github/codeql-action
1
0
Fork 0
mirror of https://github.com/github/codeql-action.git synced 2026-10-03 09:14:58 +00:00
Code Issues Packages Projects Releases Wiki Activity
10,530 Commits 445 Branches 589 Tags
main
Commit Graph

104 Commits

Author SHA1 Message Date
Michael B. Gale
894842692f Install newer npm in Node 20 workflows 2026-10-02 18:31:31 +01:00
Michael B. Gale
d4bfde754d Merge pull request #4042 from github/dependabot/github_actions/dot-github/workflows/actions/setup-dotnet-6.0.0 
Bump actions/setup-dotnet from 5.4.0 to 6.0.0 in /.github/workflows
 2026-07-24 14:00:27 +00:00
Michael B. Gale
519b2703bc Merge pull request #4041 from github/dependabot/github_actions/dot-github/workflows/actions/setup-go-7.0.0 
Bump actions/setup-go from 6.5.0 to 7.0.0 in /.github/workflows
 2026-07-24 13:25:12 +00:00
dependabot[bot]
5c0fb499d4 Bump actions/setup-dotnet from 5.4.0 to 6.0.0 in /.github/workflows 
Bumps [actions/setup-dotnet](https://github.com/actions/setup-dotnet) from 5.4.0 to 6.0.0.
- [Release notes](https://github.com/actions/setup-dotnet/releases)
- [Commits](26b0ec14cb...a98b56852c)

---
updated-dependencies:
- dependency-name: actions/setup-dotnet
  dependency-version: 6.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-22 17:58:30 +00:00
dependabot[bot]
6cce0e741f Bump actions/setup-go from 6.5.0 to 7.0.0 in /.github/workflows 
Bumps [actions/setup-go](https://github.com/actions/setup-go) from 6.5.0 to 7.0.0.
- [Release notes](https://github.com/actions/setup-go/releases)
- [Commits](924ae3a1cd...b7ad1dad31)

---
updated-dependencies:
- dependency-name: actions/setup-go
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-22 17:58:15 +00:00
dependabot[bot]
8a0be82efa Bump the actions-minor group across 1 directory with 3 updates 
Bumps the actions-minor group with 3 updates in the /.github/workflows directory: [actions/checkout](https://github.com/actions/checkout), [actions/setup-java](https://github.com/actions/setup-java) and [ruby/setup-ruby](https://github.com/ruby/setup-ruby).


Updates `actions/checkout` from 7.0.0 to 7.0.1
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](9c091bb21b...3d3c42e5aa)

Updates `actions/setup-java` from 5.5.0 to 5.6.0
- [Release notes](https://github.com/actions/setup-java/releases)
- [Commits](0f481fcb61...03ad4de099)

Updates `ruby/setup-ruby` from 1.316.0 to 1.319.0
- [Release notes](https://github.com/ruby/setup-ruby/releases)
- [Changelog](https://github.com/ruby/setup-ruby/blob/master/release.rb)
- [Commits](d45b1a4e94...003a5c4d8d)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 7.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions-minor
- dependency-name: actions/setup-java
  dependency-version: 5.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions-minor
- dependency-name: ruby/setup-ruby
  dependency-version: 1.319.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-22 17:57:43 +00:00
dependabot[bot]
db76a66b98 Bump actions/setup-node from 6.4.0 to 7.0.0 in /.github/workflows 
Bumps [actions/setup-node](https://github.com/actions/setup-node) from 6.4.0 to 7.0.0.
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](48b55a011b...8207627860)

---
updated-dependencies:
- dependency-name: actions/setup-node
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-15 17:57:52 +00:00
dependabot[bot]
1578ba0b4f Bump the actions-minor group across 1 directory with 3 updates 
Bumps the actions-minor group with 3 updates in the /.github/workflows directory: [actions/setup-dotnet](https://github.com/actions/setup-dotnet), [actions/setup-java](https://github.com/actions/setup-java) and [ruby/setup-ruby](https://github.com/ruby/setup-ruby).


Updates `actions/setup-dotnet` from 5.3.0 to 5.4.0
- [Release notes](https://github.com/actions/setup-dotnet/releases)
- [Commits](9a946fdbd5...26b0ec14cb)

Updates `actions/setup-java` from 5.3.0 to 5.4.0
- [Release notes](https://github.com/actions/setup-java/releases)
- [Commits](ad2b38190b...1bcf9fb12c)

Updates `ruby/setup-ruby` from 1.313.0 to 1.314.0
- [Release notes](https://github.com/ruby/setup-ruby/releases)
- [Changelog](https://github.com/ruby/setup-ruby/blob/master/release.rb)
- [Commits](89f90524b8...9eb537ca03)

---
updated-dependencies:
- dependency-name: actions/setup-dotnet
  dependency-version: 5.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions-minor
- dependency-name: actions/setup-java
  dependency-version: 5.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions-minor
- dependency-name: ruby/setup-ruby
  dependency-version: 1.314.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-01 17:58:47 +00:00
Henry Mercer
9cea5827c6 Merge pull request #3977 from github/dependabot/github_actions/dot-github/workflows/actions/checkout-7.0.0 
Bump actions/checkout from 6.0.3 to 7.0.0 in /.github/workflows
 2026-06-25 10:09:43 +00:00
dependabot[bot]
490a5f655c Bump actions/checkout from 6.0.3 to 7.0.0 in /.github/workflows 
Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.3 to 7.0.0.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](df4cb1c069...9c091bb21b)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-06-24 17:58:21 +00:00
dependabot[bot]
1582c0ec80 Bump the actions-minor group across 1 directory with 3 updates 
Bumps the actions-minor group with 3 updates in the /.github/workflows directory: [actions/setup-go](https://github.com/actions/setup-go), [actions/setup-python](https://github.com/actions/setup-python) and [ruby/setup-ruby](https://github.com/ruby/setup-ruby).


Updates `actions/setup-go` from 6.4.0 to 6.5.0
- [Release notes](https://github.com/actions/setup-go/releases)
- [Commits](4a3601121d...924ae3a1cd)

Updates `actions/setup-python` from 6.2.0 to 6.3.0
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](a309ff8b42...ece7cb06ca)

Updates `ruby/setup-ruby` from 1.312.0 to 1.313.0
- [Release notes](https://github.com/ruby/setup-ruby/releases)
- [Changelog](https://github.com/ruby/setup-ruby/blob/master/release.rb)
- [Commits](12fd324f1d...89f90524b8)

---
updated-dependencies:
- dependency-name: actions/setup-go
  dependency-version: 6.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions-minor
- dependency-name: actions/setup-python
  dependency-version: 6.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions-minor
- dependency-name: ruby/setup-ruby
  dependency-version: 1.313.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-06-24 17:57:04 +00:00
Michael B. Gale
e3a04b7473 Remove ready_for_review triggers 2026-06-22 13:19:40 +01:00
Henry Mercer
87f4948cb0 Pin first-party Actions 2026-06-03 17:19:36 +01:00
Michael B. Gale
da11f44114 Run prepare-test after setup steps 2026-03-09 14:13:22 +00:00
Michael B. Gale
97a3705788 Organise language-specific setup information 2026-03-04 11:37:16 +00:00
Michael B. Gale
f91cab1409 Adjust quotes and re-generate workflows 2026-02-28 18:13:05 +00:00
Henry Mercer
f379c46d49 Address review comments 2026-02-25 15:26:48 +00:00
Henry Mercer
8105503f1a Add merge_group trigger to required checks to prepare for merge queue 2026-02-25 15:12:37 +00:00
Michael B. Gale
90f4ffcc7e Include input values in concurrency groups 2026-01-19 18:53:51 +00:00
Michael B. Gale
03e3f60d99 Explicitly set cancel-in-progress to false 2026-01-19 18:51:44 +00:00
Michael B. Gale
778f83ff16 Use hard-coded concurrency group names instead of github.workflow 
Since `github.workflow` will be the caller's name for `workflow_call` events
 2026-01-19 18:43:17 +00:00
dependabot[bot]
5bd8069afb Bump actions/checkout from 5 to 6 in /.github/workflows 
Bumps [actions/checkout](https://github.com/actions/checkout) from 5 to 6.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/v5...v6)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2025-11-24 18:01:10 +00:00
Michael B. Gale
38a3a7258f Enable installDotNet in all workflows that analyse C# 2025-11-13 19:48:37 +00:00
dependabot[bot]
53588c5ad2 Bump actions/setup-node from 5 to 6 in /.github/workflows 
Bumps [actions/setup-node](https://github.com/actions/setup-node) from 5 to 6.
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](https://github.com/actions/setup-node/compare/v5...v6)

---
updated-dependencies:
- dependency-name: actions/setup-node
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2025-10-20 17:26:07 +00:00
Henry Mercer
a34e1cd60b Merge branch 'main' into henrymercer/slim-pr-checks 2025-09-24 19:29:32 +02:00
Michael B. Gale
cec0b17b93 Skip PR checks for events triggered by Dependabot 2025-09-24 12:08:05 +01:00
Henry Mercer
83fdfaf3fc Merge branch 'main' into henrymercer/slim-pr-checks 2025-09-24 13:03:53 +02:00
Henry Mercer
944aa7df3d Merge pull request #3088 from github/dependabot/github_actions/actions-f739f361ea 
Bump the actions group with 4 updates
 2025-09-23 13:48:16 +01:00
Henry Mercer
3df807292a Only run PR checks on Ubuntu by default 2025-09-23 14:38:33 +02:00
Michael B. Gale
6fcf631e73 Add concurrency settings to PR checks 2025-09-20 14:19:07 +01:00
Paolo Tranquilli
1b8f0ffedf Set shell: bash by default on all workflows 2025-09-09 12:19:45 +02:00
dependabot[bot]
1a80c9b44e Bump the actions group with 4 updates 
Bumps the actions group with 4 updates: [actions/setup-go](https://github.com/actions/setup-go), [actions/github-script](https://github.com/actions/github-script), [actions/setup-node](https://github.com/actions/setup-node) and [actions/setup-python](https://github.com/actions/setup-python).


Updates `actions/setup-go` from 5 to 6
- [Release notes](https://github.com/actions/setup-go/releases)
- [Commits](https://github.com/actions/setup-go/compare/v5...v6)

Updates `actions/github-script` from 7 to 8
- [Release notes](https://github.com/actions/github-script/releases)
- [Commits](https://github.com/actions/github-script/compare/v7...v8)

Updates `actions/setup-node` from 4 to 5
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](https://github.com/actions/setup-node/compare/v4...v5)

Updates `actions/setup-python` from 5 to 6
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](https://github.com/actions/setup-python/compare/v5...v6)

---
updated-dependencies:
- dependency-name: actions/setup-go
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: actions/github-script
  dependency-version: '8'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: actions/setup-node
  dependency-version: '5'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: actions/setup-python
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <support@github.com>
 2025-09-08 17:54:44 +00:00
Henry Mercer
4da503e0f5 Use npm ci in CI 2025-08-21 18:48:23 +01:00
Henry Mercer
879c788b45 Install npm dependencies where necessary in generated workflows 2025-08-21 16:27:50 +01:00
Michael B. Gale
bd79bc6b67 Automatically add go-version input if installGo == true 2025-08-14 11:52:35 +01:00
Michael B. Gale
a592f71173 Allow inputs for workflow_* events, and propagate them through collections 2025-08-14 11:52:34 +01:00
Michael B. Gale
092bf71d04 Add workflow_call triggers to PR checks 2025-08-14 11:52:34 +01:00
Henry Mercer
9dfbcfd29f Merge pull request #3025 from github/dependabot/github_actions/actions-b7431406fe 
Bump the actions group with 3 updates
 2025-08-12 12:24:05 +01:00
dependabot[bot]
b1bfc45906 Bump the actions group with 3 updates 
Bumps the actions group with 3 updates: [actions/checkout](https://github.com/actions/checkout), [actions/download-artifact](https://github.com/actions/download-artifact) and [actions/create-github-app-token](https://github.com/actions/create-github-app-token).


Updates `actions/checkout` from 4 to 5
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/v4...v5)

Updates `actions/download-artifact` from 4 to 5
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](https://github.com/actions/download-artifact/compare/v4...v5)

Updates `actions/create-github-app-token` from 2.0.6 to 2.1.1
- [Release notes](https://github.com/actions/create-github-app-token/releases)
- [Commits](https://github.com/actions/create-github-app-token/compare/v2.0.6...v2.1.1)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: '5'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: actions/download-artifact
  dependency-version: '5'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: actions/create-github-app-token
  dependency-version: 2.1.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <support@github.com>
 2025-08-12 02:10:43 +00:00
Paolo Tranquilli
286b9e9d74 Specify the ruamel.yaml version in one place only (sync.sh) 2025-08-11 15:38:32 +02:00
Paolo Tranquilli
2d7401b887 Revert ruamel.yaml back to 0.17.31 
And revert back related changes
 2025-08-11 15:36:42 +02:00
Paolo Tranquilli
28f2516040 Improve Rust analysis PR check 
Also run the `rust` checks on "milestone" CLI releases, to ensure we
remain backward compatible with those versions. This was prompted by
https://github.com/github/codeql-action/pull/2960#pullrequestreview-3104730221

Running this on current `main` and then on that PR should improve our
confidence we remain backward compatible.

It also turns out a probable `ruamel.yaml` update was changing a lot of
generated workflows, so I've:
* fixed the `ruamel.yaml` version to the latest in `sync.sh`
* added `yaml.width = 120` in `sync.py` to minimize (but not entirely
  remove) the number of changes
* checked in the workflows whose formatting was changed by the new
  `ruamel.yaml` version
 2025-08-11 14:58:50 +02:00
Michael B. Gale
8f71d47b93 Add installGo input for adding setup-go step in sync.py 2025-06-16 12:28:23 +01:00
Henry Mercer
9cd802ec12 Give only read-level security-events permission where possible 2025-01-24 13:27:33 +00:00
Henry Mercer
bd76a92ebe PR checks: Remove code for unsupported versions 2025-01-15 17:50:02 +00:00
Josh Soref
756aa649df spelling: macos 
Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com>
 2024-11-06 06:43:41 -05:00
Henry Mercer
619f0d628b Update CodeQL versions tested in generated checks 2024-10-15 19:43:56 +01:00
Henry Mercer
a1404425d9 Remove 2.12.6 from tests 2024-08-05 19:28:35 +01:00
Andrew Eisenberg
79f6e84e69 Ensure string argument instead of boolean 2024-06-14 14:59:22 -07:00
Andrew Eisenberg
3f41e06a52 Merge remote-tracking branch 'upstream/main' into aeisenberg/enable-kotlin-tests 2024-06-14 13:20:03 -07:00