Skip to content

Commit e09b8db

Browse files
committed
Merge remote-tracking branch 'origin/main' into mbg/bundle-metadata-improvements
2 parents 6e368b7 + a6109b1 commit e09b8db

76 files changed

Lines changed: 122159 additions & 117751 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

.github/dependabot.yml

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,9 @@
11
version: 2
22
updates:
33
- package-ecosystem: npm
4-
directory: "/"
4+
directories:
5+
- "/"
6+
- "/pr-checks"
57
schedule:
68
interval: weekly
79
cooldown:

.github/workflows/__rubocop-multi-language.yml

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

.github/workflows/deflake.yml

Lines changed: 106 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,106 @@
1+
# Workflow runs on main, on a release branch, and that were triggered as part of a merge group have
2+
# already passed CI before being merged. Therefore if they fail, we should make sure that there
3+
# wasn't a transient failure by rerunning the failed jobs once before investigating further.
4+
name: Deflake
5+
6+
on:
7+
workflow_run:
8+
types: [completed]
9+
# Exclude workflows that have significant side effects, like publishing releases. It's OK to
10+
# retry CodeQL analysis.
11+
workflows:
12+
- Check Expected Release Files
13+
- Code-Scanning config CLI tests
14+
- CodeQL action
15+
- Manual Check - go
16+
- "PR Check - All-platform bundle"
17+
- "PR Check - Analysis kinds"
18+
- "PR Check - Analyze: 'ref' and 'sha' from inputs"
19+
- "PR Check - autobuild-action"
20+
- "PR Check - Autobuild direct tracing (custom working directory)"
21+
- "PR Check - Autobuild working directory"
22+
- "PR Check - Build mode autobuild"
23+
- "PR Check - Build mode manual"
24+
- "PR Check - Build mode none"
25+
- "PR Check - Build mode rollback"
26+
- "PR Check - Bundle: Caching checks"
27+
- "PR Check - Bundle: From nightly"
28+
- "PR Check - Bundle: From toolcache"
29+
- "PR Check - Bundle: Zstandard checks"
30+
- "PR Check - C/C\\+\\+: autoinstalling dependencies (Linux)"
31+
- "PR Check - C/C\\+\\+: autoinstalling dependencies is skipped (macOS)"
32+
- "PR Check - C/C\\+\\+: disabling autoinstalling dependencies (Linux)"
33+
- "PR Check - Clean up database cluster directory"
34+
- "PR Check - CodeQL Bundle All"
35+
- "PR Check - Config export"
36+
- "PR Check - Config input"
37+
- "PR Check - Custom source root"
38+
- "PR Check - Debug artifact upload"
39+
- "PR Check - Debug artifacts after failure"
40+
- "PR Check - Diagnostic export"
41+
- "PR Check - Export file baseline information"
42+
- "PR Check - Extractor ram and threads options test"
43+
- "PR Check - Go: Custom queries"
44+
- "PR Check - Go: diagnostic when Go is changed after init step"
45+
- "PR Check - Go: diagnostic when `file` is not installed"
46+
- "PR Check - Go: tracing with autobuilder step"
47+
- "PR Check - Go: tracing with custom build steps"
48+
- "PR Check - Go: tracing with legacy workflow"
49+
- "PR Check - Go: workaround for indirect tracing"
50+
- "PR Check - Job run UUID added to SARIF"
51+
- "PR Check - Language aliases"
52+
- "PR Check - Local CodeQL bundle"
53+
- "PR Check - Multi-language repository"
54+
- "PR Check - Overlay database init fallback"
55+
- "PR Check - Packaging: Action input"
56+
- "PR Check - Packaging: Config and input"
57+
- "PR Check - Packaging: Config and input passed to the CLI"
58+
- "PR Check - Packaging: Config file"
59+
- "PR Check - Packaging: Download using registries"
60+
- "PR Check - Proxy test"
61+
- "PR Check - Remote config file"
62+
- "PR Check - Resolve environment"
63+
- "PR Check - RuboCop multi-language"
64+
- "PR Check - Ruby analysis"
65+
- "PR Check - Rust analysis"
66+
- "PR Check - Split workflow"
67+
- "PR Check - Start proxy"
68+
- "PR Check - Submit SARIF after failure"
69+
- "PR Check - Swift analysis using a custom build command"
70+
- "PR Check - Swift analysis using autobuild"
71+
- "PR Check - Test different uses of `upload-sarif`"
72+
- "PR Check - Test unsetting environment variables"
73+
- "PR Check - Upload-sarif: ref and sha from inputs"
74+
- "PR Check - Use a custom `checkout_path`"
75+
- PR Checks
76+
- Query filters tests
77+
- Test that the workaround for python 3.12 on windows works
78+
79+
jobs:
80+
rerun-on-failure:
81+
name: Rerun failed jobs
82+
if: >-
83+
github.event.workflow_run.conclusion == 'failure' &&
84+
github.event.workflow_run.run_attempt == 1 &&
85+
(
86+
github.event.workflow_run.head_branch == 'main' ||
87+
startsWith(github.event.workflow_run.head_branch, 'releases/') ||
88+
github.event.workflow_run.event == 'merge_group'
89+
)
90+
runs-on: ubuntu-slim
91+
permissions:
92+
actions: write
93+
steps:
94+
- name: Rerun failed jobs in ${{ github.event.workflow_run.name }}
95+
env:
96+
GH_TOKEN: ${{ github.token }}
97+
GH_REPO: ${{ github.repository }}
98+
RUN_ID: ${{ github.event.workflow_run.id }}
99+
RUN_NAME: ${{ github.event.workflow_run.name }}
100+
RUN_URL: ${{ github.event.workflow_run.html_url }}
101+
run: |
102+
echo "Rerunning failed jobs for workflow run ${RUN_ID}"
103+
gh run rerun "${RUN_ID}" --failed
104+
echo "### Reran failed jobs :recycle:" >> "$GITHUB_STEP_SUMMARY"
105+
echo "" >> "$GITHUB_STEP_SUMMARY"
106+
echo "Workflow: [${RUN_NAME}](${RUN_URL})" >> "$GITHUB_STEP_SUMMARY"

.github/workflows/post-release-mergeback.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -131,7 +131,7 @@ jobs:
131131
echo "::endgroup::"
132132
133133
- name: Generate token
134-
uses: actions/create-github-app-token@v3.0.0
134+
uses: actions/create-github-app-token@v3.1.1
135135
id: app-token
136136
with:
137137
app-id: ${{ vars.AUTOMATION_APP_ID }}

.github/workflows/rollback-release.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -136,7 +136,7 @@ jobs:
136136
137137
- name: Generate token
138138
if: github.event_name == 'workflow_dispatch'
139-
uses: actions/create-github-app-token@v3.0.0
139+
uses: actions/create-github-app-token@v3.1.1
140140
id: app-token
141141
with:
142142
app-id: ${{ vars.AUTOMATION_APP_ID }}

.github/workflows/update-bundle.yml

Lines changed: 2 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -63,13 +63,10 @@ jobs:
6363
with:
6464
tools: https://github.com/github/codeql-action/releases/download/${{ github.event.release.tag_name }}/codeql-bundle-linux64.tar.gz
6565

66-
- name: Update language aliases
66+
- name: Update built-in languages
67+
run: npx tsx pr-checks/update-builtin-languages.ts "$CODEQL_PATH"
6768
env:
6869
CODEQL_PATH: ${{ steps.setup-codeql.outputs.codeql-path }}
69-
run: |
70-
"$CODEQL_PATH" resolve languages --format=betterjson --extractor-include-aliases \
71-
| jq -S '.aliases // {}' \
72-
> src/known-language-aliases.json
7370

7471
- name: Bump Action minor version if new CodeQL minor version series
7572
id: bump-action-version

.github/workflows/update-release-branch.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -93,7 +93,7 @@ jobs:
9393
pull-requests: write # needed to create pull request
9494
steps:
9595
- name: Generate token
96-
uses: actions/create-github-app-token@v3.0.0
96+
uses: actions/create-github-app-token@v3.1.1
9797
id: app-token
9898
with:
9999
app-id: ${{ vars.AUTOMATION_APP_ID }}

CHANGELOG.md

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,10 +4,16 @@ See the [releases page](https://github.com/github/codeql-action/releases) for th
44

55
## [UNRELEASED]
66

7+
- Fixed a bug where two diagnostics produced within the same millisecond could overwrite each other on disk, causing one of them to be lost. [#3852](https://github.com/github/codeql-action/pull/3852)
8+
- _Upcoming breaking change_: Add a deprecation warning for customers using CodeQL version 2.19.3 and earlier. These versions of CodeQL were discontinued on 9 April 2026 alongside GitHub Enterprise Server 3.15, and will be unsupported by the next minor release of the CodeQL Action. [#3837](https://github.com/github/codeql-action/pull/3837)
9+
10+
## 4.35.2 - 15 Apr 2026
11+
712
- The undocumented TRAP cache cleanup feature that could be enabled using the `CODEQL_ACTION_CLEANUP_TRAP_CACHES` environment variable is deprecated and will be removed in May 2026. If you are affected by this, we recommend disabling TRAP caching by passing the `trap-caching: false` input to the `init` Action. [#3795](https://github.com/github/codeql-action/pull/3795)
813
- The Git version 2.36.0 requirement for improved incremental analysis now only applies to repositories that contain submodules. [#3789](https://github.com/github/codeql-action/pull/3789)
914
- Python analysis on GHES no longer extracts the standard library, relying instead on models of the standard library. This should result in significantly faster extraction and analysis times, while the effect on alerts should be minimal. [#3794](https://github.com/github/codeql-action/pull/3794)
1015
- Fixed a bug in the validation of OIDC configurations for private registries that was added in CodeQL Action 4.33.0 / 3.33.0. [#3807](https://github.com/github/codeql-action/pull/3807)
16+
- Update default CodeQL bundle version to [2.25.2](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.2). [#3823](https://github.com/github/codeql-action/pull/3823)
1117

1218
## 4.35.1 - 27 Mar 2026
1319

README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -72,6 +72,7 @@ We typically release new minor versions of the CodeQL Action and Bundle when a n
7272

7373
| Minimum CodeQL Action | Minimum CodeQL Bundle Version | GitHub Environment | Notes |
7474
|-----------------------|-------------------------------|--------------------|-------|
75+
| `v4.33.0` | `2.24.3` | Enterprise Server 3.21 | |
7576
| `v4.31.10` | `2.23.9` | Enterprise Server 3.20 | |
7677
| `v3.29.11` | `2.22.4` | Enterprise Server 3.19 | |
7778
| `v3.28.21` | `2.21.3` | Enterprise Server 3.18 | |

0 commit comments

Comments
 (0)