github/codeql-action
1
0
Fork 0
mirror of https://github.com/github/codeql-action.git synced 2026-10-31 09:59:43 +00:00
Code Issues Packages Projects Releases Wiki Activity
10,060 Commits 479 Branches 597 Tags
aeef68fc3690c1958466fdbfe5dbef33b93e866e
Commit Graph

132 Commits

Author SHA1 Message Date
dependabot[bot]
8a0be82efa Bump the actions-minor group across 1 directory with 3 updates 
Bumps the actions-minor group with 3 updates in the /.github/workflows directory: [actions/checkout](https://github.com/actions/checkout), [actions/setup-java](https://github.com/actions/setup-java) and [ruby/setup-ruby](https://github.com/ruby/setup-ruby).


Updates `actions/checkout` from 7.0.0 to 7.0.1
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](9c091bb21b...3d3c42e5aa)

Updates `actions/setup-java` from 5.5.0 to 5.6.0
- [Release notes](https://github.com/actions/setup-java/releases)
- [Commits](0f481fcb61...03ad4de099)

Updates `ruby/setup-ruby` from 1.316.0 to 1.319.0
- [Release notes](https://github.com/ruby/setup-ruby/releases)
- [Changelog](https://github.com/ruby/setup-ruby/blob/master/release.rb)
- [Commits](d45b1a4e94...003a5c4d8d)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 7.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions-minor
- dependency-name: actions/setup-java
  dependency-version: 5.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions-minor
- dependency-name: ruby/setup-ruby
  dependency-version: 1.319.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-22 17:57:43 +00:00
dependabot[bot]
1578ba0b4f Bump the actions-minor group across 1 directory with 3 updates 
Bumps the actions-minor group with 3 updates in the /.github/workflows directory: [actions/setup-dotnet](https://github.com/actions/setup-dotnet), [actions/setup-java](https://github.com/actions/setup-java) and [ruby/setup-ruby](https://github.com/ruby/setup-ruby).


Updates `actions/setup-dotnet` from 5.3.0 to 5.4.0
- [Release notes](https://github.com/actions/setup-dotnet/releases)
- [Commits](9a946fdbd5...26b0ec14cb)

Updates `actions/setup-java` from 5.3.0 to 5.4.0
- [Release notes](https://github.com/actions/setup-java/releases)
- [Commits](ad2b38190b...1bcf9fb12c)

Updates `ruby/setup-ruby` from 1.313.0 to 1.314.0
- [Release notes](https://github.com/ruby/setup-ruby/releases)
- [Changelog](https://github.com/ruby/setup-ruby/blob/master/release.rb)
- [Commits](89f90524b8...9eb537ca03)

---
updated-dependencies:
- dependency-name: actions/setup-dotnet
  dependency-version: 5.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions-minor
- dependency-name: actions/setup-java
  dependency-version: 5.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions-minor
- dependency-name: ruby/setup-ruby
  dependency-version: 1.314.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-01 17:58:47 +00:00
Henry Mercer
9cea5827c6 Merge pull request #3977 from github/dependabot/github_actions/dot-github/workflows/actions/checkout-7.0.0 
Bump actions/checkout from 6.0.3 to 7.0.0 in /.github/workflows
 2026-06-25 10:09:43 +00:00
dependabot[bot]
490a5f655c Bump actions/checkout from 6.0.3 to 7.0.0 in /.github/workflows 
Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.3 to 7.0.0.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](df4cb1c069...9c091bb21b)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-06-24 17:58:21 +00:00
dependabot[bot]
1582c0ec80 Bump the actions-minor group across 1 directory with 3 updates 
Bumps the actions-minor group with 3 updates in the /.github/workflows directory: [actions/setup-go](https://github.com/actions/setup-go), [actions/setup-python](https://github.com/actions/setup-python) and [ruby/setup-ruby](https://github.com/ruby/setup-ruby).


Updates `actions/setup-go` from 6.4.0 to 6.5.0
- [Release notes](https://github.com/actions/setup-go/releases)
- [Commits](4a3601121d...924ae3a1cd)

Updates `actions/setup-python` from 6.2.0 to 6.3.0
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](a309ff8b42...ece7cb06ca)

Updates `ruby/setup-ruby` from 1.312.0 to 1.313.0
- [Release notes](https://github.com/ruby/setup-ruby/releases)
- [Changelog](https://github.com/ruby/setup-ruby/blob/master/release.rb)
- [Commits](12fd324f1d...89f90524b8)

---
updated-dependencies:
- dependency-name: actions/setup-go
  dependency-version: 6.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions-minor
- dependency-name: actions/setup-python
  dependency-version: 6.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions-minor
- dependency-name: ruby/setup-ruby
  dependency-version: 1.313.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-06-24 17:57:04 +00:00
Michael B. Gale
c9d4e1d902 Merge branch 'main' into mbg/ci/no-more-draft-prs 2026-06-23 18:45:25 +01:00
Henry Mercer
cdcf50882b Default macOS PR checks to latest runner, pin only old CLIs to macOS 15 
Redesign the per-entry codeql-versions filter so an OS entry without a
version list catches all versions not claimed by its siblings. This lets
new CodeQL versions flow to macos-latest-xlarge automatically. Move
v2.23.9 (which supports Swift 6.2) off the macOS 15 list and simplify the
matrix filter logic.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
 2026-06-23 17:33:14 +01:00
Henry Mercer
e054b4b848 Address review: split macOS Swift checks by CodeQL version 
Rather than pinning every macOS job to macOS 15, only run the older CodeQL CLI
versions (which need Xcode 16, and so macOS 15) there. Newer versions, which
support Swift 6.2, run on the latest macOS runner with its default Xcode, so we
keep exercising the common latest-CLI-on-latest-runner combination.

To express this, `sync.ts` now supports an optional per-OS-entry
`codeql-versions` filter, used by `multi-language-autodetect` to send old
versions to `macos-15-xlarge` and new versions to `macos-latest-xlarge`.

`swift-custom-build` only runs `linked`/`default`/`nightly`, which all support
Swift 6.2, so it no longer needs the Xcode 16 step or a macOS 15 pin.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
 2026-06-23 16:39:54 +01:00
Henry Mercer
b9c90effa0 Pin Swift macOS checks to macOS 15 for Xcode 16 
`macos-latest-xlarge` now resolves to macOS 26, which ships only Xcode 26
(Swift 6.2) and no longer includes Xcode 16. The Swift-analysing PR checks
select Xcode 16 because CodeQL CLI versions before 2.24.0 only support Swift
up to 6.1, so `xcode-select -s /Applications/Xcode_16.app` fails on macOS 26.

Pin these checks to macOS 15, where Xcode 16 is still available, so we keep
testing the full matrix of supported CodeQL versions. This also pre-empts the
`swift-custom-build` check failing once plain `macos`/`macos-latest` migrates.

See https://github.com/actions/runner-images/issues/14167.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
 2026-06-23 16:09:07 +01:00
Michael B. Gale
e3a04b7473 Remove ready_for_review triggers 2026-06-22 13:19:40 +01:00
Henry Mercer
87f4948cb0 Pin first-party Actions 2026-06-03 17:19:36 +01:00
Henry Mercer
05e8f288eb Merge branch 'main' into henrymercer/require-codeql-2.19.4 2026-05-15 18:13:43 +01:00
Henry Mercer
aa005faaad PR checks: Run slowest macOS checks on larger runners 2026-05-14 17:29:44 +01:00
Henry Mercer
9c3aedb4cd Update PR check testing matrix 2026-05-13 14:25:03 +01:00
Henry Mercer
117bf916af Sort OS list and versions consistently 2026-03-11 17:11:07 +00:00
Michael B. Gale
b9b42bed94 Remove last use of installPython 
- Add explicit `setup-python` step with condition to the workflow that was still using it
- This allows simplifying the logic in `sync.ts`
 2026-03-11 11:55:16 +00:00
Michael B. Gale
5ddbbbe614 Install python if there is no matrix.version 2026-03-09 14:16:23 +00:00
Michael B. Gale
da11f44114 Run prepare-test after setup steps 2026-03-09 14:13:22 +00:00
Michael B. Gale
97a3705788 Organise language-specific setup information 2026-03-04 11:37:16 +00:00
Michael B. Gale
f91cab1409 Adjust quotes and re-generate workflows 2026-02-28 18:13:05 +00:00
Henry Mercer
f379c46d49 Address review comments 2026-02-25 15:26:48 +00:00
Henry Mercer
8105503f1a Add merge_group trigger to required checks to prepare for merge queue 2026-02-25 15:12:37 +00:00
Michael B. Gale
90f4ffcc7e Include input values in concurrency groups 2026-01-19 18:53:51 +00:00
Michael B. Gale
03e3f60d99 Explicitly set cancel-in-progress to false 2026-01-19 18:51:44 +00:00
Michael B. Gale
778f83ff16 Use hard-coded concurrency group names instead of github.workflow 
Since `github.workflow` will be the caller's name for `workflow_call` events
 2026-01-19 18:43:17 +00:00
dependabot[bot]
5bd8069afb Bump actions/checkout from 5 to 6 in /.github/workflows 
Bumps [actions/checkout](https://github.com/actions/checkout) from 5 to 6.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/v5...v6)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2025-11-24 18:01:10 +00:00
Michael B. Gale
38a3a7258f Enable installDotNet in all workflows that analyse C# 2025-11-13 19:48:37 +00:00
Michael B. Gale
3569065d7e Install Python 3.13, except for nightly-latest 2025-10-17 12:51:50 +01:00
Michael B. Gale
cec0b17b93 Skip PR checks for events triggered by Dependabot 2025-09-24 12:08:05 +01:00
Henry Mercer
944aa7df3d Merge pull request #3088 from github/dependabot/github_actions/actions-f739f361ea 
Bump the actions group with 4 updates
 2025-09-23 13:48:16 +01:00
Michael B. Gale
6fcf631e73 Add concurrency settings to PR checks 2025-09-20 14:19:07 +01:00
Henry Mercer
86f23c3336 Run PR checks over CodeQL v2.22 release series 2025-09-15 16:34:20 +01:00
Paolo Tranquilli
aa90e97ad2 Merge pull request #3091 from github/redsun82/fix-windows-ci 
Set `shell: bash` by default on all workflows
 2025-09-12 18:47:08 +02:00
Paolo Tranquilli
1b8f0ffedf Set shell: bash by default on all workflows 2025-09-09 12:19:45 +02:00
dependabot[bot]
1a80c9b44e Bump the actions group with 4 updates 
Bumps the actions group with 4 updates: [actions/setup-go](https://github.com/actions/setup-go), [actions/github-script](https://github.com/actions/github-script), [actions/setup-node](https://github.com/actions/setup-node) and [actions/setup-python](https://github.com/actions/setup-python).


Updates `actions/setup-go` from 5 to 6
- [Release notes](https://github.com/actions/setup-go/releases)
- [Commits](https://github.com/actions/setup-go/compare/v5...v6)

Updates `actions/github-script` from 7 to 8
- [Release notes](https://github.com/actions/github-script/releases)
- [Commits](https://github.com/actions/github-script/compare/v7...v8)

Updates `actions/setup-node` from 4 to 5
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](https://github.com/actions/setup-node/compare/v4...v5)

Updates `actions/setup-python` from 5 to 6
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](https://github.com/actions/setup-python/compare/v5...v6)

---
updated-dependencies:
- dependency-name: actions/setup-go
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: actions/github-script
  dependency-version: '8'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: actions/setup-node
  dependency-version: '5'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: actions/setup-python
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <support@github.com>
 2025-09-08 17:54:44 +00:00
Henry Mercer
71410c6e72 Enable feature in CI for testing 2025-09-05 16:56:51 +01:00
Michael B. Gale
c0abce94a0 Don't pin Xcode for nightly tests 2025-08-28 15:15:33 +01:00
Michael B. Gale
caeeaa1fe8 Select Xcode 16 in workflows that analyse Swift 2025-08-28 14:01:23 +01:00
Michael B. Gale
5896c12c39 Remove setup-swift steps 2025-08-28 13:56:38 +01:00
Michael B. Gale
bd79bc6b67 Automatically add go-version input if installGo == true 2025-08-14 11:52:35 +01:00
Michael B. Gale
a592f71173 Allow inputs for workflow_* events, and propagate them through collections 2025-08-14 11:52:34 +01:00
Michael B. Gale
092bf71d04 Add workflow_call triggers to PR checks 2025-08-14 11:52:34 +01:00
Henry Mercer
9dfbcfd29f Merge pull request #3025 from github/dependabot/github_actions/actions-b7431406fe 
Bump the actions group with 3 updates
 2025-08-12 12:24:05 +01:00
dependabot[bot]
b1bfc45906 Bump the actions group with 3 updates 
Bumps the actions group with 3 updates: [actions/checkout](https://github.com/actions/checkout), [actions/download-artifact](https://github.com/actions/download-artifact) and [actions/create-github-app-token](https://github.com/actions/create-github-app-token).


Updates `actions/checkout` from 4 to 5
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/v4...v5)

Updates `actions/download-artifact` from 4 to 5
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](https://github.com/actions/download-artifact/compare/v4...v5)

Updates `actions/create-github-app-token` from 2.0.6 to 2.1.1
- [Release notes](https://github.com/actions/create-github-app-token/releases)
- [Commits](https://github.com/actions/create-github-app-token/compare/v2.0.6...v2.1.1)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: '5'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: actions/download-artifact
  dependency-version: '5'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: actions/create-github-app-token
  dependency-version: 2.1.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <support@github.com>
 2025-08-12 02:10:43 +00:00
Paolo Tranquilli
286b9e9d74 Specify the ruamel.yaml version in one place only (sync.sh) 2025-08-11 15:38:32 +02:00
Paolo Tranquilli
2d7401b887 Revert ruamel.yaml back to 0.17.31 
And revert back related changes
 2025-08-11 15:36:42 +02:00
Paolo Tranquilli
28f2516040 Improve Rust analysis PR check 
Also run the `rust` checks on "milestone" CLI releases, to ensure we
remain backward compatible with those versions. This was prompted by
https://github.com/github/codeql-action/pull/2960#pullrequestreview-3104730221

Running this on current `main` and then on that PR should improve our
confidence we remain backward compatible.

It also turns out a probable `ruamel.yaml` update was changing a lot of
generated workflows, so I've:
* fixed the `ruamel.yaml` version to the latest in `sync.sh`
* added `yaml.width = 120` in `sync.py` to minimize (but not entirely
  remove) the number of changes
* checked in the workflows whose formatting was changed by the new
  `ruamel.yaml` version
 2025-08-11 14:58:50 +02:00
Chuan-kai Lin
88d99b3033 Stop testing stable-v2.16.6 2025-07-29 09:14:16 -07:00
Michael B. Gale
8f71d47b93 Add installGo input for adding setup-go step in sync.py 2025-06-16 12:28:23 +01:00
Henry Mercer
7419bc61b3 Update CodeQL versions in generated workflows 2025-05-30 17:52:01 +01:00