github/codeql-action
1
0
Fork 0
mirror of https://github.com/github/codeql-action.git synced 2026-10-03 17:41:28 +00:00
Code Issues Packages Projects Releases Wiki Activity
9,720 Commits 445 Branches 589 Tags
6cdc6063c031308c200c6cc637e69b1af0ce2c40
Commit Graph

9720 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Mario Campos
6cdc6063c0 Create wrapper runCliJson 2026-06-30 23:07:02 -05:00
Henry Mercer
628fc3f124 Merge pull request #3979 from github/henrymercer/overlay-db-cleanup-size-telemetry 
Measure overlay-base database size at the clear cleanup level
 2026-06-30 16:46:03 +00:00
Henry Mercer
9cfb67bab9 Add clarifying comments 2026-06-30 16:49:29 +01:00
Henry Mercer
6f8864c8b0 Address review comments 2026-06-26 18:43:09 +01:00
Henry Mercer
e90a71aaea Add tests for clear cleanup size telemetry 2026-06-26 17:44:30 +01:00
Henry Mercer
ad159d34f6 Measure overlay-base database size at the clear cleanup level 
This lets us compare the storage cost of overlay-base and trimmed databases for the same commit.
 2026-06-26 17:42:49 +01:00
Henry Mercer
9cea5827c6 Merge pull request #3977 from github/dependabot/github_actions/dot-github/workflows/actions/checkout-7.0.0 
Bump actions/checkout from 6.0.3 to 7.0.0 in /.github/workflows
 2026-06-25 10:09:43 +00:00
Henry Mercer
4d3359631e Merge pull request #3976 from github/dependabot/github_actions/dot-github/workflows/actions-minor-149d5843f4 
Bump the actions-minor group across 1 directory with 3 updates
 2026-06-25 10:08:33 +00:00
Henry Mercer
bc9b48e778 Merge pull request #3975 from github/dependabot/npm_and_yarn/npm-minor-82bd637a11 
Bump the npm-minor group across 1 directory with 3 updates
 2026-06-25 10:08:12 +00:00
github-actions[bot]
d56b7d789e Rebuild 2026-06-24 18:00:15 +00:00
github-actions[bot]
dca26a3927 Rebuild 2026-06-24 17:59:01 +00:00
dependabot[bot]
490a5f655c Bump actions/checkout from 6.0.3 to 7.0.0 in /.github/workflows 
Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.3 to 7.0.0.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](df4cb1c069...9c091bb21b)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-06-24 17:58:21 +00:00
dependabot[bot]
1582c0ec80 Bump the actions-minor group across 1 directory with 3 updates 
Bumps the actions-minor group with 3 updates in the /.github/workflows directory: [actions/setup-go](https://github.com/actions/setup-go), [actions/setup-python](https://github.com/actions/setup-python) and [ruby/setup-ruby](https://github.com/ruby/setup-ruby).


Updates `actions/setup-go` from 6.4.0 to 6.5.0
- [Release notes](https://github.com/actions/setup-go/releases)
- [Commits](4a3601121d...924ae3a1cd)

Updates `actions/setup-python` from 6.2.0 to 6.3.0
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](a309ff8b42...ece7cb06ca)

Updates `ruby/setup-ruby` from 1.312.0 to 1.313.0
- [Release notes](https://github.com/ruby/setup-ruby/releases)
- [Changelog](https://github.com/ruby/setup-ruby/blob/master/release.rb)
- [Commits](12fd324f1d...89f90524b8)

---
updated-dependencies:
- dependency-name: actions/setup-go
  dependency-version: 6.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions-minor
- dependency-name: actions/setup-python
  dependency-version: 6.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions-minor
- dependency-name: ruby/setup-ruby
  dependency-version: 1.313.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-06-24 17:57:04 +00:00
github-actions[bot]
d8d3457a33 Rebuild 2026-06-24 17:56:32 +00:00
dependabot[bot]
98470ab04f Bump the npm-minor group across 1 directory with 3 updates 
Bumps the npm-minor group with 3 updates in the / directory: [@actions/cache](https://github.com/actions/toolkit/tree/HEAD/packages/cache), [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) and [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint).


Updates `@actions/cache` from 5.0.5 to 5.1.0
- [Changelog](https://github.com/actions/toolkit/blob/main/packages/cache/RELEASES.md)
- [Commits](https://github.com/actions/toolkit/commits/HEAD/packages/cache)

Updates `@types/node` from 20.19.42 to 20.19.43
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `typescript-eslint` from 8.61.0 to 8.61.1
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.61.1/packages/typescript-eslint)

---
updated-dependencies:
- dependency-name: "@actions/cache"
  dependency-version: 5.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor
- dependency-name: "@types/node"
  dependency-version: 20.19.43
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor
- dependency-name: typescript-eslint
  dependency-version: 8.61.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-06-24 17:54:37 +00:00
Michael B. Gale
a16f4a4973 Merge pull request #3974 from github/mbg/deps/glob 
Update `glob` to at least `13.0.6`
 2026-06-24 09:50:54 +00:00
Henry Mercer
a9f40c6340 Merge pull request #3972 from github/henrymercer/code-quality-user-error-categorization 
Categorize Code Quality "not enabled" upload failure as user-error
 2026-06-24 08:33:05 +00:00
Michael B. Gale
423f7de042 Update glob to at least 13.0.6 2026-06-23 19:12:17 +01:00
Michael B. Gale
dd3c803c55 Merge pull request #3969 from github/mbg/ci/no-more-draft-prs 
Remove `ready_for_review` triggers from workflows
 2026-06-23 17:57:17 +00:00
Michael B. Gale
d990aa1c2a Merge branch 'main' into henrymercer/code-quality-user-error-categorization 2026-06-23 18:50:48 +01:00
Michael B. Gale
c9d4e1d902 Merge branch 'main' into mbg/ci/no-more-draft-prs 2026-06-23 18:45:25 +01:00
Henry Mercer
ade8366b4d Merge pull request #3971 from github/henrymercer/macos-runner-migration 
Pin Swift macOS PR checks to macOS 15 for Xcode 16
 2026-06-23 17:27:52 +00:00
Henry Mercer
cdcf50882b Default macOS PR checks to latest runner, pin only old CLIs to macOS 15 
Redesign the per-entry codeql-versions filter so an OS entry without a
version list catches all versions not claimed by its siblings. This lets
new CodeQL versions flow to macos-latest-xlarge automatically. Move
v2.23.9 (which supports Swift 6.2) off the macOS 15 list and simplify the
matrix filter logic.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
 2026-06-23 17:33:14 +01:00
Henry Mercer
e054b4b848 Address review: split macOS Swift checks by CodeQL version 
Rather than pinning every macOS job to macOS 15, only run the older CodeQL CLI
versions (which need Xcode 16, and so macOS 15) there. Newer versions, which
support Swift 6.2, run on the latest macOS runner with its default Xcode, so we
keep exercising the common latest-CLI-on-latest-runner combination.

To express this, `sync.ts` now supports an optional per-OS-entry
`codeql-versions` filter, used by `multi-language-autodetect` to send old
versions to `macos-15-xlarge` and new versions to `macos-latest-xlarge`.

`swift-custom-build` only runs `linked`/`default`/`nightly`, which all support
Swift 6.2, so it no longer needs the Xcode 16 step or a macOS 15 pin.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
 2026-06-23 16:39:54 +01:00
Henry Mercer
6feed5452f Categorize Code Quality "not enabled" upload failure as user-error 
When a repository requests Code Quality analysis but it is not enabled,
the SARIF upload to `PUT /repos/:owner/:repo/code-quality/analysis`
returns a 403 with the message "Code quality is not enabled for this
repository...". `isEnablementError` did not recognize this wording, so
`wrapApiConfigurationError` left it as a plain Error and the analyze job
was reported with `status=failure` instead of `user-error`.

Add a `/Code Quality is not enabled/i` pattern so the error becomes a
ConfigurationError and `getActionsStatus` categorizes it as `user-error`.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
 2026-06-23 16:23:41 +01:00
Henry Mercer
b9c90effa0 Pin Swift macOS checks to macOS 15 for Xcode 16 
`macos-latest-xlarge` now resolves to macOS 26, which ships only Xcode 26
(Swift 6.2) and no longer includes Xcode 16. The Swift-analysing PR checks
select Xcode 16 because CodeQL CLI versions before 2.24.0 only support Swift
up to 6.1, so `xcode-select -s /Applications/Xcode_16.app` fails on macOS 26.

Pin these checks to macOS 15, where Xcode 16 is still available, so we keep
testing the full matrix of supported CodeQL versions. This also pre-empts the
`swift-custom-build` check failing once plain `macos`/`macos-latest` migrates.

See https://github.com/actions/runner-images/issues/14167.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
 2026-06-23 16:09:07 +01:00
Michael B. Gale
85bb4c6476 Restore edited trigger for label-pr-size workflow 2026-06-23 14:20:21 +01:00
Michael B. Gale
09dec6cc8c Merge pull request #3968 from github/dependabot/npm_and_yarn/js-yaml-5.0.0 
Bump js-yaml from 4.2.0 to 5.0.0
 2026-06-22 15:00:26 +00:00
Michael B. Gale
ba61470b11 Use quoteStyle 2026-06-22 14:26:21 +01:00
dependabot[bot]
31d88dd791 Bump js-yaml from 4.2.0 to 5.0.0 
Bumps [js-yaml](https://github.com/nodeca/js-yaml) from 4.2.0 to 5.0.0.
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](https://github.com/nodeca/js-yaml/compare/4.2.0...5.0.0)

---
updated-dependencies:
- dependency-name: js-yaml
  dependency-version: 5.0.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-06-22 12:31:01 +00:00
Michael B. Gale
aa12ef06b4 Do not create draft PRs where we did so to trigger workflows with ready_for_review before 2026-06-22 13:27:47 +01:00
Michael B. Gale
e3a04b7473 Remove ready_for_review triggers 2026-06-22 13:19:40 +01:00
Michael B. Gale
2f90a82ab7 Merge pull request #3966 from github/dependabot/npm_and_yarn/multi-dd1c4363d0 
Bump archiver and @types/archiver
 2026-06-18 22:36:49 +00:00
Michael B. Gale
ee70cd5210 Merge pull request #3916 from github/mbg/ts/update-ghes-versions 
Convert `update-supported-enterprise-server-versions` script to TypeScript
 2026-06-18 14:11:07 +00:00
Michael B. Gale
516447a110 Merge pull request #3909 from github/mbg/ff/remove/StartProxyRemoveUnusedRegistries 
Default to `StartProxyRemoveUnusedRegistries` behaviour
 2026-06-18 14:10:42 +00:00
Michael B. Gale
839edd2b07 Merge branch 'main' into mbg/ts/update-ghes-versions 2026-06-18 14:34:04 +01:00
Michael B. Gale
b3b14d6671 Merge branch 'main' into mbg/ff/remove/StartProxyRemoveUnusedRegistries 2026-06-18 14:29:55 +01:00
Michael B. Gale
711c19c2dc Use ZipArchive instead of archive("zip") 2026-06-18 14:24:11 +01:00
dependabot[bot]
4138e5a7fe Bump archiver and @types/archiver 
Bumps [archiver](https://github.com/archiverjs/node-archiver) and [@types/archiver](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/archiver). These dependencies needed to be updated together.

Updates `archiver` from 7.0.1 to 8.0.0
- [Release notes](https://github.com/archiverjs/node-archiver/releases)
- [Changelog](https://github.com/archiverjs/node-archiver/blob/master/CHANGELOG.md)
- [Commits](https://github.com/archiverjs/node-archiver/compare/7.0.1...8.0.0)

Updates `@types/archiver` from 7.0.0 to 8.0.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/archiver)

---
updated-dependencies:
- dependency-name: archiver
  dependency-version: 8.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
- dependency-name: "@types/archiver"
  dependency-version: 8.0.0
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-06-17 19:10:07 +00:00
Michael B. Gale
0bae987e7d Merge pull request #3964 from github/dependabot/npm_and_yarn/npm-minor-dc44a34bad 
Bump the npm-minor group across 1 directory with 3 updates
 2026-06-17 18:55:15 +00:00
Michael B. Gale
3b64eeeb9f Merge pull request #3965 from github/dependabot/github_actions/dot-github/workflows/actions-minor-ea9362b8e5 
Bump the actions-minor group across 1 directory with 2 updates
 2026-06-17 18:43:54 +00:00
Michael B. Gale
49e524587f Merge pull request #3963 from github/mbg/repo-prop/config-file 
Add repository property for configuration files
 2026-06-17 18:12:54 +00:00
github-actions[bot]
18e8398a57 Rebuild 2026-06-17 17:59:57 +00:00
github-actions[bot]
80de837984 Rebuild 2026-06-17 17:58:05 +00:00
dependabot[bot]
03dfa6fb02 Bump the actions-minor group across 1 directory with 2 updates 
Bumps the actions-minor group with 2 updates in the /.github/workflows directory: [actions/setup-java](https://github.com/actions/setup-java) and [ruby/setup-ruby](https://github.com/ruby/setup-ruby).


Updates `actions/setup-java` from 5.2.0 to 5.3.0
- [Release notes](https://github.com/actions/setup-java/releases)
- [Commits](be666c2fcd...ad2b38190b)

Updates `ruby/setup-ruby` from 1.310.0 to 1.312.0
- [Release notes](https://github.com/ruby/setup-ruby/releases)
- [Changelog](https://github.com/ruby/setup-ruby/blob/master/release.rb)
- [Commits](afeafc3d1a...12fd324f1d)

---
updated-dependencies:
- dependency-name: actions/setup-java
  dependency-version: 5.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions-minor
- dependency-name: ruby/setup-ruby
  dependency-version: 1.312.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-06-17 17:57:53 +00:00
dependabot[bot]
3187067e93 Bump the npm-minor group across 1 directory with 3 updates 
Bumps the npm-minor group with 3 updates in the / directory: [semver](https://github.com/npm/node-semver), [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) and [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint).


Updates `semver` from 7.8.1 to 7.8.4
- [Release notes](https://github.com/npm/node-semver/releases)
- [Changelog](https://github.com/npm/node-semver/blob/main/CHANGELOG.md)
- [Commits](https://github.com/npm/node-semver/compare/v7.8.1...v7.8.4)

Updates `@types/node` from 20.19.41 to 20.19.42
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `typescript-eslint` from 8.60.1 to 8.61.0
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.61.0/packages/typescript-eslint)

---
updated-dependencies:
- dependency-name: semver
  dependency-version: 7.8.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor
- dependency-name: "@types/node"
  dependency-version: 20.19.42
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor
- dependency-name: typescript-eslint
  dependency-version: 8.61.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-06-17 17:55:32 +00:00
Michael B. Gale
52077a03d9 Ignore empty repository property 2026-06-17 15:18:14 +01:00
Michael B. Gale
0337b99474 Merge pull request #3961 from github/dependabot/npm_and_yarn/tar-7.5.16 
Bump tar from 7.5.15 to 7.5.16
 2026-06-16 22:00:36 +00:00
Michael B. Gale
b2cc23e25d Log input choice 2026-06-16 14:19:37 +01:00
Michael B. Gale
82036913c8 Accept repository property as fallback 2026-06-16 12:28:17 +02:00