github/codeql-action
1
0
Fork 0
mirror of https://github.com/github/codeql-action.git synced 2026-10-03 17:41:28 +00:00
Code Issues Packages Projects Releases Wiki Activity
10,266 Commits 445 Branches 589 Tags
1bcdd0c019f29ad522ba46d210df10af670d96ec
Commit Graph

10266 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Henry Mercer
1bcdd0c019 Derive the API client type from @actions/github 
`ApiClient` was hand-composed from `Octokit`, `Api` and `PaginateInterface`, imported directly from separately versioned Octokit packages. That asserted a shape matching what `@actions/github` actually returns, which held only while the versions happened to agree.

`@octokit/plugin-rest-endpoint-methods` v18 adds twelve Actions cache-limit methods. `@actions/github` still depends on `^17.0.0`, so the client it constructs no longer satisfies the v18-derived alias and the build fails.

Deriving the type from the constructor removes the assumption, so the alias tracks whatever `@actions/github` returns.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
 2026-08-27 18:56:47 +01:00
dependabot[bot]
25694c08ea Bump @octokit/plugin-rest-endpoint-methods from 17.0.0 to 18.0.0 
Bumps [@octokit/plugin-rest-endpoint-methods](https://github.com/octokit/plugin-rest-endpoint-methods.js) from 17.0.0 to 18.0.0.
- [Release notes](https://github.com/octokit/plugin-rest-endpoint-methods.js/releases)
- [Commits](https://github.com/octokit/plugin-rest-endpoint-methods.js/compare/v17.0.0...v18.0.0)

---
updated-dependencies:
- dependency-name: "@octokit/plugin-rest-endpoint-methods"
  dependency-version: 18.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-27 11:01:07 +00:00
Henry Mercer
0963041ab4 Merge pull request #4090 from github/dependabot/npm_and_yarn/octokit/plugin-paginate-rest-15.0.0 
Bump @octokit/plugin-paginate-rest from 14.0.0 to 15.0.0
 2026-08-27 10:45:55 +00:00
github-actions[bot]
1a8ddd7325 Rebuild 2026-08-27 10:32:49 +00:00
Henry Mercer
abc579a511 Merge pull request #4112 from github/dependabot/npm_and_yarn/npm-minor-62a3d68ea9 
Bump the npm-minor group across 1 directory with 2 updates
 2026-08-27 10:28:51 +00:00
dependabot[bot]
4d1d53ec73 Bump @octokit/plugin-paginate-rest from 14.0.0 to 15.0.0 
Bumps [@octokit/plugin-paginate-rest](https://github.com/octokit/plugin-paginate-rest.js) from 14.0.0 to 15.0.0.
- [Release notes](https://github.com/octokit/plugin-paginate-rest.js/releases)
- [Commits](https://github.com/octokit/plugin-paginate-rest.js/compare/v14.0.0...v15.0.0)

---
updated-dependencies:
- dependency-name: "@octokit/plugin-paginate-rest"
  dependency-version: 15.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-27 10:08:06 +00:00
Henry Mercer
6d4d5dfcd6 Merge pull request #4089 from github/dependabot/npm_and_yarn/octokit/types-17.0.0 
Bump @octokit/types from 16.0.0 to 17.0.0
 2026-08-27 09:37:27 +00:00
Paolo Tranquilli
7acc225a21 Merge pull request #4110 from github/redsun82-release-merge-instructions 
Document merge-commit requirement for release PRs
 2026-08-27 08:26:42 +00:00
Paolo Tranquilli
76ba03be44 Merge branch 'main' into redsun82-release-merge-instructions 2026-08-27 10:10:14 +02:00
github-actions[bot]
d75af13705 Rebuild 2026-08-26 18:03:17 +00:00
dependabot[bot]
0006c77502 Bump the npm-minor group across 1 directory with 2 updates 
Bumps the npm-minor group with 2 updates in the / directory: [js-yaml](https://github.com/nodeca/js-yaml) and [uuid](https://github.com/uuidjs/uuid).


Updates `js-yaml` from 5.2.3 to 5.3.0
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](https://github.com/nodeca/js-yaml/compare/5.2.3...5.3.0)

Updates `uuid` from 14.0.1 to 14.0.2
- [Release notes](https://github.com/uuidjs/uuid/releases)
- [Changelog](https://github.com/uuidjs/uuid/blob/main/CHANGELOG.md)
- [Commits](https://github.com/uuidjs/uuid/compare/v14.0.1...v14.0.2)

---
updated-dependencies:
- dependency-name: js-yaml
  dependency-version: 5.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor
- dependency-name: uuid
  dependency-version: 14.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-26 18:01:20 +00:00
Henry Mercer
4d40c93072 Merge pull request #4108 from github/mergeback/v4.37.9-to-main-cdf488f5 
Mergeback v4.37.9 refs/heads/releases/v4 into main
 2026-08-26 17:19:52 +00:00
Henry Mercer
3e93618b99 Merge pull request #4105 from github/henrymercer/tools-download-telemetry 
Improve CodeQL tools download time telemetry
 2026-08-26 17:01:23 +00:00
Paolo Tranquilli
42c2ea9ef7 Document merge-commit requirement for release PRs 
Release, mergeback, and backport PRs must be merged with a merge commit
so the branch linkage the release automation depends on is preserved
(the mergeback tags the release using the merge commit of the
"Merge main into releases/vN" PR, so squashing or rebasing breaks
tagging).

Add a path-scoped Copilot instructions file scoped to the files that
reliably change in these PRs (CHANGELOG.md, src/defaults.json,
lib/defaults.json, src/api-compatibility.json), and add an explicit note
to the Releasing runbook in CONTRIBUTING.md so the rule is enforced
regardless of who merges.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 0dae6e42-7fc6-4fb1-b1ea-15dc17e402a2
 2026-08-26 17:13:12 +02:00
github-actions[bot]
f37565646f Rebuild 2026-08-26 14:41:38 +00:00
github-actions[bot]
0f2e2bde5c Update changelog and version after v4.37.9 2026-08-26 14:41:24 +00:00
Paolo Tranquilli
cdf488f595 Merge pull request #4107 from github/update-v4.37.9-920ba7cd1 
Merge main into releases/v4
v4.37.9 		2026-08-26 16:39:15 +02:00
github-actions[bot]
7243f38558 Update changelog for v4.37.9 2026-08-26 12:56:36 +00:00
Paolo Tranquilli
920ba7cd15 Merge pull request #4106 from github/update-bundle/codeql-bundle-v2.26.4 
Update default bundle to 2.26.4
 2026-08-26 08:49:41 +00:00
github-actions[bot]
ecfa6e1681 Add changelog note 2026-08-26 08:23:26 +00:00
github-actions[bot]
adcdf4a70d Update default bundle to codeql-bundle-v2.26.4 2026-08-26 08:23:20 +00:00
Henry Mercer
9d89e2d1d6 Rebuild 
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 628ce334-991a-4578-9c1b-93d2e96bbddb
 2026-08-24 18:32:11 +01:00
Henry Mercer
bee82de8ba Add tools download durations to the init status report 
Surface `tools_extraction_duration_ms` and `tools_total_duration_ms` from
both the `init` and `setup-codeql` actions.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 628ce334-991a-4578-9c1b-93d2e96bbddb
 2026-08-24 18:32:08 +01:00
Henry Mercer
c05e445696 Report tools download durations on both download paths 
The streaming path reported no timings at all, so we have no data for the
path that most runs take. It now reports a total duration, which is also
populated on the download-then-extract path.

That path additionally reports the extraction duration, which was
previously computed but only logged.

`downloadDurationMs` keeps its existing meaning of time spent downloading
alone, so existing telemetry stays comparable.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 628ce334-991a-4578-9c1b-93d2e96bbddb
 2026-08-24 18:32:04 +01:00
Henry Mercer
486fec2a3e Merge pull request #4099 from github/update-supported-enterprise-server-versions 
Update supported GitHub Enterprise Server versions
codeql-bundle-v2.26.4 		2026-08-21 12:54:32 +00:00
Henry Mercer
134624c67b Merge pull request #4101 from github/dependabot/npm_and_yarn/npm-minor-457d827a35 
Bump the npm-minor group across 1 directory with 4 updates
 2026-08-21 12:53:13 +00:00
Henry Mercer
ff43db8f98 Merge pull request #4103 from github/mergeback/v4.37.8-to-main-db488dde 
Mergeback v4.37.8 refs/heads/releases/v4 into main
 2026-08-21 12:51:15 +00:00
github-actions[bot]
4605e03a74 Rebuild 2026-08-21 12:26:00 +00:00
github-actions[bot]
099c869cad Update changelog and version after v4.37.8 2026-08-21 12:25:47 +00:00
Henry Mercer
db488ddef3 Merge pull request #4102 from github/update-v4.37.8-9ee088e13 
Merge main into releases/v4
v4.37.8 		2026-08-21 13:24:15 +01:00
github-actions[bot]
1845f5ba8b Update changelog for v4.37.8 2026-08-21 12:09:34 +00:00
dependabot[bot]
79a73408b4 Bump the npm-minor group across 1 directory with 4 updates 
Bumps the npm-minor group with 4 updates in the / directory: [esbuild](https://github.com/evanw/esbuild), [globals](https://github.com/sindresorhus/globals), [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) and [tsx](https://github.com/privatenumber/tsx).


Updates `esbuild` from 0.28.1 to 0.28.2
- [Release notes](https://github.com/evanw/esbuild/releases)
- [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG.md)
- [Commits](https://github.com/evanw/esbuild/compare/v0.28.1...v0.28.2)

Updates `globals` from 17.9.0 to 17.11.0
- [Release notes](https://github.com/sindresorhus/globals/releases)
- [Commits](https://github.com/sindresorhus/globals/compare/v17.9.0...v17.11.0)

Updates `typescript-eslint` from 8.66.0 to 8.67.0
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.67.0/packages/typescript-eslint)

Updates `tsx` from 4.23.8 to 4.23.12
- [Release notes](https://github.com/privatenumber/tsx/releases)
- [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs)
- [Commits](https://github.com/privatenumber/tsx/compare/v4.23.8...v4.23.12)

---
updated-dependencies:
- dependency-name: esbuild
  dependency-version: 0.28.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor
- dependency-name: globals
  dependency-version: 17.11.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor
- dependency-name: typescript-eslint
  dependency-version: 8.67.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor
- dependency-name: tsx
  dependency-version: 4.23.12
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-19 17:55:06 +00:00
github-actions[bot]
f9d9f07d37 Update supported GitHub Enterprise Server versions 2026-08-19 00:11:43 +00:00
Henry Mercer
9ee088e136 Merge pull request #4080 from github/henrymercer/studious-giggle 
Determine the overlay minimum disk space requirement from feature flags
 2026-08-18 12:25:05 +00:00
Henry Mercer
1aef003397 Address review feedback on overlay disk flags 
Document each minimum disk feature flag individually and replace the tuple list with an explicit feature-to-threshold mapping.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
 2026-08-18 12:09:33 +01:00
Henry Mercer
508b83bc41 Merge main into overlay minimum disk feature branch 
Resolve the overlap with the separately shipped promotion of the overlay resource checks while preserving the feature-flagged minimum disk thresholds.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
 2026-08-18 12:09:09 +01:00
Michael B. Gale
d97b3428e8 Merge pull request #4098 from github/mbg/permission-error-as-configuration-error 
Make `EACCES` when installing CodeQL CLI a `ConfigurationError`
 2026-08-14 11:56:43 +00:00
Michael B. Gale
47fa622223 Make EACCES a ConfigurationError 2026-08-14 11:56:26 +01:00
Michael B. Gale
45693cc688 Refactor ENOSPC check into isDiskConfigurationError function 2026-08-14 11:53:32 +01:00
Mario Campos
c2fd8f54d1 Merge pull request #4081 from github/mario-campos/version-cache-to-disk 
Persist CodeQL version output to file rather than environment
 2026-08-13 14:27:41 +00:00
Mario Campos
c56f48e9bd Log unexpected conditions during caching CLI output 2026-08-13 09:14:00 -05:00
Mario Campos
aa0eadc572 Merge branch 'main' into mario-campos/version-cache-to-disk 
# Conflicts:
#	lib/entry-points.js
 2026-08-13 09:02:15 -05:00
Mario Campos
43250d671a Change cache key to string type to include CLI args 2026-08-13 08:59:09 -05:00
Michael B. Gale
5008effa71 Merge pull request #4094 from github/mergeback/v4.37.7-to-main-ff2f1c62 
Mergeback v4.37.7 refs/heads/releases/v4 into main
 2026-08-13 13:48:05 +00:00
github-actions[bot]
053d41e61e Rebuild 2026-08-13 13:30:41 +00:00
github-actions[bot]
1158e1c92a Update changelog and version after v4.37.7 2026-08-13 13:30:28 +00:00
Michael B. Gale
ff2f1c621b Merge pull request #4093 from github/update-v4.37.7-be7a3dbb8 
Merge main into releases/v4
v4.37.7 		2026-08-13 14:28:39 +01:00
Mario Campos
2d49edbac6 Re-order env to be first argument for consistency 2026-08-13 08:13:49 -05:00
github-actions[bot]
951a133f96 Update changelog for v4.37.7 2026-08-13 10:59:59 +00:00
dependabot[bot]
9875827ada Bump @octokit/types from 16.0.0 to 17.0.0 
Bumps [@octokit/types](https://github.com/octokit/types.ts) from 16.0.0 to 17.0.0.
- [Release notes](https://github.com/octokit/types.ts/releases)
- [Commits](https://github.com/octokit/types.ts/compare/v16.0.0...v17.0.0)

---
updated-dependencies:
- dependency-name: "@octokit/types"
  dependency-version: 17.0.0
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-13 10:32:23 +00:00