github/codeql-action
1
0
Fork 0
mirror of https://github.com/github/codeql-action.git synced 2026-10-03 17:41:28 +00:00
Code Issues Packages Projects Releases Wiki Activity
10,472 Commits 445 Branches 589 Tags
v4
Commit Graph

1406 Commits

Author SHA1 Message Date
Henry Mercer
bcffb2b658 Unify checks into a single job 2026-05-18 17:33:45 +01:00
Henry Mercer
4fc0f3e51b Add a PR check that comments on significant repo size changes 2026-05-18 16:36:58 +01:00
Henry Mercer
05e8f288eb Merge branch 'main' into henrymercer/require-codeql-2.19.4 2026-05-15 18:13:43 +01:00
Henry Mercer
93c8a9ed99 Update update-release-branch.py to take token from stdin 2026-05-15 14:53:43 +01:00
Henry Mercer
67f403822c Merge pull request #3903 from github/henrymercer/macos-larger-runners 
PR checks: Run slowest macOS checks on larger runners
 2026-05-15 13:32:01 +00:00
Henry Mercer
1b65777c19 Address review comments 2026-05-14 18:13:20 +01:00
Henry Mercer
a32db48565 Move checks back to default runners 
These jobs are not rate-limiting so we don't need to run them on larger runners.
 2026-05-14 17:57:11 +01:00
Henry Mercer
aa005faaad PR checks: Run slowest macOS checks on larger runners 2026-05-14 17:29:44 +01:00
Sam Robson
9d7243005b Merge remote-tracking branch 'origin/main' into sam-robson/overlay-fallback 
* origin/main: (40 commits)
  Bump the npm-minor group across 1 directory with 3 updates
  Bump actions/create-github-app-token
  Nit: Tweak JSDoc for `getRawLanguagesNoAutodetect`
  Enable only `code-scanning`
  Use overlay-aware version for code scanning exclusively
  Add changelog entry
  Rebuild
  Bump five transitive dependencies
  Throw error if multiple analysis kinds are specified
  Bump fast-xml-builder from 1.1.5 to 1.2.0
  Improve tests
  Improve error message
  Remove dead code
  Remove `makeOverlayMatchFeatures` indirection
  Add JSDoc for `getRawLanguagesNoAutodetect`
  Enable overlay-aware version selection in `setup-codeql`
  Minor: Introduce constant to avoid duplication
  Improve changelog note
  Rebuild
  Update changelog and version after v4.35.4
  ...

# Conflicts:
#	lib/init-action.js
#	src/diff-informed-analysis-utils.test.ts
 2026-05-14 13:39:44 +01:00
dependabot[bot]
2a6fe1608c Bump actions/create-github-app-token 
Bumps the actions-minor group with 1 update in the /.github/workflows directory: [actions/create-github-app-token](https://github.com/actions/create-github-app-token).


Updates `actions/create-github-app-token` from 3.1.1 to 3.2.0
- [Release notes](https://github.com/actions/create-github-app-token/releases)
- [Changelog](https://github.com/actions/create-github-app-token/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/create-github-app-token/compare/v3.1.1...v3.2.0)

---
updated-dependencies:
- dependency-name: actions/create-github-app-token
  dependency-version: 3.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-05-13 18:28:51 +00:00
Henry Mercer
9c3aedb4cd Update PR check testing matrix 2026-05-13 14:25:03 +01:00
dependabot[bot]
aaef09c48d Bump ruby/setup-ruby 
Bumps the actions-minor group with 1 update in the /.github/workflows directory: [ruby/setup-ruby](https://github.com/ruby/setup-ruby).


Updates `ruby/setup-ruby` from 1.305.0 to 1.306.0
- [Release notes](https://github.com/ruby/setup-ruby/releases)
- [Changelog](https://github.com/ruby/setup-ruby/blob/master/release.rb)
- [Commits](0cb964fd54...c4e5b13161)

---
updated-dependencies:
- dependency-name: ruby/setup-ruby
  dependency-version: 1.306.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-05-07 13:21:45 +00:00
Sam Robson
e9e36aec74 test: drop codescanning-config-cli scenario for overlay without diff-informed 2026-04-30 16:39:05 +01:00
Michael B. Gale
022ff3c73f Merge remote-tracking branch 'origin/main' into mbg/private-registry/cloudsmith-gcp 2026-04-30 13:43:29 +01:00
dependabot[bot]
5145c112e7 Bump ruby/setup-ruby 
Bumps the actions-minor group with 1 update in the /.github/workflows directory: [ruby/setup-ruby](https://github.com/ruby/setup-ruby).


Updates `ruby/setup-ruby` from 1.301.0 to 1.305.0
- [Release notes](https://github.com/ruby/setup-ruby/releases)
- [Changelog](https://github.com/ruby/setup-ruby/blob/master/release.rb)
- [Commits](4c56a21280...0cb964fd54)

---
updated-dependencies:
- dependency-name: ruby/setup-ruby
  dependency-version: 1.305.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-04-29 18:00:14 +00:00
Michael B. Gale
0ed734b61b Ignore test files 2026-04-25 18:36:22 +01:00
Henry Mercer
f6a5638305 Escape "+"s in on.workflow_run.workflows 2026-04-22 11:14:07 +01:00
Henry Mercer
1dcdb940d5 Merge pull request #3830 from github/henrymercer/deflake 
Add workflow to rerun potentially transient failures
 2026-04-21 10:57:19 +00:00
Henry Mercer
79f9c0517c Merge remote-tracking branch 'origin/main' into henrymercer/record-all-builtin-languages 
# Conflicts:
#	lib/start-proxy-action.js
#	src/known-language-aliases.json
 2026-04-15 18:36:47 +01:00
Henry Mercer
3b3a77544b Rename job 
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
 2026-04-15 18:34:13 +01:00
Henry Mercer
9f95de42d6 Add workflow to rerun potentially transient failures 2026-04-15 18:28:17 +01:00
dependabot[bot]
c1403f094c Bump the actions-minor group across 1 directory with 2 updates 
Bumps the actions-minor group with 2 updates in the /.github/workflows directory: [ruby/setup-ruby](https://github.com/ruby/setup-ruby) and [actions/create-github-app-token](https://github.com/actions/create-github-app-token).


Updates `ruby/setup-ruby` from 1.295.0 to 1.300.0
- [Release notes](https://github.com/ruby/setup-ruby/releases)
- [Changelog](https://github.com/ruby/setup-ruby/blob/master/release.rb)
- [Commits](319994f95f...4c56a21280)

Updates `actions/create-github-app-token` from 3.0.0 to 3.1.1
- [Release notes](https://github.com/actions/create-github-app-token/releases)
- [Commits](https://github.com/actions/create-github-app-token/compare/v3.0.0...v3.1.1)

---
updated-dependencies:
- dependency-name: ruby/setup-ruby
  dependency-version: 1.300.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions-minor
- dependency-name: actions/create-github-app-token
  dependency-version: 3.1.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-04-13 17:27:57 +00:00
Henry Mercer
90d7616015 Merge branch 'main' into henrymercer/record-all-builtin-languages 2026-04-13 18:00:09 +01:00
Henry Mercer
97bcdd8c1e Move script to pr-checks directory 2026-04-13 16:49:10 +01:00
Henry Mercer
bad0a744dd Store all built-in languages 
While we want the CodeQL Action to work with third-party language support, having a list of all built-in languages can help us create better type-level checks to ensure that we don't miss things that we want to customize for each of our built-in languages.
 2026-04-10 19:09:46 +01:00
Michael B. Gale
b669eab7e3 Explicitly add pr-checks to Dependabot config 2026-04-10 16:58:30 +01:00
Henry Mercer
60991e61ac Merge pull request #3806 from github/henrymercer/store-language-aliases 
Store language aliases from linked CLI
 2026-04-10 09:16:45 +00:00
Henry Mercer
51d833290e Store language aliases from linked CLI 2026-04-09 17:10:15 +01:00
Henry Mercer
43d8420a42 Do not run Swift in debug artifacts after failure check 2026-04-09 15:18:51 +01:00
Henry Mercer
808513f048 Update language aliases test 2026-04-08 16:38:23 +01:00
Michael B. Gale
34950e1b11 Merge pull request #3792 from github/mario-campos/issue-1664 
Extend start-proxy.yml to test multiple registry support
 2026-04-01 13:59:59 +00:00
Mario Campos
e2203c62cf Delete fromJSON() calls in test validation step 2026-03-31 13:19:33 -05:00
Mario Campos
7b0c5b1669 Keep validation steps named consistently 2026-03-31 12:49:07 -05:00
Mario Campos
faf45e07f9 Use different maven URL for start-proxy.yml test 2026-03-31 12:44:43 -05:00
Mario Campos
8b5e60477c Use maven_repository, not maven-repository 
The registry/language mapping table does not map the one with hyphens.
 2026-03-31 11:36:17 -05:00
Mario Campos
99b8dd4d57 Run pr-checks/sync.sh to generate __start-proxy.yml. 2026-03-31 09:32:42 -05:00
Henry Mercer
353802f9f2 Move time-sensitive Actions workflows to ubuntu-latest 
We originally moved these to `ubuntu-slim`, but there is a significant performance difference.  Since we often find ourselves waiting on these jobs, let's use the faster runners.
 2026-03-27 16:22:19 +00:00
Michael B. Gale
9d3ec5727a Merge pull request #3770 from github/dependabot/github_actions/dot-github/workflows/actions-minor-266139ee1d 
Bump ruby/setup-ruby from 1.288.0 to 1.295.0 in /.github/workflows in the actions-minor group across 1 directory
 2026-03-26 16:32:19 +00:00
dependabot[bot]
a663d0174a Bump ruby/setup-ruby 
Bumps the actions-minor group with 1 update in the /.github/workflows directory: [ruby/setup-ruby](https://github.com/ruby/setup-ruby).


Updates `ruby/setup-ruby` from 1.288.0 to 1.295.0
- [Release notes](https://github.com/ruby/setup-ruby/releases)
- [Changelog](https://github.com/ruby/setup-ruby/blob/master/release.rb)
- [Commits](09a7688d3b...319994f95f)

---
updated-dependencies:
- dependency-name: ruby/setup-ruby
  dependency-version: 1.295.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-03-25 17:59:44 +00:00
Michael B. Gale
a5418e172c Delete releases.ini 2026-03-25 13:49:47 +00:00
Michael B. Gale
e7c7b68c5f Remove update-required-checks.sh 2026-03-25 13:38:28 +00:00
Michael B. Gale
fa568ebc69 Delete release-branches.py 2026-03-25 13:37:41 +00:00
Michael B. Gale
3db9a05c73 Replace release-branches.py with TS version in release-branches action 2026-03-25 13:16:30 +00:00
Michael B. Gale
aa2773169b Install node in release-initialise action 2026-03-25 13:16:30 +00:00
dependabot[bot]
23674c1f2a Bump actions/create-github-app-token in /.github/workflows 
Bumps [actions/create-github-app-token](https://github.com/actions/create-github-app-token) from 2.2.1 to 3.0.0.
- [Release notes](https://github.com/actions/create-github-app-token/releases)
- [Commits](https://github.com/actions/create-github-app-token/compare/v2.2.1...v3.0.0)

---
updated-dependencies:
- dependency-name: actions/create-github-app-token
  dependency-version: 3.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-03-18 18:10:06 +00:00
Michael B. Gale
136b8ab377 Remove cache-dependency-path options as well 2026-03-13 10:46:40 +00:00
Michael B. Gale
fc8d303906 Add step (in root directory) to install dependencies 2026-03-12 22:39:45 +00:00
Michael B. Gale
3bc3228be2 Add explicit cache dependency paths in pr-checks.yml 2026-03-12 22:39:45 +00:00
Michael B. Gale
967ca853e1 Rename sync_back to sync-back 2026-03-12 22:39:44 +00:00
Henry Mercer
378e4b367d Merge pull request #3568 from github/henrymercer/fix-rebuild 
Fix rebuild Action
 2026-03-11 19:18:28 +00:00