ${{ steps.init.outputs.codeql-path }}
run: |
# A bundle that is missing most of its extractors must never be left in the toolcache,
# where a later job analyzing a different language could pick it up. The runner image
# ships with its own CodeQL in the toolcache, so check where this bundle was extracted to
# rather than whether the toolcache contains CodeQL at all.
# where a later job analyzing a different language could pick it up. Per-language bundles
# must instead be extracted under the runner's temporary directory.
echo "CodeQL is at $CODEQL_PATH"
if [[ "$CODEQL_PATH" == "$RUNNER_TOOL_CACHE"/* ]]; then
echo "::error::The per-language bundle was added to the toolcache at $CODEQL_PATH."
@@ -160,5 +172,4 @@ jobs:
fi
echo "Created a ${LANGUAGE} database at ${database}."
env:
CODEQL_ACTION_PER_LANGUAGE_BUNDLES: true
CODEQL_ACTION_TEST_MODE: true

4
.github/workflows/__remote-config.yml generated vendored
View File

@@ -54,9 +54,9 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
- os: ubuntu-latest
- os: ubuntu-26.04
version: nightly-latest
name: Remote config file
if: github.triggering_actor != 'dependabot[bot]'

6
.github/workflows/__resolve-environment-action.yml generated vendored
View File

@@ -34,11 +34,11 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
- os: ubuntu-latest
- os: ubuntu-26.04
version: default
- os: ubuntu-latest
- os: ubuntu-26.04
version: nightly-latest
name: Resolve environment
if: github.triggering_actor != 'dependabot[bot]'

74
.github/workflows/__rubocop-multi-language.yml generated vendored
View File

@@ -1,74 +0,0 @@
# Warning: This file is generated automatically, and should not be modified.
# Instead, please modify the template in the pr-checks directory and run:
# pr-checks/sync.sh
# to regenerate this file.
name: PR Check - RuboCop multi-language
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
GO111MODULE: auto
on:
push:
branches:
- main
- releases/v*
pull_request: {}
merge_group:
types:
- checks_requested
schedule:
- cron: '0 5 * * *'
workflow_dispatch:
inputs: {}
workflow_call:
inputs: {}
defaults:
run:
shell: bash
concurrency:
cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
group: rubocop-multi-language-${{github.ref}}
jobs:
rubocop-multi-language:
strategy:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
version: default
name: RuboCop multi-language
if: github.triggering_actor != 'dependabot[bot]'
permissions:
contents: read
security-events: read
timeout-minutes: 45
runs-on: ${{ matrix.os }}
steps:
- name: Check out repository
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Prepare test
id: prepare-test
uses: ./.github/actions/prepare-test
with:
version: ${{ matrix.version }}
use-all-platform-bundle: 'false'
setup-kotlin: 'true'
- name: Set up Ruby
uses: ruby/setup-ruby@14594264cd68ce8a2345dd349bc3d138a4ef85c8 # v1.327.0
with:
ruby-version: 2.6
- name: Install Code Scanning integration
run: bundle add code-scanning-rubocop --version 0.3.0 --skip-install
- name: Install dependencies
run: bundle install
- name: RuboCop run
run: |
bash -c "
bundle exec rubocop --require code_scanning --format CodeScanning::SarifFormatter -o rubocop.sarif
[[ $? -ne 2 ]]
"
- uses: ./../action/upload-sarif
with:
sarif_file: rubocop.sarif
env:
CODEQL_ACTION_TEST_MODE: true

12
.github/workflows/__ruby.yml generated vendored
View File

@@ -34,17 +34,17 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
- os: macos-latest
- os: macos-26
version: linked
- os: ubuntu-latest
- os: ubuntu-26.04
version: default
- os: macos-latest
- os: macos-26
version: default
- os: ubuntu-latest
- os: ubuntu-26.04
version: nightly-latest
- os: macos-latest
- os: macos-26
version: nightly-latest
name: Ruby analysis
if: github.triggering_actor != 'dependabot[bot]'

10
.github/workflows/__rust.yml generated vendored
View File

@@ -34,15 +34,15 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-24.04
version: stable-v2.20.7
- os: ubuntu-latest
- os: ubuntu-26.04
version: stable-v2.22.1
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
- os: ubuntu-latest
- os: ubuntu-26.04
version: default
- os: ubuntu-latest
- os: ubuntu-26.04
version: nightly-latest
name: Rust analysis
if: github.triggering_actor != 'dependabot[bot]'

12
.github/workflows/__split-workflow.yml generated vendored
View File

@@ -54,17 +54,17 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
- os: macos-latest
- os: macos-26
version: linked
- os: ubuntu-latest
- os: ubuntu-26.04
version: default
- os: macos-latest
- os: macos-26
version: default
- os: ubuntu-latest
- os: ubuntu-26.04
version: nightly-latest
- os: macos-latest
- os: macos-26
version: nightly-latest
name: Split workflow
if: github.triggering_actor != 'dependabot[bot]'

6
.github/workflows/__start-proxy.yml generated vendored
View File

@@ -34,11 +34,11 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
- os: macos-latest
- os: macos-26
version: linked
- os: windows-latest
- os: windows-2025
version: linked
name: Start proxy
if: github.triggering_actor != 'dependabot[bot]'

10
.github/workflows/__submit-sarif-failure.yml generated vendored
View File

@@ -34,11 +34,11 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
- os: ubuntu-latest
- os: ubuntu-26.04
version: default
- os: ubuntu-latest
- os: ubuntu-26.04
version: nightly-latest
name: Submit SARIF after failure
if: github.triggering_actor != 'dependabot[bot]'
@@ -71,7 +71,9 @@ jobs:
run: exit 1
- uses: ./analyze
# In a real workflow, this step wouldn't run. Since we used `continue-on-error`
# above, we manually disable it with an `if` condition.
# above, we manually disable it with an `if` condition. Having this step is required
# for the init post-action because it checks the workflow definition for e.g. the
# `category` input. Without this step, that part of the init post-action would fail.
if: false
with:
category: '/test-codeql-version:${{ matrix.version }}'

2
.github/workflows/__swift-autobuild.yml generated vendored
View File

@@ -34,7 +34,7 @@ jobs:
fail-fast: false
matrix:
include:
- os: macos-latest-xlarge
- os: macos-26-xlarge
version: nightly-latest
name: Swift analysis using autobuild
if: github.triggering_actor != 'dependabot[bot]'

6
.github/workflows/__swift-custom-build.yml generated vendored
View File

@@ -54,11 +54,11 @@ jobs:
fail-fast: false
matrix:
include:
- os: macos-latest-xlarge
- os: macos-26-xlarge
version: linked
- os: macos-latest-xlarge
- os: macos-26-xlarge
version: default
- os: macos-latest-xlarge
- os: macos-26-xlarge
version: nightly-latest
name: Swift analysis using a custom build command
if: github.triggering_actor != 'dependabot[bot]'

4
.github/workflows/__unset-environment.yml generated vendored
View File

@@ -54,9 +54,9 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
- os: ubuntu-latest
- os: ubuntu-26.04
version: nightly-latest
name: Test unsetting environment variables
if: github.triggering_actor != 'dependabot[bot]'

135
.github/workflows/__unsupported-macos.yml generated vendored Normal file
View File

@@ -0,0 +1,135 @@
# Warning: This file is generated automatically, and should not be modified.
# Instead, please modify the template in the pr-checks directory and run:
# pr-checks/sync.sh
# to regenerate this file.
name: PR Check - Unsupported macOS
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
GO111MODULE: auto
on:
push:
branches:
- main
- releases/v*
pull_request: {}
merge_group:
types:
- checks_requested
schedule:
- cron: '0 5 * * *'
workflow_dispatch:
inputs: {}
workflow_call:
inputs: {}
defaults:
run:
shell: bash
concurrency:
cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
group: unsupported-macos-${{github.ref}}
jobs:
unsupported-macos:
strategy:
fail-fast: false
matrix:
include:
- os: xcode-27
version: linked
- os: xcode-27
version: nightly-latest
name: Unsupported macOS
if: github.triggering_actor != 'dependabot[bot]'
permissions:
contents: read
security-events: read
timeout-minutes: 45
runs-on: ${{ matrix.os }}
steps:
- name: Check out repository
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Install Node.js
uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
with:
node-version: 20.x
cache: npm
- name: Install newer npm
run: npm install -g npm@11.19.1
- name: Install dependencies
run: npm ci
- name: Prepare test
id: prepare-test
uses: ./.github/actions/prepare-test
with:
version: ${{ matrix.version }}
use-all-platform-bundle: 'false'
setup-kotlin: 'true'
- name: Check xcode_select_link
run: |
readlink /private/var/db/xcode_select_link
file -h /private/var/db/xcode_select_link
- uses: ./../action/init
id: init
continue-on-error: true
env:
CODEQL_ACTION_CHECK_UNSUPPORTED_TRACED_ANALYSIS: true
CODEQL_ACTION_ABORT_UNSUPPORTED_TRACED_ANALYSIS: true
with:
languages: swift
tools: ${{ steps.prepare-test.outputs.tools-url }}
- name: Analyze
# We could run `analyze` here from `./../analyze`, but `getAnalyzeActionName` in `workflow.ts`
# can't cope with that unless we introduce a different testing environment. Since this step
# would just fail on `xcode-27` anyway, we just skip it instead.
if: false
uses: ./analyze
with:
category: '/test-codeql-version:${{ matrix.version }}'
env:
CODEQL_ACTION_SKIP_GENERATE_FAILED_SARIF: false
CODEQL_ACTION_SKIP_SARIF_UPLOAD: true
CODEQL_ACTION_TESTING_ENVIRONMENT: codeql-action-pr-checks
CODEQL_ACTION_TEST_MODE: true
unsupported-macos-sarif-checks:
if: github.triggering_actor != 'dependabot[bot]'
needs:
- unsupported-macos
permissions:
contents: read
security-events: read
timeout-minutes: 5
runs-on: ubuntu-26.04
steps:
- name: Check out repository
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Install Node.js
uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
with:
node-version: 20.x
cache: npm
- name: Install newer npm
run: npm install -g npm@11.19.1
- name: Install dependencies
run: npm ci
- name: Download workflow artifact
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with:
pattern: test-mode-sarif-*
path: sarif
- name: List artifact contents
run: ls -laR ./sarif
- name: Check diagnostics appear in SARIF
env:
SARIF_PATH: "./sarif/"
DIAGNOSTIC_ID: "codeql-action/unsupported-traced-analysis-macos"
DIAGNOSTIC_NAME: "Traced analysis is not supported on this version of macOS"
EXPECTED_LOCATIONS: "0"
EXPECTED_MESSAGE: |
Traced analysis is not supported on macOS 27 or above.
run: npx tsx ./pr-checks/check-diagnostics.ts
env:
CODEQL_ACTION_TEST_MODE: true

2
.github/workflows/__upload-ref-sha-input.yml generated vendored
View File

@@ -54,7 +54,7 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: default
name: "Upload-sarif: 'ref' and 'sha' from inputs"
if: github.triggering_actor != 'dependabot[bot]'

6
.github/workflows/__upload-sarif.yml generated vendored
View File

@@ -54,13 +54,13 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: default
analysis-kinds: code-scanning
- os: ubuntu-latest
- os: ubuntu-26.04
version: default
analysis-kinds: code-quality
- os: ubuntu-latest
- os: ubuntu-26.04
version: default
analysis-kinds: code-scanning,code-quality
name: Test different uses of `upload-sarif`

2
.github/workflows/__with-checkout-path.yml generated vendored
View File

@@ -54,7 +54,7 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
name: Use a custom `checkout_path`
if: github.triggering_actor != 'dependabot[bot]'

4
.github/workflows/codeql.yml vendored
View File

@@ -22,7 +22,7 @@ jobs:
# Identify the CodeQL tool versions to use in the analysis job.
check-codeql-versions:
if: github.triggering_actor != 'dependabot[bot]'
runs-on: ubuntu-latest
runs-on: ubuntu-26.04
outputs:
versions: ${{ steps.compare.outputs.versions }}
@@ -106,7 +106,7 @@ jobs:
analyze-other:
if: github.triggering_actor != 'dependabot[bot]'
runs-on: ubuntu-latest
runs-on: ubuntu-26.04
strategy:
fail-fast: false

6
.github/workflows/codescanning-config-cli.yml vendored
View File

@@ -41,11 +41,11 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: linked
- os: ubuntu-latest
- os: ubuntu-26.04
version: default
- os: ubuntu-latest
- os: ubuntu-26.04
version: nightly-latest
# Code-Scanning config not created because environment variable is not set

26
.github/workflows/debug-artifacts-failure-safe.yml vendored
View File

@@ -6,13 +6,13 @@ env:
on:
push:
branches:
- main
- releases/v*
- main
- releases/v*
pull_request:
merge_group:
types: [checks_requested]
schedule:
- cron: '0 5 * * *'
- cron: "0 5 * * *"
workflow_dispatch:
concurrency:
@@ -30,10 +30,10 @@ jobs:
fail-fast: false
matrix:
version:
- stable-v2.20.7
- default
- linked
- nightly-latest
- stable-v2.20.7
- default
- linked
- nightly-latest
name: Upload debug artifacts after failure in analyze
continue-on-error: true
env:
@@ -43,7 +43,12 @@ jobs:
# We currently need `security-events: read` to access feature flags.
security-events: read
timeout-minutes: 45
runs-on: ubuntu-latest
# stable-v2.20.7 requires an older version of Java than the default on `ubuntu-latest` (`ubuntu-26.04`).
# We could install that older version on the newer runners, or use the older runner.
# We do the latter here. This can be removed once we stop supporting `v2.20.7`.
runs-on: ${{ case(matrix.version == 'stable-v2.20.7', 'ubuntu-24.04', 'ubuntu-26.04') }}
steps:
- name: Dump GitHub event
run: cat "${GITHUB_EVENT_PATH}"
@@ -60,7 +65,7 @@ jobs:
- name: Install .NET
uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
with:
dotnet-version: '9.x'
dotnet-version: "9.x"
- name: Assert best-effort artifact scan completed
uses: ./../action/.github/actions/verify-debug-artifact-scan-completed
- uses: ./../action/init
@@ -86,12 +91,13 @@ jobs:
timeout-minutes: 45
permissions:
contents: read
runs-on: ubuntu-latest
runs-on: ubuntu-26.04
steps:
- name: Download all artifacts
uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
- name: Check expected artifacts exist
run: |
VERSIONS="stable-v2.20.7 default linked nightly-latest"
LANGUAGES="cpp csharp go java javascript python"
for version in $VERSIONS; do
echo "Artifacts from version $version:"

25
.github/workflows/debug-artifacts-safe.yml vendored
View File

@@ -5,13 +5,13 @@ env:
on:
push:
branches:
- main
- releases/v*
- main
- releases/v*
pull_request:
merge_group:
types: [checks_requested]
schedule:
- cron: '0 5 * * *'
- cron: "0 5 * * *"
workflow_dispatch:
concurrency:
@@ -29,10 +29,10 @@ jobs:
fail-fast: false
matrix:
version:
- stable-v2.20.7
- default
- linked
- nightly-latest
- stable-v2.20.7
- default
- linked
- nightly-latest
name: Upload debug artifacts
env:
CODEQL_ACTION_TEST_MODE: true
@@ -41,7 +41,12 @@ jobs:
contents: read
# We currently need `security-events: read` to access feature flags.
security-events: read
runs-on: ubuntu-latest
# stable-v2.20.7 requires an older version of Java than the default on `ubuntu-latest` (`ubuntu-26.04`).
# We could install that older version on the newer runners, or use the older runner.
# We do the latter here. This can be removed once we stop supporting `v2.20.7`.
runs-on: ${{ case(matrix.version == 'stable-v2.20.7', 'ubuntu-24.04', 'ubuntu-26.04') }}
steps:
- name: Check out repository
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -56,7 +61,7 @@ jobs:
- name: Install .NET
uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
with:
dotnet-version: '9.x'
dotnet-version: "9.x"
- name: Assert best-effort artifact scan completed
uses: ./../action/.github/actions/verify-debug-artifact-scan-completed
- uses: ./../action/init
@@ -79,7 +84,7 @@ jobs:
timeout-minutes: 45
permissions:
contents: read
runs-on: ubuntu-latest
runs-on: ubuntu-26.04
steps:
- name: Download all artifacts
uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2

1
.github/workflows/deflake.yml vendored
View File

@@ -60,7 +60,6 @@ on:
- "PR Check - Proxy test"
- "PR Check - Remote config file"
- "PR Check - Resolve environment"
- "PR Check - RuboCop multi-language"
- "PR Check - Ruby analysis"
- "PR Check - Rust analysis"
- "PR Check - Split workflow"

12
.github/workflows/post-release-mergeback.yml vendored
View File

@@ -10,7 +10,7 @@ on:
workflow_dispatch:
inputs:
baseBranch:
description: 'The base branch to merge into'
description: "The base branch to merge into"
default: main
required: false
@@ -24,7 +24,7 @@ defaults:
jobs:
merge-back:
runs-on: ubuntu-latest
runs-on: ubuntu-26.04
environment: Automation
if: github.repository == 'github/codeql-action'
env:
@@ -41,16 +41,16 @@ jobs:
- name: Dump GitHub context
env:
GITHUB_CONTEXT: '${{ toJson(github) }}'
GITHUB_CONTEXT: "${{ toJson(github) }}"
run: echo "${GITHUB_CONTEXT}"
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
fetch-depth: 0 # ensure we have all tags and can push commits
fetch-depth: 0 # ensure we have all tags and can push commits
- uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
with:
node-version: 24
cache: 'npm'
cache: "npm"
- name: Install JavaScript dependencies
run: npm ci
@@ -134,7 +134,7 @@ jobs:
echo "::endgroup::"
- name: Generate token
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
id: app-token
with:
app-id: ${{ vars.AUTOMATION_APP_ID }}

15
.github/workflows/pr-checks.yml vendored
View File

@@ -25,7 +25,7 @@ jobs:
strategy:
fail-fast: false
matrix:
os: [ubuntu-latest, macos-latest, windows-latest]
os: [ubuntu-26.04, macos-26, windows-2025]
node-version: [20, 24]
permissions:
contents: read
@@ -71,7 +71,7 @@ jobs:
run: npm test
- name: Lint
if: always() && matrix.os != 'windows-latest'
if: always() && matrix.os != 'windows-2025'
run: npm run lint-ci
- name: Upload sarif
@@ -81,7 +81,7 @@ jobs:
# paired `push` run that the queue branch creates use that ref, so gate on the ref itself
# rather than the event. The same results are uploaded by the `pull_request` run and again
# by the `push` run on `main`.
if: matrix.os == 'ubuntu-latest' && matrix.node-version == 24 && !startsWith(github.ref, 'refs/heads/gh-readonly-queue/')
if: matrix.os == 'ubuntu-26.04' && matrix.node-version == 24 && !startsWith(github.ref, 'refs/heads/gh-readonly-queue/')
with:
sarif_file: eslint.sarif
category: eslint
@@ -93,7 +93,7 @@ jobs:
if: github.triggering_actor != 'dependabot[bot]'
permissions:
contents: read
runs-on: ubuntu-latest
runs-on: ubuntu-26.04
timeout-minutes: 10
concurrency:
@@ -126,10 +126,15 @@ jobs:
if: ${{ !cancelled() && steps.install-deps.outcome == 'success' }}
run: .github/workflows/script/verify-pr-checks.sh
- name: Typecheck pr-checks scripts
if: ${{ !cancelled() && steps.install-deps.outcome == 'success' }}
working-directory: pr-checks
run: npm run typecheck
- name: Run pr-checks tests
if: ${{ !cancelled() && steps.install-deps.outcome == 'success' }}
working-directory: pr-checks
run: npx tsx --test
run: npm run test
- name: Run `pr-checks/changenotes.ts` to ensure that all unreleased change notes are valid
if: ${{ !cancelled() && steps.install-deps.outcome == 'success' }}

43
.github/workflows/pr-dequeued.yml vendored Normal file
View File

@@ -0,0 +1,43 @@
name: PR dequeued
on:
pull_request:
types:
- dequeued
jobs:
notify:
name: Notify
runs-on: ubuntu-slim
if: github.event.pull_request.merged != true
permissions:
pull-requests: write
steps:
- name: Notify that the PR was removed from the merge queue
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
PR_NUMBER: ${{ github.event.pull_request.number }}
REASON: ${{ github.event.reason }}
run: |
# Mention whoever added the PR to the merge queue rather than the PR author, who may be a
# bot such as Dependabot. The `dequeued` event payload doesn't identify the enqueuer, so
# look them up in the most recent `AddedToMergeQueueEvent` on the PR's timeline.
enqueuer=$(gh api graphql \
-F number="$PR_NUMBER" \
-f query='
query($number: Int!) {
repository(owner: "github", name: "codeql-action") {
pullRequest(number: $number) {
timelineItems(itemTypes: [ADDED_TO_MERGE_QUEUE_EVENT], last: 1) {
nodes { ... on AddedToMergeQueueEvent { enqueuer { login } } }
}
}
}
}' \
--jq '.data.repository.pullRequest.timelineItems.nodes[0].enqueuer.login')
echo "@$enqueuer The pull request was removed from the merge queue (\`$REASON\`)." \
"Please resolve any issues if required and enqueue the PR again." |
gh pr comment --body-file - --repo github/codeql-action "$PR_NUMBER"

2
.github/workflows/prepare-release.yml vendored
View File

@@ -29,7 +29,7 @@ defaults:
jobs:
prepare:
name: "Release info"
runs-on: ubuntu-latest
runs-on: ubuntu-26.04
if: github.repository == 'github/codeql-action'
permissions:

4
.github/workflows/python312-windows.yml vendored
View File

@@ -29,10 +29,10 @@ jobs:
contents: read
# We currently need `security-events: read` to access feature flags.
security-events: read
runs-on: windows-latest
runs-on: windows-2025
steps:
- uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
- uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
with:
python-version: 3.12

2
.github/workflows/query-filters.yml vendored
View File

@@ -25,7 +25,7 @@ jobs:
name: Query Filters Tests
if: github.triggering_actor != 'dependabot[bot]'
timeout-minutes: 45
runs-on: ubuntu-latest
runs-on: ubuntu-26.04
permissions:
contents: read # This permission is needed to allow the GitHub Actions workflow to read the contents of the repository.
steps:

4
.github/workflows/rebuild.yml vendored
View File

@@ -12,7 +12,7 @@ defaults:
jobs:
rebuild:
name: Rebuild Action
runs-on: ubuntu-latest
runs-on: ubuntu-26.04
if: github.event.label.name == 'Rebuild' || github.event_name == 'workflow_dispatch'
env:
@@ -33,7 +33,7 @@ jobs:
uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
with:
node-version: 24
cache: 'npm'
cache: "npm"
- name: Remove label
if: github.event_name == 'pull_request'

4
.github/workflows/rollback-release.yml vendored
View File

@@ -34,7 +34,7 @@ jobs:
rollback:
name: "Create rollback release"
if: github.repository == 'github/codeql-action'
runs-on: ubuntu-latest
runs-on: ubuntu-26.04
timeout-minutes: 45
# Don't set the deployment environment for test runs
@@ -139,7 +139,7 @@ jobs:
- name: Generate token
if: github.event_name == 'workflow_dispatch'
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
id: app-token
with:
app-id: ${{ vars.AUTOMATION_APP_ID }}

2
.github/workflows/test-codeql-bundle-all.yml vendored
View File

@@ -27,7 +27,7 @@ jobs:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
- os: ubuntu-26.04
version: nightly-latest
name: 'CodeQL Bundle All'
if: github.triggering_actor != 'dependabot[bot]'

2
.github/workflows/update-bundle.yml vendored
View File

@@ -20,7 +20,7 @@ defaults:
jobs:
update-bundle:
if: github.event.release.prerelease && startsWith(github.event.release.tag_name, 'codeql-bundle-')
runs-on: ubuntu-latest
runs-on: ubuntu-26.04
permissions:
contents: write # needed to push commits
pull-requests: write # needed to create pull requests

6
.github/workflows/update-release-branch.yml vendored
View File

@@ -26,7 +26,7 @@ jobs:
update:
name: "Update release branch"
timeout-minutes: 45
runs-on: ubuntu-latest
runs-on: ubuntu-26.04
if: github.event_name == 'workflow_dispatch'
needs: [prepare]
env:
@@ -79,7 +79,7 @@ jobs:
backport:
name: "Create backport"
timeout-minutes: 45
runs-on: ubuntu-latest
runs-on: ubuntu-26.04
environment: Automation
needs: [prepare]
if: ${{ (github.event_name == 'push') && needs.prepare.outputs.backport_target_branches != '[]' }}
@@ -95,7 +95,7 @@ jobs:
pull-requests: write # needed to create pull request
steps:
- name: Generate token
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
id: app-token
with:
app-id: ${{ vars.AUTOMATION_APP_ID }}