github/codeql-action
1
0
Fork 0
mirror of https://github.com/github/codeql-action.git synced 2026-10-03 17:41:28 +00:00
Code Issues Packages Projects Releases Wiki Activity
10,287 Commits 445 Branches 589 Tags
ccd5275aa4e05dc04af2de7c55dd2272269ecc6d
Commit Graph

160 Commits

Author SHA1 Message Date
Mario Campos
be555cf0a3 Extend scripts/changetool as a NPM workspace 2026-08-26 23:25:06 -05:00
Mario Campos
426c10420b Create changetool script for validating change-notes 2026-08-26 17:13:40 -05:00
dependabot[bot]
8a0be82efa Bump the actions-minor group across 1 directory with 3 updates 
Bumps the actions-minor group with 3 updates in the /.github/workflows directory: [actions/checkout](https://github.com/actions/checkout), [actions/setup-java](https://github.com/actions/setup-java) and [ruby/setup-ruby](https://github.com/ruby/setup-ruby).


Updates `actions/checkout` from 7.0.0 to 7.0.1
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](9c091bb21b...3d3c42e5aa)

Updates `actions/setup-java` from 5.5.0 to 5.6.0
- [Release notes](https://github.com/actions/setup-java/releases)
- [Commits](0f481fcb61...03ad4de099)

Updates `ruby/setup-ruby` from 1.316.0 to 1.319.0
- [Release notes](https://github.com/ruby/setup-ruby/releases)
- [Changelog](https://github.com/ruby/setup-ruby/blob/master/release.rb)
- [Commits](d45b1a4e94...003a5c4d8d)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 7.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions-minor
- dependency-name: actions/setup-java
  dependency-version: 5.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions-minor
- dependency-name: ruby/setup-ruby
  dependency-version: 1.319.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-22 17:57:43 +00:00
dependabot[bot]
db76a66b98 Bump actions/setup-node from 6.4.0 to 7.0.0 in /.github/workflows 
Bumps [actions/setup-node](https://github.com/actions/setup-node) from 6.4.0 to 7.0.0.
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](48b55a011b...8207627860)

---
updated-dependencies:
- dependency-name: actions/setup-node
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-15 17:57:52 +00:00
dependabot[bot]
490a5f655c Bump actions/checkout from 6.0.3 to 7.0.0 in /.github/workflows 
Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.3 to 7.0.0.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](df4cb1c069...9c091bb21b)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-06-24 17:58:21 +00:00
Michael B. Gale
e3a04b7473 Remove ready_for_review triggers 2026-06-22 13:19:40 +01:00
Henry Mercer
72f4abcfcc Use local upload-sarif Action in PR checks job 2026-06-04 16:45:01 +01:00
Henry Mercer
87f4948cb0 Pin first-party Actions 2026-06-03 17:19:36 +01:00
Henry Mercer
84498526a0 Merge pull request #3910 from github/henrymercer/repo-size-diff-check 
Action size: Add a PR check that comments on significant repo size changes
 2026-05-21 10:29:33 +00:00
Henry Mercer
8ffeae7d05 CI: Automatically cancel non-generated workflows 
Specify concurrency groups for non-generated workflows so we can cancel in-progress runs when new commits are pushed to a PR.
 2026-05-20 16:39:16 +01:00
Henry Mercer
a14f75e3ac Address review comments 2026-05-20 15:39:14 +01:00
Henry Mercer
2c8faa5e9f Pass comment body file directly 2026-05-18 20:28:53 +01:00
Henry Mercer
15a712bbc2 Address review comments 2026-05-18 20:08:43 +01:00
Henry Mercer
9b6438e936 Tweak workflow 2026-05-18 18:25:26 +01:00
Henry Mercer
bcffb2b658 Unify checks into a single job 2026-05-18 17:33:45 +01:00
Michael B. Gale
136b8ab377 Remove cache-dependency-path options as well 2026-03-13 10:46:40 +00:00
Michael B. Gale
fc8d303906 Add step (in root directory) to install dependencies 2026-03-12 22:39:45 +00:00
Michael B. Gale
3bc3228be2 Add explicit cache dependency paths in pr-checks.yml 2026-03-12 22:39:45 +00:00
Michael B. Gale
d1a7580bd3 Verify PR checks in a different job, with newer Node 2026-03-11 12:29:36 +00:00
Michael B. Gale
24fa947692 Update pr-checks to run new tests 2026-03-03 11:40:54 +00:00
Henry Mercer
f379c46d49 Address review comments 2026-02-25 15:26:48 +00:00
Henry Mercer
8105503f1a Add merge_group trigger to required checks to prepare for merge queue 2026-02-25 15:12:37 +00:00
dependabot[bot]
5bd8069afb Bump actions/checkout from 5 to 6 in /.github/workflows 
Bumps [actions/checkout](https://github.com/actions/checkout) from 5 to 6.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/v5...v6)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2025-11-24 18:01:10 +00:00
dependabot[bot]
53588c5ad2 Bump actions/setup-node from 5 to 6 in /.github/workflows 
Bumps [actions/setup-node](https://github.com/actions/setup-node) from 5 to 6.
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](https://github.com/actions/setup-node/compare/v5...v6)

---
updated-dependencies:
- dependency-name: actions/setup-node
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2025-10-20 17:26:07 +00:00
dependabot[bot]
452186448a Bump github/codeql-action from 3 to 4 in /.github/workflows 
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3 to 4.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/v3...v4)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: '4'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2025-10-10 13:48:11 +00:00
Mario Campos
54ae8ba5b1 Simplify PR check by reverting changes to @types/node. 2025-10-02 14:24:46 -05:00
Mario Campos
d4bbcb74ca Implement simultaneous PR checks for Node.js v20, v24. 
Copied from #2006.
 2025-09-30 14:11:13 -05:00
Mario Campos
180438161e Specify Node.js v24 in actions/setup-node steps. 2025-09-30 14:11:13 -05:00
Mario Campos
d7ada03e02 Downgrade upload-sarif@v4 -> v3 
I got ahead of myself; v4 hasn't been tagged yet.
 2025-09-30 14:11:13 -05:00
Mario Campos
7434149006 Upgrade Node.js version to 24. 
This requires creating a new major-version (v4) of codeql-action.
 2025-09-30 13:56:31 -05:00
Michael B. Gale
6a72568b19 Run more checks in unit-tests job, even when previous checks failed 2025-09-25 13:27:32 +01:00
Michael B. Gale
3183e6b8f9 Skip non-generated workflows for Dependabot 2025-09-24 12:49:31 +01:00
Henry Mercer
944aa7df3d Merge pull request #3088 from github/dependabot/github_actions/actions-f739f361ea 
Bump the actions group with 4 updates
 2025-09-23 13:48:16 +01:00
Henry Mercer
d08f929510 Run test script in CI 2025-09-10 18:12:29 +01:00
Paolo Tranquilli
0c065fa4cf Sort out windows CRLF mess 2025-09-09 14:00:28 +02:00
Paolo Tranquilli
1b8f0ffedf Set shell: bash by default on all workflows 2025-09-09 12:19:45 +02:00
dependabot[bot]
1a80c9b44e Bump the actions group with 4 updates 
Bumps the actions group with 4 updates: [actions/setup-go](https://github.com/actions/setup-go), [actions/github-script](https://github.com/actions/github-script), [actions/setup-node](https://github.com/actions/setup-node) and [actions/setup-python](https://github.com/actions/setup-python).


Updates `actions/setup-go` from 5 to 6
- [Release notes](https://github.com/actions/setup-go/releases)
- [Commits](https://github.com/actions/setup-go/compare/v5...v6)

Updates `actions/github-script` from 7 to 8
- [Release notes](https://github.com/actions/github-script/releases)
- [Commits](https://github.com/actions/github-script/compare/v7...v8)

Updates `actions/setup-node` from 4 to 5
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](https://github.com/actions/setup-node/compare/v4...v5)

Updates `actions/setup-python` from 5 to 6
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](https://github.com/actions/setup-python/compare/v5...v6)

---
updated-dependencies:
- dependency-name: actions/setup-go
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: actions/github-script
  dependency-version: '8'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: actions/setup-node
  dependency-version: '5'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: actions/setup-python
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <support@github.com>
 2025-09-08 17:54:44 +00:00
Henry Mercer
4da503e0f5 Use npm ci in CI 2025-08-21 18:48:23 +01:00
Henry Mercer
d8905c2090 Don't run linter in CI on Windows 
It isn't working, and this PR didn't break it.  Let's fix it in a separate PR.
 2025-08-21 14:02:46 +01:00
Henry Mercer
a2df83b478 Cache npm dependencies 2025-08-21 13:59:19 +01:00
Henry Mercer
3edad3eebd Combine basic jobs to reduce Actions usage 2025-08-21 13:55:22 +01:00
Henry Mercer
06f83b7cc8 Run more checks on push 2025-08-21 13:51:34 +01:00
Henry Mercer
31ee7f54d3 Install dependencies in PR checks 2025-08-21 13:49:32 +01:00
Henry Mercer
6d34e4e857 Use "Rebuild" workflow instead of "Update dependencies" 2025-08-21 13:47:21 +01:00
Henry Mercer
9dfbcfd29f Merge pull request #3025 from github/dependabot/github_actions/actions-b7431406fe 
Bump the actions group with 3 updates
 2025-08-12 12:24:05 +01:00
dependabot[bot]
b1bfc45906 Bump the actions group with 3 updates 
Bumps the actions group with 3 updates: [actions/checkout](https://github.com/actions/checkout), [actions/download-artifact](https://github.com/actions/download-artifact) and [actions/create-github-app-token](https://github.com/actions/create-github-app-token).


Updates `actions/checkout` from 4 to 5
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/v4...v5)

Updates `actions/download-artifact` from 4 to 5
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](https://github.com/actions/download-artifact/compare/v4...v5)

Updates `actions/create-github-app-token` from 2.0.6 to 2.1.1
- [Release notes](https://github.com/actions/create-github-app-token/releases)
- [Commits](https://github.com/actions/create-github-app-token/compare/v2.0.6...v2.1.1)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: '5'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: actions/download-artifact
  dependency-version: '5'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: actions/create-github-app-token
  dependency-version: 2.1.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <support@github.com>
 2025-08-12 02:10:43 +00:00
Paolo Tranquilli
286b9e9d74 Specify the ruamel.yaml version in one place only (sync.sh) 2025-08-11 15:38:32 +02:00
Henry Mercer
9cd802ec12 Give only read-level security-events permission where possible 2025-01-24 13:27:33 +00:00
Henry Mercer
d39065943f Add missing permissions 2025-01-24 13:21:05 +00:00
Henry Mercer
048b0a2fc9 Remove Node 16 compilation PR check 2025-01-15 13:59:30 +00:00