diff --git a/.github/workflows/update-bundle.yml b/.github/workflows/update-bundle.yml index d7d90b749..36503a64d 100644 --- a/.github/workflows/update-bundle.yml +++ b/.github/workflows/update-bundle.yml @@ -113,11 +113,12 @@ jobs: echo "CLI_VERSION=$cli_version" | tee -a "$GITHUB_ENV" echo "PR_URL=$pr_url" | tee -a "$GITHUB_ENV" - - name: Create changelog note + - name: Create changenote run: | npx tsx pr-checks/bundle-changelog.ts - - name: Push changelog note + - name: Push changenote run: | - git commit -am "Add changelog note" + git add unreleased-change-notes + git commit -m "Add changenote" git push diff --git a/CHANGELOG.md b/CHANGELOG.md index 950e8ffbe..2aa6b37e6 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,7 +4,14 @@ See the [releases page](https://github.com/github/codeql-action/releases) for th ## [UNRELEASED] +No user facing changes. + +## 4.39.2 - 03 Nov 2026 + - Update default CodeQL bundle version to [2.27.4](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.4). [#4284](https://github.com/github/codeql-action/pull/4284) +- _Upcoming breaking change_: CodeQL version 2.22.3 and earlier were discontinued on 16 October 2026 alongside GitHub Enterprise Server 3.18, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. [#4266](https://github.com/github/codeql-action/pull/4266) +- Starting with macOS 27 and Xcode 27, traced analyses are unsupported. See [this blog post for more information](https://github.blog/changelog/2026-10-19-codeql-changes-for-macos-27-xcode-27-and-swift-6-4/). The CodeQL Action will now try to identify if a workflow is about to perform a traced analysis on version 27 or above of macOS or Xcode. If so, the CodeQL Action will emit a corresponding warning that will also be visible on the [Tool Status Page](https://docs.github.com/en/code-security/how-tos/find-and-fix-code-vulnerabilities/manage-your-configuration/use-the-tools-status-page-for-code-scanning). This check will be rolled out following this release of the CodeQL Action. [#4221](https://github.com/github/codeql-action/pull/4221) +- The undocumented TRAP cache cleanup feature that could be enabled using the `CODEQL_ACTION_CLEANUP_TRAP_CACHES` environment variable has been removed, as announced in the release notes for CodeQL Action 4.35.2. The `analyze` Action now warns if this environment variable is set. If you used TRAP cache cleanup to limit Actions cache usage, we recommend disabling TRAP caching by passing the `trap-caching: false` input to the `init` Action. [#4243](https://github.com/github/codeql-action/pull/4243) ## 4.39.1 - 21 Oct 2026 diff --git a/lib/entry-points.js b/lib/entry-points.js index 533b7c381..e0c268fa3 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -177993,7 +177993,7 @@ function getDiffRangesJsonFilePath(env = getEnv()) { return path2.join(getTemporaryDirectory(env), PR_DIFF_RANGE_JSON_FILENAME); } function getActionVersion() { - return "4.39.2"; + return "4.39.3"; } function getWorkflowEventName(env = getEnv()) { return env.getRequired("GITHUB_EVENT_NAME" /* GITHUB_EVENT_NAME */); diff --git a/package-lock.json b/package-lock.json index c1a68345a..a33fe2871 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,12 +1,12 @@ { "name": "codeql", - "version": "4.39.2", + "version": "4.39.3", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "codeql", - "version": "4.39.2", + "version": "4.39.3", "license": "MIT", "workspaces": [ "pr-checks" diff --git a/package.json b/package.json index 73d61b35d..93429872c 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "codeql", - "version": "4.39.2", + "version": "4.39.3", "private": true, "description": "CodeQL action", "scripts": { diff --git a/pr-checks/bundle-changelog.test.ts b/pr-checks/bundle-changelog.test.ts index fad06826a..448851507 100644 --- a/pr-checks/bundle-changelog.test.ts +++ b/pr-checks/bundle-changelog.test.ts @@ -10,17 +10,13 @@ import { afterEach, beforeEach, describe, it } from "node:test"; import { CLI_VERSION_ENV_VAR, + getChangenote, getCLIVersion, getPRNumber, getPRUrl, PR_URL_ENV_VAR, - updateChangelog, } from "./bundle-changelog"; -import { - EMPTY_CHANGELOG, - NO_CHANGES_STR, - UNRELEASED_PLACEHOLDER, -} from "./changelog"; +import { isValidChangenoteContent } from "./changelog/validate"; let testDir: string; @@ -85,58 +81,15 @@ describe("getPRNumber", async () => { }); }); -const testChangelog = `${EMPTY_CHANGELOG.trimEnd()} - -## 4.23.7 - -- Other change - -## 4.23.6 - -${NO_CHANGES_STR}`; - -const expectedChangelog = `# CodeQL Action Changelog - -## ${UNRELEASED_PLACEHOLDER} - -- Update default CodeQL bundle version to - -## 4.23.7 - -- Other change - -## 4.23.6 - -${NO_CHANGES_STR}`; - -describe("updateChangelog", async () => { - await it("removes `NO_CHANGES_STR` if present in [UNRELEASED] section", async () => { - const result = updateChangelog(EMPTY_CHANGELOG, ""); - assert.ok(!result.includes(NO_CHANGES_STR)); - }); - - await it("doesn't remove `NO_CHANGES_STR` if present in versioned section", async () => { - const result = updateChangelog( - EMPTY_CHANGELOG.replace(UNRELEASED_PLACEHOLDER, "1.2.3"), - "", +describe("getChangenote", async () => { + await it("returns a note linking to the bundle release and the PR", async () => { + assert.equal( + getChangenote("1.2.3", testPrUrl), + "- Update default CodeQL bundle version to [1.2.3](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v1.2.3). [#42](https://github.com/github/codeql-action/pulls/42)\n", ); - assert.ok(result.includes(NO_CHANGES_STR)); }); - await it("throws if there are no sections", async () => { - assert.throws(() => { - updateChangelog( - "# CodeQL Action Changelog", - "- Update default CodeQL bundle version to", - ); - }); - }); - - await it("adds note at the end of the first section", async () => { - const result = updateChangelog( - testChangelog, - "- Update default CodeQL bundle version to", - ); - assert.deepEqual(result, expectedChangelog); + await it("returns valid changenote content", async () => { + assert.ok(isValidChangenoteContent(getChangenote("1.2.3", testPrUrl))); }); }); diff --git a/pr-checks/bundle-changelog.ts b/pr-checks/bundle-changelog.ts index 230b80fb8..8019c7090 100755 --- a/pr-checks/bundle-changelog.ts +++ b/pr-checks/bundle-changelog.ts @@ -1,17 +1,13 @@ #!/usr/bin/env npx tsx /** - * Updates the changelog with a change note for an updated CodeQL CLI bundle. + * Creates a changenote file for an update to the default CodeQL CLI bundle. */ import * as fs from "node:fs"; +import * as path from "node:path"; -import { - parseChangelog, - renderChangelog, - UNRELEASED_PLACEHOLDER, -} from "./changelog"; -import { CHANGELOG_FILE, CLI_BUNDLE_RELEASE_URL_PREFIX } from "./config"; +import { CHANGENOTES_DIR, CLI_BUNDLE_RELEASE_URL_PREFIX } from "./config"; import { getErrorMessage } from "./util"; export const CLI_VERSION_ENV_VAR = "CLI_VERSION"; @@ -58,42 +54,19 @@ export function getPRNumber(prUrl: string) { } /** - * Updates `changelog` by adding `changelogNote` to the first section. + * Returns the contents of the changenote file for an update to the default + * CodeQL CLI bundle. * - * @param contents The existing changelog contents. - * @param changelogNote The note to add to the first section. + * @param cliVersion The CodeQL CLI version of the new default bundle. + * @param prUrl The URL of the PR that updates the default bundle. + * @throws If the PR number can't be determined from `prUrl`. */ -export function updateChangelog(contents: string, changelogNote: string) { - // If the "[UNRELEASED]" section starts with "no user facing changes", remove that line. - contents = contents.replace( - `## ${UNRELEASED_PLACEHOLDER}\n\nNo user facing changes.`, - `## ${UNRELEASED_PLACEHOLDER}\n`, - ); +export function getChangenote(cliVersion: string, prUrl: string): string { + // The GitHub Release for the new bundle version. + const bundleReleaseUrl = `${CLI_BUNDLE_RELEASE_URL_PREFIX}${cliVersion}`; - const changelog = parseChangelog(contents); - - if (changelog.sections.length === 0) { - throw new Error("The changelog contains no existing sections."); - } - - // Add the changelog note to the bottom of the first section. - const firstSection = changelog.sections[0]; - const lastLine = firstSection.bodyLines.pop(); - - if (lastLine !== undefined && lastLine.trim() !== "") { - // We expect the last line to be empty. If it isn't for some reason, - // add it back. - firstSection.bodyLines.push(lastLine); - } - - firstSection.bodyLines.push(changelogNote); - - // If the last line is empty as expected, then add it back in after the new note. - if (lastLine?.trim() === "") { - firstSection.bodyLines.push(lastLine); - } - - return renderChangelog(changelog); + const prNumber = getPRNumber(prUrl); + return `- Update default CodeQL bundle version to [${cliVersion}](${bundleReleaseUrl}). [#${prNumber}](${prUrl})\n`; } function main() { @@ -101,22 +74,19 @@ function main() { const cliVersion = getCLIVersion(); const prUrl = getPRUrl(); - // The GitHub Release for the new bundle version. - const bundleReleaseUrl = `${CLI_BUNDLE_RELEASE_URL_PREFIX}${cliVersion}`; - - // Get the PR number from the PR URL. - const prNumber = getPRNumber(prUrl); - const changelogNote = `- Update default CodeQL bundle version to [${cliVersion}](${bundleReleaseUrl}). [#${prNumber}](${prUrl})`; - - let changelog = fs.readFileSync(CHANGELOG_FILE, "utf-8"); - - changelog = updateChangelog(changelog, changelogNote); - - fs.writeFileSync(CHANGELOG_FILE, changelog); + // Include the CLI version in the file name so that changenotes for + // different bundle updates don't conflict. + const changenotePath = path.join( + CHANGENOTES_DIR, + `update-bundle-${cliVersion}.md`, + ); + fs.writeFileSync(changenotePath, getChangenote(cliVersion, prUrl)); return 0; } catch (err) { - console.error(`Failed to bundle changelog: ${getErrorMessage(err)}`); + console.error( + `Failed to create changenote for bundle update: ${getErrorMessage(err)}`, + ); return -1; } } diff --git a/unreleased-change-notes/ghes-3-18-deprecation.md b/unreleased-change-notes/ghes-3-18-deprecation.md deleted file mode 100644 index 0e33d3932..000000000 --- a/unreleased-change-notes/ghes-3-18-deprecation.md +++ /dev/null @@ -1 +0,0 @@ -- _Upcoming breaking change_: CodeQL version 2.22.3 and earlier were discontinued on 16 October 2026 alongside GitHub Enterprise Server 3.18, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. [#4266](https://github.com/github/codeql-action/pull/4266) diff --git a/unreleased-change-notes/macos-xcode-deprecation.md b/unreleased-change-notes/macos-xcode-deprecation.md deleted file mode 100644 index ea7586d08..000000000 --- a/unreleased-change-notes/macos-xcode-deprecation.md +++ /dev/null @@ -1 +0,0 @@ -- Starting with macOS 27 and Xcode 27, traced analyses are unsupported. See [this blog post for more information](https://github.blog/changelog/2026-10-19-codeql-changes-for-macos-27-xcode-27-and-swift-6-4/). The CodeQL Action will now try to identify if a workflow is about to perform a traced analysis on version 27 or above of macOS or Xcode. If so, the CodeQL Action will emit a corresponding warning that will also be visible on the [Tool Status Page](https://docs.github.com/en/code-security/how-tos/find-and-fix-code-vulnerabilities/manage-your-configuration/use-the-tools-status-page-for-code-scanning). This check will be rolled out following this release of the CodeQL Action. [#4221](https://github.com/github/codeql-action/pull/4221) diff --git a/unreleased-change-notes/remove-trap-cache-cleanup.md b/unreleased-change-notes/remove-trap-cache-cleanup.md deleted file mode 100644 index b3cb822b8..000000000 --- a/unreleased-change-notes/remove-trap-cache-cleanup.md +++ /dev/null @@ -1 +0,0 @@ -- The undocumented TRAP cache cleanup feature that could be enabled using the `CODEQL_ACTION_CLEANUP_TRAP_CACHES` environment variable has been removed, as announced in the release notes for CodeQL Action 4.35.2. The `analyze` Action now warns if this environment variable is set. If you used TRAP cache cleanup to limit Actions cache usage, we recommend disabling TRAP caching by passing the `trap-caching: false` input to the `init` Action. [#4243](https://github.com/github/codeql-action/pull/4243)