github/codeql-action
1
0
Fork 0
mirror of https://github.com/github/codeql-action.git synced 2026-10-03 09:14:58 +00:00
Code Issues Packages Projects Releases Wiki Activity
10,345 Commits 445 Branches 589 Tags
d40707c73d115ffa5dc893675e3c46fd40386f6b
Commit Graph

10345 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
dependabot[bot]
d40707c73d Bump the npm-minor group across 1 directory with 6 updates 
Bumps the npm-minor group with 6 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@octokit/core](https://github.com/octokit/core.js) | `7.0.7` | `7.0.8` |
| [js-yaml](https://github.com/nodeca/js-yaml) | `5.4.0` | `5.4.1` |
| [eslint-plugin-jsdoc](https://github.com/gajus/eslint-plugin-jsdoc) | `64.2.1` | `64.3.4` |
| [globals](https://github.com/sindresorhus/globals) | `17.11.0` | `17.12.0` |
| [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) | `8.68.0` | `8.69.0` |
| [tsx](https://github.com/privatenumber/tsx) | `4.23.12` | `4.23.13` |



Updates `@octokit/core` from 7.0.7 to 7.0.8
- [Release notes](https://github.com/octokit/core.js/releases)
- [Commits](https://github.com/octokit/core.js/compare/v7.0.7...v7.0.8)

Updates `js-yaml` from 5.4.0 to 5.4.1
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](https://github.com/nodeca/js-yaml/compare/5.4.0...5.4.1)

Updates `eslint-plugin-jsdoc` from 64.2.1 to 64.3.4
- [Release notes](https://github.com/gajus/eslint-plugin-jsdoc/releases)
- [Commits](https://github.com/gajus/eslint-plugin-jsdoc/compare/v64.2.1...v64.3.4)

Updates `globals` from 17.11.0 to 17.12.0
- [Release notes](https://github.com/sindresorhus/globals/releases)
- [Commits](https://github.com/sindresorhus/globals/compare/v17.11.0...v17.12.0)

Updates `typescript-eslint` from 8.68.0 to 8.69.0
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.69.0/packages/typescript-eslint)

Updates `tsx` from 4.23.12 to 4.23.13
- [Release notes](https://github.com/privatenumber/tsx/releases)
- [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs)
- [Commits](https://github.com/privatenumber/tsx/compare/v4.23.12...v4.23.13)

---
updated-dependencies:
- dependency-name: "@octokit/core"
  dependency-version: 7.0.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor
- dependency-name: js-yaml
  dependency-version: 5.4.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor
- dependency-name: eslint-plugin-jsdoc
  dependency-version: 64.3.4
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor
- dependency-name: globals
  dependency-version: 17.12.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor
- dependency-name: typescript-eslint
  dependency-version: 8.69.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor
- dependency-name: tsx
  dependency-version: 4.23.13
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-09-09 17:54:35 +00:00
Henry Mercer
e855781840 Merge pull request #4132 from github/mergeback/v4.38.0-to-main-b96794f0 
Mergeback v4.38.0 refs/heads/releases/v4 into main
 2026-09-09 15:16:08 +00:00
github-actions[bot]
23a5edca55 Rebuild 2026-09-09 14:04:19 +00:00
github-actions[bot]
6f5a84b5b5 Update changelog and version after v4.38.0 2026-09-09 14:04:04 +00:00
Henry Mercer
b96794f015 Merge pull request #4131 from github/update-v4.38.0-7e08580a9 
Merge main into releases/v4
v4.38.0 		2026-09-09 15:02:30 +01:00
github-actions[bot]
02d5093871 Update changelog for v4.38.0 2026-09-09 12:33:07 +00:00
Henry Mercer
7e08580a93 Merge pull request #4130 from github/henrymercer/workflow-runner-sizing 
Run slow macOS checks on larger runners
 2026-09-09 12:16:50 +00:00
Henry Mercer
bfcc52b4f5 Run slow macOS checks on larger runners 
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
 2026-09-09 12:57:40 +01:00
Henry Mercer
8c251e757c Merge pull request #4129 from github/update-bundle/codeql-bundle-v2.27.0 
Update default bundle to 2.27.0
 2026-09-09 11:48:16 +00:00
github-actions[bot]
0b7ca400df Add changelog note 2026-09-09 11:33:54 +00:00
github-actions[bot]
40484b3395 Update default bundle to codeql-bundle-v2.27.0 2026-09-09 11:33:48 +00:00
Henry Mercer
977e6ceaea Merge pull request #4124 from github/henrymercer/toolcache-bundle-cleanup 
Delete unused CodeQL bundles from the toolcache before downloading
codeql-bundle-v2.27.0 		2026-09-08 17:04:25 +00:00
Henry Mercer
40a6b38247 Address toolcache cleanup review feedback 
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
 2026-09-08 15:55:41 +01:00
Henry Mercer
deece8f852 Apply suggestion from @henrymercer 2026-09-07 14:08:36 +01:00
copilot-swe-agent[bot]
034db721dd Merge remote-tracking branch 'origin/main' into henrymercer/toolcache-bundle-cleanup 
Co-authored-by: henrymercer <14129055+henrymercer@users.noreply.github.com>
 2026-09-07 12:57:51 +00:00
Henry Mercer
313a0b9922 Merge pull request #4122 from github/henrymercer/friendly-potato 
Don't record an overlay status when the job was cancelled
 2026-09-04 16:55:52 +00:00
Henry Mercer
31da345c07 Address review comments 
Delete each version directory individually so that a symlinked one is skipped rather than removed, take an `ActionState` so the environment is read through `ReadOnlyEnv` rather than the deprecated `getOptionalEnvVar`, let `deleteToolcacheBundles` report its own failure to locate the toolcache instead of having the caller catch it, quote paths in log messages, and rename `HAS_OBTAINED_CODEQL_TOOLS` to `HAS_SET_UP_CODEQL`, which is also set when we find the tools in the toolcache rather than downloading them.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
 2026-09-04 17:43:40 +01:00
Henry Mercer
46dfb14111 Merge pull request #4123 from github/redsun82-address-pr-4072-comments 
Analyze all supported languages in the Linux Arm64 check
 2026-09-04 16:39:50 +00:00
Henry Mercer
e06b60f75f Merge pull request #4125 from github/henrymercer/merge-queue-sarif-upload-flake 
Don't upload the ESLint SARIF from merge queue refs
 2026-09-04 16:37:26 +00:00
Henry Mercer
a48f2d3077 Record an overlay status only for conclusive job statuses 
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
 2026-09-04 17:33:02 +01:00
Henry Mercer
657964c39f Read the job status from a ReadOnlyEnv in recordOverlayStatus 
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
 2026-09-04 17:31:24 +01:00
Henry Mercer
d2fe508a6d Don't upload the ESLint SARIF from merge queue refs 
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
 2026-09-04 17:22:52 +01:00
Paolo Tranquilli
16da74769e Log found databases in Linux Arm64 check 
Log a success line for each language database found in the Linux Arm64 PR check.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
 2026-09-04 12:27:23 +02:00
Henry Mercer
e13c3dc834 Only clean up a toolcache on the workspace filesystem 
Some runner images keep the toolcache on a different volume to the workspace, so deleting the tools there frees up disk space that the analysis cannot use, and costs a later step that wanted them in the toolcache a download. Windows runners are laid out this way, with the toolcache on `C:` and the workspace on `D:`.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
 2026-09-04 11:00:56 +01:00
Henry Mercer
1331773b9a Address Copilot review feedback 
Run the cleanup even when the download will not be cached in the toolcache, since the toolcache shares a filesystem with the directory we extract to, so freeing it helps either way, and report an error other than the toolcache being absent as a failure rather than as an empty toolcache.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
 2026-09-04 10:26:09 +01:00
Henry Mercer
2681b03bd6 Add a changelog note 
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
 2026-09-04 10:18:43 +01:00
Henry Mercer
a7a90f3ffb Enable toolcache cleanup in the multi-language PR check 
The check installs the tools from a URL, so most versions in its matrix are downloaded rather than found in the toolcache, which is when the cleanup runs, and it then builds and analyses seven languages, so a bundle we damaged on the way in would show up.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
 2026-09-04 10:12:11 +01:00
Henry Mercer
4a0b22ec25 Delete unused CodeQL bundles from the toolcache before downloading 
When we download a bundle the toolcache often already holds a different one that the job will not use, and on GitHub-hosted runners it shares a filesystem with the workspace, so it takes space away from the analysis. Empty the toolcache before downloading, which also frees space for the archive during extraction, and which is safe because getting as far as a download means the tools were not resolved from the toolcache. Skip this once a step has obtained the tools, since a later step may run a path it was given, and gate it on the runner being GitHub-hosted and on a feature flag that is off by default.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
 2026-09-04 10:12:10 +01:00
Henry Mercer
762a5ed7f7 Add a helper to delete the CodeQL tools from the toolcache 
`deleteToolcacheBundles` removes `$RUNNER_TOOL_CACHE/CodeQL` and reports which versions were there. It refuses to follow a symlinked CodeQL directory so that it can only ever delete paths that are really inside the toolcache, and reports failures rather than throwing. Not called yet.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
 2026-09-04 10:12:10 +01:00
Henry Mercer
ceb85f25b5 Distinguish GitHub-hosted runners from ones that look hosted 
`isHostedRunner` infers hostedness from the runner name and the toolcache path, so it also matches self-hosted runners that are configured to resemble hosted ones. Rename it to `looksLikeHostedRunner` so callers can see they are getting a heuristic, and add `isGitHubHostedRunner`, which reads the `RUNNER_ENVIRONMENT` value the Actions service reports. The existing callers keep the heuristic, so there is no behaviour change.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
 2026-09-04 10:12:09 +01:00
Henry Mercer
9fddc16f0d Merge pull request #4088 from github/dependabot/npm_and_yarn/octokit/plugin-rest-endpoint-methods-18.0.0 
Bump @octokit/plugin-rest-endpoint-methods from 17.0.0 to 18.0.0
 2026-09-04 07:23:47 +00:00
Paolo Tranquilli
36cbf13b5e Address review comments 
- Analyze all languages CodeQL supports on Linux Arm64 (except Swift,
  which is macOS only) in the Linux Arm64 check, building the compiled
  ones via the shared multi-language-repo build.sh
- De-duplicate the check's language list via a shared LANGUAGES env var
  used by both the init input and the assert loop
- Fix CHANGELOG tense: "download" -> "downloads"

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
 2026-09-04 08:30:10 +02:00
Henry Mercer
38dd4a088a Don't record an overlay status when the job was cancelled 
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
 2026-09-03 18:21:46 +01:00
Henry Mercer
2f3c1c964a Add an internal job-status input to the init Action 
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
 2026-09-03 18:21:14 +01:00
Michael B. Gale
5914b031b1 Merge pull request #4111 from github/dependabot/github_actions/dot-github/workflows/actions/setup-java-6.0.0 
Bump actions/setup-java from 5.7.0 to 6.0.0 in /.github/workflows
 2026-09-03 16:50:30 +00:00
Michael B. Gale
102499482f Merge pull request #4119 from github/dependabot/npm_and_yarn/npm-minor-21ac56865f 
Bump the npm-minor group across 1 directory with 2 updates
 2026-09-03 16:22:14 +00:00
Michael B. Gale
9401a335a3 Merge pull request #4118 from github/dependabot/npm_and_yarn/browserslist-4.28.8 
Bump browserslist from 4.24.2 to 4.28.8
 2026-09-03 16:21:07 +00:00
Michael B. Gale
3ee8a9398b Merge branch 'main' into dependabot/npm_and_yarn/browserslist-4.28.8 2026-09-03 17:03:16 +01:00
Michael B. Gale
25da1b1495 Merge branch 'main' into dependabot/npm_and_yarn/npm-minor-21ac56865f 2026-09-03 17:00:00 +01:00
Michael B. Gale
9509fd0822 Merge pull request #4120 from github/dependabot/npm_and_yarn/eslint-plugin-jsdoc-64.2.1 
Bump eslint-plugin-jsdoc from 62.9.0 to 64.2.1
 2026-09-03 15:58:16 +00:00
Michael B. Gale
20ec60c2d9 Merge branch 'main' into dependabot/npm_and_yarn/eslint-plugin-jsdoc-64.2.1 2026-09-03 15:12:29 +01:00
Paolo Tranquilli
4cccb3aa86 Merge pull request #4072 from github/redsun82-linux-arm64-support 
Add support for Linux Arm64 runners
 2026-09-03 13:58:15 +00:00
github-actions[bot]
b724a86493 Rebuild 2026-09-02 17:56:48 +00:00
dependabot[bot]
2a03009e3f Bump eslint-plugin-jsdoc from 62.9.0 to 64.2.1 
Bumps [eslint-plugin-jsdoc](https://github.com/gajus/eslint-plugin-jsdoc) from 62.9.0 to 64.2.1.
- [Release notes](https://github.com/gajus/eslint-plugin-jsdoc/releases)
- [Commits](https://github.com/gajus/eslint-plugin-jsdoc/compare/v62.9.0...v64.2.1)

---
updated-dependencies:
- dependency-name: eslint-plugin-jsdoc
  dependency-version: 64.2.1
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-09-02 17:55:01 +00:00
dependabot[bot]
da21771e2e Bump the npm-minor group across 1 directory with 2 updates 
Bumps the npm-minor group with 2 updates in the / directory: [js-yaml](https://github.com/nodeca/js-yaml) and [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint).


Updates `js-yaml` from 5.3.0 to 5.4.0
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](https://github.com/nodeca/js-yaml/compare/5.3.0...5.4.0)

Updates `typescript-eslint` from 8.67.0 to 8.68.0
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.68.0/packages/typescript-eslint)

---
updated-dependencies:
- dependency-name: js-yaml
  dependency-version: 5.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor
- dependency-name: typescript-eslint
  dependency-version: 8.68.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-09-02 17:54:50 +00:00
dependabot[bot]
bb36f8049c Bump browserslist from 4.24.2 to 4.28.8 
Bumps [browserslist](https://github.com/browserslist/browserslist) from 4.24.2 to 4.28.8.
- [Release notes](https://github.com/browserslist/browserslist/releases)
- [Changelog](https://github.com/browserslist/browserslist/blob/main/CHANGELOG.md)
- [Commits](https://github.com/browserslist/browserslist/compare/4.24.2...4.28.8)

---
updated-dependencies:
- dependency-name: browserslist
  dependency-version: 4.28.8
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-09-02 13:55:34 +00:00
Michael B. Gale
276e2ce25d Merge pull request #4117 from github/mbg/deps/1sep 
Update dependencies
 2026-09-02 13:39:31 +00:00
Michael B. Gale
ccd5275aa4 Merge branch 'main' into dependabot/github_actions/dot-github/workflows/actions/setup-java-6.0.0 2026-09-02 14:36:24 +01:00
Mario Campos
a0c73122a6 Merge pull request #4096 from github/mario-campos/use-json-module 
Use `json` module for JSON validation in `output-cache`
 2026-09-01 15:17:48 +00:00
Michael B. Gale
50e244824e Update dependencies 2026-09-01 12:16:07 +01:00