From d57cc916e8c983c1ca7f8a7119aa329ed0055b27 Mon Sep 17 00:00:00 2001 From: Henry Mercer Date: Mon, 20 Jul 2026 17:57:01 +0100 Subject: [PATCH 01/95] Remove Zstandard availability diagnostic Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- lib/entry-points.js | 30 +++++------------------------- src/codeql.ts | 4 ---- src/init-action.ts | 21 --------------------- src/init.ts | 4 ---- src/setup-codeql.ts | 2 -- 5 files changed, 5 insertions(+), 56 deletions(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index 41af9350b6..8c72430207 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -151260,8 +151260,7 @@ async function setupCodeQLBundle(toolsInput, apiDetails, tempDir, variant, defau codeqlFolder, toolsDownloadStatusReport, toolsSource, - toolsVersion, - zstdAvailability + toolsVersion }; } async function useZstdBundle(cliVersion2, tarSupportsZstd) { @@ -151395,8 +151394,7 @@ async function setupCodeQL(toolsInput, apiDetails, tempDir, variant, defaultCliV codeqlFolder, toolsDownloadStatusReport, toolsSource, - toolsVersion, - zstdAvailability + toolsVersion } = await setupCodeQLBundle( toolsInput, apiDetails, @@ -151426,8 +151424,7 @@ async function setupCodeQL(toolsInput, apiDetails, tempDir, variant, defaultCliV codeql: cachedCodeQL, toolsDownloadStatusReport, toolsSource, - toolsVersion, - zstdAvailability + toolsVersion }; } catch (rawError) { const e = wrapApiConfigurationError(rawError); @@ -154043,8 +154040,7 @@ async function initCodeQL(toolsInput, apiDetails, tempDir, variant, defaultCliVe codeql, toolsDownloadStatusReport, toolsSource, - toolsVersion, - zstdAvailability + toolsVersion } = await setupCodeQL( toolsInput, apiDetails, @@ -154063,8 +154059,7 @@ async function initCodeQL(toolsInput, apiDetails, tempDir, variant, defaultCliVe codeql, toolsDownloadStatusReport, toolsSource, - toolsVersion, - zstdAvailability + toolsVersion }; } async function initConfig2(actionState, inputs) { @@ -160673,7 +160668,6 @@ async function run3(actionState) { let toolsFeatureFlagsValid; let toolsSource; let toolsVersion; - let zstdAvailability; try { initializeEnvironment(getActionVersion()); persistInputs(); @@ -160746,7 +160740,6 @@ async function run3(actionState) { toolsDownloadStatusReport = initCodeQLResult.toolsDownloadStatusReport; toolsVersion = initCodeQLResult.toolsVersion; toolsSource = initCodeQLResult.toolsSource; - zstdAvailability = initCodeQLResult.zstdAvailability; await checkWorkflow(logger, codeql); if ( // Only enable the experimental features env variable for Rust analysis if the user has explicitly @@ -160877,9 +160870,6 @@ async function run3(actionState) { if (config.overlayDatabaseMode !== "overlay" /* Overlay */) { cleanupDatabaseClusterDirectory(config, logger); } - if (zstdAvailability) { - await recordZstdAvailability(config, zstdAvailability); - } if (toolsDownloadStatusReport) { addNoLanguageDiagnostic( config, @@ -161110,16 +161100,6 @@ async function loadRepositoryProperties(repositoryNwo, logger) { return new Failure(error3); } } -async function recordZstdAvailability(config, zstdAvailability) { - addNoLanguageDiagnostic( - config, - makeTelemetryDiagnostic( - "codeql-action/zstd-availability", - "Zstandard availability", - zstdAvailability - ) - ); -} var init = { name: "init" /* Init */, run: run3 diff --git a/src/codeql.ts b/src/codeql.ts index f98130f118..78831ccc12 100644 --- a/src/codeql.ts +++ b/src/codeql.ts @@ -27,7 +27,6 @@ import { Logger } from "./logging"; import { writeBaseDatabaseOidsFile, writeOverlayChangesFile } from "./overlay"; import { OverlayDatabaseMode } from "./overlay/overlay-database-mode"; import * as setupCodeql from "./setup-codeql"; -import { ZstdAvailability } from "./tar"; import { ToolsDownloadStatusReport } from "./tools-download"; import { ToolsFeature, isSupportedToolsFeature } from "./tools-features"; import { shouldEnableIndirectTracing } from "./tracer-config"; @@ -319,7 +318,6 @@ export async function setupCodeQL( toolsDownloadStatusReport?: ToolsDownloadStatusReport; toolsSource: setupCodeql.ToolsSource; toolsVersion: string; - zstdAvailability: ZstdAvailability; }> { try { const { @@ -327,7 +325,6 @@ export async function setupCodeQL( toolsDownloadStatusReport, toolsSource, toolsVersion, - zstdAvailability, } = await setupCodeql.setupCodeQLBundle( toolsInput, apiDetails, @@ -361,7 +358,6 @@ export async function setupCodeQL( toolsDownloadStatusReport, toolsSource, toolsVersion, - zstdAvailability, }; } catch (rawError) { const e = api.wrapApiConfigurationError(rawError); diff --git a/src/init-action.ts b/src/init-action.ts index 8d0434160b..82c6609d93 100644 --- a/src/init-action.ts +++ b/src/init-action.ts @@ -74,7 +74,6 @@ import { getActionsStatus, sendStatusReport, } from "./status-report"; -import { ZstdAvailability } from "./tar"; import { ToolsDownloadStatusReport } from "./tools-download"; import { ToolsFeature } from "./tools-features"; import { getCombinedTracerConfig } from "./tracer-config"; @@ -222,7 +221,6 @@ async function run( let toolsFeatureFlagsValid: boolean | undefined; let toolsSource: ToolsSource; let toolsVersion: string; - let zstdAvailability: ZstdAvailability | undefined; try { initializeEnvironment(getActionVersion()); @@ -326,7 +324,6 @@ async function run( toolsDownloadStatusReport = initCodeQLResult.toolsDownloadStatusReport; toolsVersion = initCodeQLResult.toolsVersion; toolsSource = initCodeQLResult.toolsSource; - zstdAvailability = initCodeQLResult.zstdAvailability; // Check the workflow for problems. If there are any problems, they are reported // to the workflow log. No exceptions are thrown. @@ -497,10 +494,6 @@ async function run( cleanupDatabaseClusterDirectory(config, logger); } - if (zstdAvailability) { - await recordZstdAvailability(config, zstdAvailability); - } - // Log CodeQL download telemetry, if appropriate if (toolsDownloadStatusReport) { addNoLanguageDiagnostic( @@ -837,20 +830,6 @@ async function loadRepositoryProperties( } } -async function recordZstdAvailability( - config: configUtils.Config, - zstdAvailability: ZstdAvailability, -) { - addNoLanguageDiagnostic( - config, - makeTelemetryDiagnostic( - "codeql-action/zstd-availability", - "Zstandard availability", - zstdAvailability, - ), - ); -} - /** Defines the `init` Action. */ const init: Action = { name: ActionName.Init, diff --git a/src/init.ts b/src/init.ts index 53efbe99a3..b4dc63a24b 100644 --- a/src/init.ts +++ b/src/init.ts @@ -30,7 +30,6 @@ import { import { BuiltInLanguage, Language } from "./languages"; import { Logger, withGroupAsync } from "./logging"; import { ToolsSource } from "./setup-codeql"; -import { ZstdAvailability } from "./tar"; import { ToolsDownloadStatusReport } from "./tools-download"; import * as util from "./util"; @@ -49,7 +48,6 @@ export async function initCodeQL( toolsDownloadStatusReport?: ToolsDownloadStatusReport; toolsSource: ToolsSource; toolsVersion: string; - zstdAvailability: ZstdAvailability; }> { logger.startGroup("Setup CodeQL tools"); const { @@ -57,7 +55,6 @@ export async function initCodeQL( toolsDownloadStatusReport, toolsSource, toolsVersion, - zstdAvailability, } = await setupCodeQL( toolsInput, apiDetails, @@ -77,7 +74,6 @@ export async function initCodeQL( toolsDownloadStatusReport, toolsSource, toolsVersion, - zstdAvailability, }; } diff --git a/src/setup-codeql.ts b/src/setup-codeql.ts index 3db0b6ca4d..105c544499 100644 --- a/src/setup-codeql.ts +++ b/src/setup-codeql.ts @@ -921,7 +921,6 @@ interface SetupCodeQLResult { toolsDownloadStatusReport?: ToolsDownloadStatusReport; toolsSource: ToolsSource; toolsVersion: string; - zstdAvailability: tar.ZstdAvailability; } /** @@ -1005,7 +1004,6 @@ export async function setupCodeQLBundle( toolsDownloadStatusReport, toolsSource, toolsVersion, - zstdAvailability, }; } From 3f208c9347cd86f3e498906a7a277e51252d8903 Mon Sep 17 00:00:00 2001 From: Henry Mercer Date: Mon, 20 Jul 2026 17:57:44 +0100 Subject: [PATCH 02/95] Remove bundle download diagnostic Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- .github/workflows/__bundle-zstd.yml | 120 ---------------------------- lib/entry-points.js | 10 --- pr-checks/checks/bundle-zstd.yml | 68 ---------------- src/init-action.ts | 12 --- 4 files changed, 210 deletions(-) delete mode 100644 .github/workflows/__bundle-zstd.yml delete mode 100644 pr-checks/checks/bundle-zstd.yml diff --git a/.github/workflows/__bundle-zstd.yml b/.github/workflows/__bundle-zstd.yml deleted file mode 100644 index 7c1f89cfbd..0000000000 --- a/.github/workflows/__bundle-zstd.yml +++ /dev/null @@ -1,120 +0,0 @@ -# Warning: This file is generated automatically, and should not be modified. -# Instead, please modify the template in the pr-checks directory and run: -# pr-checks/sync.sh -# to regenerate this file. - -name: 'PR Check - Bundle: Zstandard checks' -env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - GO111MODULE: auto -on: - push: - branches: - - main - - releases/v* - pull_request: {} - merge_group: - types: - - checks_requested - schedule: - - cron: '0 5 * * *' - workflow_dispatch: - inputs: {} - workflow_call: - inputs: {} -defaults: - run: - shell: bash -concurrency: - cancel-in-progress: ${{ github.event_name == 'pull_request' || false }} - group: bundle-zstd-${{github.ref}} -jobs: - bundle-zstd: - strategy: - fail-fast: false - matrix: - include: - - os: ubuntu-latest - version: linked - - os: macos-latest - version: linked - - os: windows-latest - version: linked - name: 'Bundle: Zstandard checks' - if: github.triggering_actor != 'dependabot[bot]' - permissions: - contents: read - security-events: read - timeout-minutes: 45 - runs-on: ${{ matrix.os }} - steps: - - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - - name: Prepare test - id: prepare-test - uses: ./.github/actions/prepare-test - with: - version: ${{ matrix.version }} - use-all-platform-bundle: 'false' - setup-kotlin: 'true' - - name: Remove CodeQL from toolcache - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const fs = require('fs'); - const path = require('path'); - const codeqlPath = path.join(process.env['RUNNER_TOOL_CACHE'], 'CodeQL'); - if (codeqlPath !== undefined) { - fs.rmdirSync(codeqlPath, { recursive: true }); - } - - id: init - uses: ./../action/init - with: - languages: javascript - tools: ${{ steps.prepare-test.outputs.tools-url }} - - uses: ./../action/analyze - with: - output: ${{ runner.temp }}/results - upload-database: false - - name: Upload SARIF - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 - with: - name: ${{ matrix.os }}-zstd-bundle.sarif - path: ${{ runner.temp }}/results/javascript.sarif - retention-days: 7 - - name: Check diagnostic with expected tools URL appears in SARIF - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - env: - SARIF_PATH: ${{ runner.temp }}/results/javascript.sarif - with: - script: | - const fs = require('fs'); - - const sarif = JSON.parse(fs.readFileSync(process.env['SARIF_PATH'], 'utf8')); - const run = sarif.runs[0]; - - const toolExecutionNotifications = run.invocations[0].toolExecutionNotifications; - const downloadTelemetryNotifications = toolExecutionNotifications.filter(n => - n.descriptor.id === 'codeql-action/bundle-download-telemetry' - ); - if (downloadTelemetryNotifications.length !== 1) { - core.setFailed( - 'Expected exactly one reporting descriptor in the ' + - `'runs[].invocations[].toolExecutionNotifications[]' SARIF property, but found ` + - `${downloadTelemetryNotifications.length}. All notification reporting descriptors: ` + - `${JSON.stringify(toolExecutionNotifications)}.` - ); - } - - const toolsUrl = downloadTelemetryNotifications[0].properties.attributes.toolsUrl; - console.log(`Found tools URL: ${toolsUrl}`); - - const expectedExtension = process.env['RUNNER_OS'] === 'Windows' ? '.tar.gz' : '.tar.zst'; - - if (!toolsUrl.endsWith(expectedExtension)) { - core.setFailed( - `Expected the tools URL to be a ${expectedExtension} file, but found ${toolsUrl}.` - ); - } - env: - CODEQL_ACTION_TEST_MODE: true diff --git a/lib/entry-points.js b/lib/entry-points.js index 8c72430207..3cbfdd9787 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -160870,16 +160870,6 @@ async function run3(actionState) { if (config.overlayDatabaseMode !== "overlay" /* Overlay */) { cleanupDatabaseClusterDirectory(config, logger); } - if (toolsDownloadStatusReport) { - addNoLanguageDiagnostic( - config, - makeTelemetryDiagnostic( - "codeql-action/bundle-download-telemetry", - "CodeQL bundle download telemetry", - toolsDownloadStatusReport - ) - ); - } const goFlags = process.env["GOFLAGS"]; if (goFlags) { core21.exportVariable("GOFLAGS", goFlags); diff --git a/pr-checks/checks/bundle-zstd.yml b/pr-checks/checks/bundle-zstd.yml deleted file mode 100644 index a961af3c36..0000000000 --- a/pr-checks/checks/bundle-zstd.yml +++ /dev/null @@ -1,68 +0,0 @@ -name: "Bundle: Zstandard checks" -description: "A Zstandard CodeQL bundle should be extracted on supported operating systems" -versions: - - linked -operatingSystems: - - ubuntu - - macos - - windows -steps: - - name: Remove CodeQL from toolcache - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const fs = require('fs'); - const path = require('path'); - const codeqlPath = path.join(process.env['RUNNER_TOOL_CACHE'], 'CodeQL'); - if (codeqlPath !== undefined) { - fs.rmdirSync(codeqlPath, { recursive: true }); - } - - id: init - uses: ./../action/init - with: - languages: javascript - tools: ${{ steps.prepare-test.outputs.tools-url }} - - uses: ./../action/analyze - with: - output: ${{ runner.temp }}/results - upload-database: false - - name: Upload SARIF - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 - with: - name: ${{ matrix.os }}-zstd-bundle.sarif - path: ${{ runner.temp }}/results/javascript.sarif - retention-days: 7 - - name: Check diagnostic with expected tools URL appears in SARIF - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - env: - SARIF_PATH: ${{ runner.temp }}/results/javascript.sarif - with: - script: | - const fs = require('fs'); - - const sarif = JSON.parse(fs.readFileSync(process.env['SARIF_PATH'], 'utf8')); - const run = sarif.runs[0]; - - const toolExecutionNotifications = run.invocations[0].toolExecutionNotifications; - const downloadTelemetryNotifications = toolExecutionNotifications.filter(n => - n.descriptor.id === 'codeql-action/bundle-download-telemetry' - ); - if (downloadTelemetryNotifications.length !== 1) { - core.setFailed( - 'Expected exactly one reporting descriptor in the ' + - `'runs[].invocations[].toolExecutionNotifications[]' SARIF property, but found ` + - `${downloadTelemetryNotifications.length}. All notification reporting descriptors: ` + - `${JSON.stringify(toolExecutionNotifications)}.` - ); - } - - const toolsUrl = downloadTelemetryNotifications[0].properties.attributes.toolsUrl; - console.log(`Found tools URL: ${toolsUrl}`); - - const expectedExtension = process.env['RUNNER_OS'] === 'Windows' ? '.tar.gz' : '.tar.zst'; - - if (!toolsUrl.endsWith(expectedExtension)) { - core.setFailed( - `Expected the tools URL to be a ${expectedExtension} file, but found ${toolsUrl}.` - ); - } diff --git a/src/init-action.ts b/src/init-action.ts index 82c6609d93..5a3606de5e 100644 --- a/src/init-action.ts +++ b/src/init-action.ts @@ -494,18 +494,6 @@ async function run( cleanupDatabaseClusterDirectory(config, logger); } - // Log CodeQL download telemetry, if appropriate - if (toolsDownloadStatusReport) { - addNoLanguageDiagnostic( - config, - makeTelemetryDiagnostic( - "codeql-action/bundle-download-telemetry", - "CodeQL bundle download telemetry", - toolsDownloadStatusReport, - ), - ); - } - // Forward Go flags const goFlags = process.env["GOFLAGS"]; if (goFlags) { From 14e8bf9e67c1b8333373f8946e704c1f009b860a Mon Sep 17 00:00:00 2001 From: Henry Mercer Date: Mon, 20 Jul 2026 17:58:17 +0100 Subject: [PATCH 03/95] Remove Git version diagnostic Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- lib/entry-points.js | 16 ---------------- src/config-utils.ts | 21 --------------------- 2 files changed, 37 deletions(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index 3cbfdd9787..dffbcf8e9e 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -149684,7 +149684,6 @@ async function initConfig(actionState, inputs) { try { gitVersion = await getGitVersionOrThrow(); logger.info(`Using Git version ${gitVersion.fullVersion}`); - await logGitVersionTelemetry(config, gitVersion); } catch (e) { logger.warning(`Could not determine Git version: ${getErrorMessage(e)}`); if (isInTestMode() && process.env["CODEQL_ACTION_TOLERATE_MISSING_GIT_VERSION" /* TOLERATE_MISSING_GIT_VERSION */] !== "true") { @@ -149960,21 +149959,6 @@ function getPrimaryAnalysisKind(config) { function getPrimaryAnalysisConfig(config) { return getAnalysisConfig(getPrimaryAnalysisKind(config)); } -async function logGitVersionTelemetry(config, gitVersion) { - if (config.languages.length > 0) { - addNoLanguageDiagnostic( - config, - makeTelemetryDiagnostic( - "codeql-action/git-version-telemetry", - "Git version telemetry", - { - fullVersion: gitVersion.fullVersion, - truncatedVersion: gitVersion.truncatedVersion - } - ) - ); - } -} async function logGeneratedFilesTelemetry(config, duration, generatedFilesCount) { if (config.languages.length < 1) { return; diff --git a/src/config-utils.ts b/src/config-utils.ts index 948494f531..3badec7238 100644 --- a/src/config-utils.ts +++ b/src/config-utils.ts @@ -1170,7 +1170,6 @@ export async function initConfig( try { gitVersion = await getGitVersionOrThrow(); logger.info(`Using Git version ${gitVersion.fullVersion}`); - await logGitVersionTelemetry(config, gitVersion); } catch (e) { logger.warning(`Could not determine Git version: ${getErrorMessage(e)}`); // Throw the error in test mode so it's more visible, unless the environment @@ -1648,26 +1647,6 @@ export function getPrimaryAnalysisConfig(config: Config): AnalysisConfig { return getAnalysisConfig(getPrimaryAnalysisKind(config)); } -/** Logs the Git version as a telemetry diagnostic. */ -async function logGitVersionTelemetry( - config: Config, - gitVersion: GitVersionInfo, -): Promise { - if (config.languages.length > 0) { - addNoLanguageDiagnostic( - config, - makeTelemetryDiagnostic( - "codeql-action/git-version-telemetry", - "Git version telemetry", - { - fullVersion: gitVersion.fullVersion, - truncatedVersion: gitVersion.truncatedVersion, - }, - ), - ); - } -} - /** * Logs the time it took to identify generated files and how many were discovered as * a telemetry diagnostic. From 1040e2a159d012fa07730388886d082f58fbf362 Mon Sep 17 00:00:00 2001 From: Henry Mercer Date: Mon, 20 Jul 2026 17:59:18 +0100 Subject: [PATCH 04/95] Format CodeQL initialization Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- lib/entry-points.js | 7 +------ src/init.ts | 30 +++++++++++++----------------- 2 files changed, 14 insertions(+), 23 deletions(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index dffbcf8e9e..0a60d34573 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -154020,12 +154020,7 @@ var github2 = __toESM(require_github()); var io6 = __toESM(require_io()); async function initCodeQL(toolsInput, apiDetails, tempDir, variant, defaultCliVersion, rawLanguages, useOverlayAwareDefaultCliVersion, features, logger) { logger.startGroup("Setup CodeQL tools"); - const { - codeql, - toolsDownloadStatusReport, - toolsSource, - toolsVersion - } = await setupCodeQL( + const { codeql, toolsDownloadStatusReport, toolsSource, toolsVersion } = await setupCodeQL( toolsInput, apiDetails, tempDir, diff --git a/src/init.ts b/src/init.ts index b4dc63a24b..dee62913c2 100644 --- a/src/init.ts +++ b/src/init.ts @@ -50,23 +50,19 @@ export async function initCodeQL( toolsVersion: string; }> { logger.startGroup("Setup CodeQL tools"); - const { - codeql, - toolsDownloadStatusReport, - toolsSource, - toolsVersion, - } = await setupCodeQL( - toolsInput, - apiDetails, - tempDir, - variant, - defaultCliVersion, - rawLanguages, - useOverlayAwareDefaultCliVersion, - features, - logger, - true, - ); + const { codeql, toolsDownloadStatusReport, toolsSource, toolsVersion } = + await setupCodeQL( + toolsInput, + apiDetails, + tempDir, + variant, + defaultCliVersion, + rawLanguages, + useOverlayAwareDefaultCliVersion, + features, + logger, + true, + ); await codeql.printVersion(); logger.endGroup(); return { From 3c20a74df36d7695daf93fc3d7949e3aeabcb1b6 Mon Sep 17 00:00:00 2001 From: Henry Mercer Date: Mon, 20 Jul 2026 18:33:46 +0100 Subject: [PATCH 05/95] Remove unused bundle download fields Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- lib/entry-points.js | 41 +-------------------- src/codeql.test.ts | 24 +++++------- src/codeql.ts | 6 --- src/setup-codeql.test.ts | 10 ----- src/tools-download.ts | 79 ++-------------------------------------- 5 files changed, 15 insertions(+), 145 deletions(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index 0a60d34573..bed9c354e2 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -150495,22 +150495,6 @@ var import_follow_redirects = __toESM(require_follow_redirects()); var semver8 = __toESM(require_semver2()); var STREAMING_HIGH_WATERMARK_BYTES = 4 * 1024 * 1024; var TOOLCACHE_TOOL_NAME = "CodeQL"; -function makeDownloadFirstToolsDownloadDurations(downloadDurationMs, extractionDurationMs) { - return { - combinedDurationMs: downloadDurationMs + extractionDurationMs, - downloadDurationMs, - extractionDurationMs, - streamExtraction: false - }; -} -function makeStreamedToolsDownloadDurations(combinedDurationMs) { - return { - combinedDurationMs, - downloadDurationMs: void 0, - extractionDurationMs: void 0, - streamExtraction: true - }; -} async function downloadAndExtract(codeqlURL, compressionMethod, dest, authorization, headers, tarVersion, logger) { logger.info( `Downloading CodeQL tools from ${codeqlURL} . This may take a while.` @@ -150535,11 +150519,7 @@ async function downloadAndExtract(codeqlURL, compressionMethod, dest, authorizat combinedDurationMs )}).` ); - return { - compressionMethod, - toolsUrl: sanitizeUrlForStatusReport(codeqlURL), - ...makeStreamedToolsDownloadDurations(combinedDurationMs) - }; + return {}; } } catch (e) { core11.warning( @@ -150581,14 +150561,7 @@ async function downloadAndExtract(codeqlURL, compressionMethod, dest, authorizat } finally { await cleanUpPath(archivedBundlePath, "CodeQL bundle archive", logger); } - return { - compressionMethod, - toolsUrl: sanitizeUrlForStatusReport(codeqlURL), - ...makeDownloadFirstToolsDownloadDurations( - downloadDurationMs, - extractionDurationMs - ) - }; + return { downloadDurationMs }; } async function downloadAndExtractZstdWithStreaming(codeqlURL, dest, authorization, headers, tarVersion, logger) { fs12.mkdirSync(dest, { recursive: true }); @@ -150631,11 +150604,6 @@ function writeToolcacheMarkerFile(extractedPath, logger) { fs12.writeFileSync(markerFilePath, ""); logger.info(`Created toolcache marker file ${markerFilePath}`); } -function sanitizeUrlForStatusReport(url2) { - return ["github/codeql-action", "dsp-testing/codeql-cli-nightlies"].some( - (repo) => url2.startsWith(`https://github.com/${repo}/releases/download/`) - ) ? url2 : "sanitized-value"; -} // src/setup-codeql.ts var CODEQL_DEFAULT_ACTION_REPOSITORY = "github/codeql-action"; @@ -151390,11 +151358,6 @@ async function setupCodeQL(toolsInput, apiDetails, tempDir, variant, defaultCliV features, logger ); - logger.debug( - `Bundle download status report: ${JSON.stringify( - toolsDownloadStatusReport - )}` - ); let codeqlCmd = path14.join(codeqlFolder, "codeql", "codeql"); if (process.platform === "win32") { codeqlCmd += ".exe"; diff --git a/src/codeql.test.ts b/src/codeql.test.ts index dea4cf04af..d83bc763be 100644 --- a/src/codeql.test.ts +++ b/src/codeql.test.ts @@ -192,7 +192,7 @@ test.serial( t.is(result.toolsVersion, `2.15.0`); t.is(result.toolsSource, ToolsSource.Download); if (result.toolsDownloadStatusReport) { - assertDurationsInteger(t, result.toolsDownloadStatusReport); + assertDownloadDurationInteger(t, result.toolsDownloadStatusReport); } }); }, @@ -231,7 +231,7 @@ test.serial( t.deepEqual(result.toolsVersion, "0.0.0-20200610"); t.is(result.toolsSource, ToolsSource.Download); if (result.toolsDownloadStatusReport) { - assertDurationsInteger(t, result.toolsDownloadStatusReport); + assertDownloadDurationInteger(t, result.toolsDownloadStatusReport); } }); }, @@ -330,9 +330,7 @@ for (const toolcacheVersion of [ SAMPLE_DEFAULT_CLI_VERSION.enabledVersions[0].cliVersion, ); t.is(result.toolsSource, ToolsSource.Toolcache); - t.is(result.toolsDownloadStatusReport?.combinedDurationMs, undefined); - t.is(result.toolsDownloadStatusReport?.downloadDurationMs, undefined); - t.is(result.toolsDownloadStatusReport?.extractionDurationMs, undefined); + t.is(result.toolsDownloadStatusReport, undefined); }); }, ); @@ -373,9 +371,7 @@ test.serial( ); t.deepEqual(result.toolsVersion, "0.0.0-20200601"); t.is(result.toolsSource, ToolsSource.Toolcache); - t.is(result.toolsDownloadStatusReport?.combinedDurationMs, undefined); - t.is(result.toolsDownloadStatusReport?.downloadDurationMs, undefined); - t.is(result.toolsDownloadStatusReport?.extractionDurationMs, undefined); + t.is(result.toolsDownloadStatusReport, undefined); const cachedVersions = toolcache.findAllVersions("CodeQL"); t.is(cachedVersions.length, 1); @@ -422,7 +418,7 @@ test.serial( t.deepEqual(result.toolsVersion, defaults.cliVersion); t.is(result.toolsSource, ToolsSource.Download); if (result.toolsDownloadStatusReport) { - assertDurationsInteger(t, result.toolsDownloadStatusReport); + assertDownloadDurationInteger(t, result.toolsDownloadStatusReport); } const cachedVersions = toolcache.findAllVersions("CodeQL"); @@ -463,7 +459,7 @@ test.serial( t.deepEqual(result.toolsVersion, defaults.cliVersion); t.is(result.toolsSource, ToolsSource.Download); if (result.toolsDownloadStatusReport) { - assertDurationsInteger(t, result.toolsDownloadStatusReport); + assertDownloadDurationInteger(t, result.toolsDownloadStatusReport); } const cachedVersions = toolcache.findAllVersions("CodeQL"); @@ -507,7 +503,7 @@ test.serial( t.is(result.toolsVersion, "0.0.0-20230203"); t.is(result.toolsSource, ToolsSource.Download); if (result.toolsDownloadStatusReport) { - assertDurationsInteger(t, result.toolsDownloadStatusReport); + assertDownloadDurationInteger(t, result.toolsDownloadStatusReport); } const cachedVersions = toolcache.findAllVersions("CodeQL"); @@ -519,14 +515,12 @@ test.serial( }, ); -function assertDurationsInteger( +function assertDownloadDurationInteger( t: ExecutionContext, statusReport: ToolsDownloadStatusReport, ) { - t.assert(Number.isInteger(statusReport?.combinedDurationMs)); if (statusReport.downloadDurationMs !== undefined) { - t.assert(Number.isInteger(statusReport?.downloadDurationMs)); - t.assert(Number.isInteger(statusReport?.extractionDurationMs)); + t.assert(Number.isInteger(statusReport.downloadDurationMs)); } } diff --git a/src/codeql.ts b/src/codeql.ts index 78831ccc12..a29df90865 100644 --- a/src/codeql.ts +++ b/src/codeql.ts @@ -337,12 +337,6 @@ export async function setupCodeQL( logger, ); - logger.debug( - `Bundle download status report: ${JSON.stringify( - toolsDownloadStatusReport, - )}`, - ); - let codeqlCmd = path.join(codeqlFolder, "codeql", "codeql"); if (process.platform === "win32") { codeqlCmd += ".exe"; diff --git a/src/setup-codeql.test.ts b/src/setup-codeql.test.ts index f2ba43c101..1f0318d9f0 100644 --- a/src/setup-codeql.test.ts +++ b/src/setup-codeql.test.ts @@ -194,12 +194,7 @@ test.serial( sinon.stub(setupCodeql, "downloadCodeQL").resolves({ codeqlFolder: "codeql", statusReport: { - combinedDurationMs: 500, - compressionMethod: "gzip", downloadDurationMs: 200, - extractionDurationMs: 300, - streamExtraction: false, - toolsUrl: "toolsUrl", }, toolsVersion: LINKED_CLI_VERSION.cliVersion, }); @@ -251,12 +246,7 @@ test.serial( sinon.stub(setupCodeql, "downloadCodeQL").resolves({ codeqlFolder: "codeql", statusReport: { - combinedDurationMs: 500, - compressionMethod: "gzip", downloadDurationMs: 200, - extractionDurationMs: 300, - streamExtraction: false, - toolsUrl: bundleUrl, }, toolsVersion: expectedVersion, }); diff --git a/src/tools-download.ts b/src/tools-download.ts index 5d8a4c5fb9..c19cedb13e 100644 --- a/src/tools-download.ts +++ b/src/tools-download.ts @@ -24,61 +24,9 @@ const STREAMING_HIGH_WATERMARK_BYTES = 4 * 1024 * 1024; // 4 MiB */ const TOOLCACHE_TOOL_NAME = "CodeQL"; -/** - * Timing information for the download and extraction of the CodeQL tools when - * we fully download the bundle before extracting. - */ -type DownloadFirstToolsDownloadDurations = { - combinedDurationMs: number; - downloadDurationMs: number; - extractionDurationMs: number; - streamExtraction: false; -}; - -function makeDownloadFirstToolsDownloadDurations( - downloadDurationMs: number, - extractionDurationMs: number, -): DownloadFirstToolsDownloadDurations { - return { - combinedDurationMs: downloadDurationMs + extractionDurationMs, - downloadDurationMs, - extractionDurationMs, - streamExtraction: false, - }; -} - -/** - * Timing information for the download and extraction of the CodeQL tools when - * we stream the download and extraction of the bundle. - */ -type StreamedToolsDownloadDurations = { - combinedDurationMs: number; - downloadDurationMs: undefined; - extractionDurationMs: undefined; - streamExtraction: true; -}; - -function makeStreamedToolsDownloadDurations( - combinedDurationMs: number, -): StreamedToolsDownloadDurations { - return { - combinedDurationMs, - downloadDurationMs: undefined, - extractionDurationMs: undefined, - streamExtraction: true, - }; -} - -type ToolsDownloadDurations = - | DownloadFirstToolsDownloadDurations - | StreamedToolsDownloadDurations; - export type ToolsDownloadStatusReport = { - cacheDurationMs?: number; - compressionMethod: tar.CompressionMethod; - toolsUrl: string; - zstdFailureReason?: string; -} & ToolsDownloadDurations; + downloadDurationMs?: number; +}; export async function downloadAndExtract( codeqlURL: string, @@ -116,11 +64,7 @@ export async function downloadAndExtract( )}).`, ); - return { - compressionMethod, - toolsUrl: sanitizeUrlForStatusReport(codeqlURL), - ...makeStreamedToolsDownloadDurations(combinedDurationMs), - }; + return {}; } } catch (e) { core.warning( @@ -170,14 +114,7 @@ export async function downloadAndExtract( await cleanUpPath(archivedBundlePath, "CodeQL bundle archive", logger); } - return { - compressionMethod, - toolsUrl: sanitizeUrlForStatusReport(codeqlURL), - ...makeDownloadFirstToolsDownloadDurations( - downloadDurationMs, - extractionDurationMs, - ), - }; + return { downloadDurationMs }; } async function downloadAndExtractZstdWithStreaming( @@ -241,11 +178,3 @@ export function writeToolcacheMarkerFile( fs.writeFileSync(markerFilePath, ""); logger.info(`Created toolcache marker file ${markerFilePath}`); } - -function sanitizeUrlForStatusReport(url: string): string { - return ["github/codeql-action", "dsp-testing/codeql-cli-nightlies"].some( - (repo) => url.startsWith(`https://github.com/${repo}/releases/download/`), - ) - ? url - : "sanitized-value"; -} From 7248c38b8fbf2ab7ada6e1fc8ff649c65275f4fd Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Wed, 22 Jul 2026 05:36:40 +0000 Subject: [PATCH 06/95] Update changelog and version after v4.37.3 --- CHANGELOG.md | 4 ++++ package-lock.json | 4 ++-- package.json | 2 +- 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index af737811ff..1303638f47 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,10 @@ See the [releases page](https://github.com/github/codeql-action/releases) for the relevant changes to the CodeQL CLI and language packs. +## [UNRELEASED] + +No user facing changes. + ## 4.37.3 - 22 Jul 2026 No user facing changes. diff --git a/package-lock.json b/package-lock.json index d08a05a351..b33e544db9 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,12 +1,12 @@ { "name": "codeql", - "version": "4.37.3", + "version": "4.37.4", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "codeql", - "version": "4.37.3", + "version": "4.37.4", "license": "MIT", "workspaces": [ "pr-checks" diff --git a/package.json b/package.json index 5a2103c244..29b329de9f 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "codeql", - "version": "4.37.3", + "version": "4.37.4", "private": true, "description": "CodeQL action", "scripts": { From 15e2f310e17b3624e42b453d04a22b417af09179 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Wed, 22 Jul 2026 05:36:55 +0000 Subject: [PATCH 07/95] Rebuild --- lib/entry-points.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index b7db317324..0183005a70 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -145331,7 +145331,7 @@ function getDiffRangesJsonFilePath(env = getEnv()) { return path2.join(getTemporaryDirectory(env), PR_DIFF_RANGE_JSON_FILENAME); } function getActionVersion() { - return "4.37.3"; + return "4.37.4"; } function getWorkflowEventName(env = getEnv()) { return env.getRequired("GITHUB_EVENT_NAME" /* GITHUB_EVENT_NAME */); From e8e914f04e7dca3327f0e713a5f83bcda5c6084b Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Tue, 21 Jul 2026 16:43:31 +0100 Subject: [PATCH 08/95] Bump js-yaml and brace-expansion --- lib/entry-points.js | 195 +++++++++++++++++++++++--------------------- package-lock.json | 42 +++++----- 2 files changed, 124 insertions(+), 113 deletions(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index 70a95fded0..32c3ca9c87 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -31280,84 +31280,87 @@ var require_brace_expansion = __commonJS({ } function expand3(str, max, isTop) { var expansions = []; - var m = balanced2("{", "}", str); - if (!m || /\$$/.test(m.pre)) return [str]; - var isNumericSequence = /^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(m.body); - var isAlphaSequence = /^[a-zA-Z]\.\.[a-zA-Z](?:\.\.-?\d+)?$/.test(m.body); - var isSequence = isNumericSequence || isAlphaSequence; - var isOptions = m.body.indexOf(",") >= 0; - if (!isSequence && !isOptions) { - if (m.post.match(/,(?!,).*\}/)) { - str = m.pre + "{" + m.body + escClose2 + m.post; - return expand3(str, max, true); - } - return [str]; - } - var n; - if (isSequence) { - n = m.body.split(/\.\./); - } else { - n = parseCommaParts2(m.body); - if (n.length === 1) { - n = expand3(n[0], max, false).map(embrace2); + for (; ; ) { + var m = balanced2("{", "}", str); + if (!m || /\$$/.test(m.pre)) return [str]; + var isNumericSequence = /^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(m.body); + var isAlphaSequence = /^[a-zA-Z]\.\.[a-zA-Z](?:\.\.-?\d+)?$/.test(m.body); + var isSequence = isNumericSequence || isAlphaSequence; + var isOptions = m.body.indexOf(",") >= 0; + if (!isSequence && !isOptions) { + if (m.post.match(/,(?!,).*\}/)) { + str = m.pre + "{" + m.body + escClose2 + m.post; + isTop = true; + continue; + } + return [str]; + } + var n; + if (isSequence) { + n = m.body.split(/\.\./); + } else { + n = parseCommaParts2(m.body); if (n.length === 1) { - var post = m.post.length ? expand3(m.post, max, false) : [""]; - return post.map(function(p) { - return m.pre + n[0] + p; - }); + n = expand3(n[0], max, false).map(embrace2); + if (n.length === 1) { + var post = m.post.length ? expand3(m.post, max, false) : [""]; + return post.map(function(p) { + return m.pre + n[0] + p; + }); + } } } - } - var pre = m.pre; - var post = m.post.length ? expand3(m.post, max, false) : [""]; - var N; - if (isSequence) { - var x = numeric2(n[0]); - var y = numeric2(n[1]); - var width = Math.max(n[0].length, n[1].length); - var incr = n.length == 3 ? Math.max(Math.abs(numeric2(n[2])), 1) : 1; - var test = lte2; - var reverse = y < x; - if (reverse) { - incr *= -1; - test = gte7; - } - var pad = n.some(isPadded2); - N = []; - for (var i = x; test(i, y); i += incr) { - var c; - if (isAlphaSequence) { - c = String.fromCharCode(i); - if (c === "\\") - c = ""; - } else { - c = String(i); - if (pad) { - var need = width - c.length; - if (need > 0) { - var z = new Array(need + 1).join("0"); - if (i < 0) - c = "-" + z + c.slice(1); - else - c = z + c; + var pre = m.pre; + var post = m.post.length ? expand3(m.post, max, false) : [""]; + var N; + if (isSequence) { + var x = numeric2(n[0]); + var y = numeric2(n[1]); + var width = Math.max(n[0].length, n[1].length); + var incr = n.length == 3 ? Math.max(Math.abs(numeric2(n[2])), 1) : 1; + var test = lte2; + var reverse = y < x; + if (reverse) { + incr *= -1; + test = gte7; + } + var pad = n.some(isPadded2); + N = []; + for (var i = x; test(i, y) && N.length < max; i += incr) { + var c; + if (isAlphaSequence) { + c = String.fromCharCode(i); + if (c === "\\") + c = ""; + } else { + c = String(i); + if (pad) { + var need = width - c.length; + if (need > 0) { + var z = new Array(need + 1).join("0"); + if (i < 0) + c = "-" + z + c.slice(1); + else + c = z + c; + } } } + N.push(c); } - N.push(c); + } else { + N = concatMap(n, function(el) { + return expand3(el, max, false); + }); } - } else { - N = concatMap(n, function(el) { - return expand3(el, max, false); - }); - } - for (var j = 0; j < N.length; j++) { - for (var k = 0; k < post.length && expansions.length < max; k++) { - var expansion = pre + N[j] + post[k]; - if (!isTop || isSequence || expansion) - expansions.push(expansion); + for (var j = 0; j < N.length; j++) { + for (var k = 0; k < post.length && expansions.length < max; k++) { + var expansion = pre + N[j] + post[k]; + if (!isTop || isSequence || expansion) + expansions.push(expansion); + } } + return expansions; } - return expansions; } } }); @@ -88996,16 +88999,18 @@ var require_brace_expansion2 = __commonJS({ } function expand3(str, max, isTop) { var expansions = []; - var m = balanced2("{", "}", str); - if (!m) return [str]; - var pre = m.pre; - var post = m.post.length ? expand3(m.post, max, false) : [""]; - if (/\$$/.test(m.pre)) { - for (var k = 0; k < post.length && k < max; k++) { - var expansion = pre + "{" + m.body + "}" + post[k]; - expansions.push(expansion); + for (; ; ) { + const m = balanced2("{", "}", str); + if (!m) return [str]; + const pre = m.pre; + if (/\$$/.test(m.pre)) { + const post2 = m.post.length ? expand3(m.post, max, false) : [""]; + for (let k2 = 0; k2 < post2.length && k2 < max; k2++) { + const expansion2 = pre + "{" + m.body + "}" + post2[k2]; + expansions.push(expansion2); + } + return expansions; } - } else { var isNumericSequence = /^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(m.body); var isAlphaSequence = /^[a-zA-Z]\.\.[a-zA-Z](?:\.\.-?\d+)?$/.test(m.body); var isSequence = isNumericSequence || isAlphaSequence; @@ -89013,10 +89018,12 @@ var require_brace_expansion2 = __commonJS({ if (!isSequence && !isOptions) { if (m.post.match(/,(?!,).*\}/)) { str = m.pre + "{" + m.body + escClose2 + m.post; - return expand3(str, max, true); + isTop = true; + continue; } return [str]; } + const post = m.post.length ? expand3(m.post, max, false) : [""]; var n; if (isSequence) { n = m.body.split(/\.\./); @@ -89079,8 +89086,8 @@ var require_brace_expansion2 = __commonJS({ expansions.push(expansion); } } + return expansions; } - return expansions; } } }); @@ -155466,17 +155473,19 @@ function gte6(i, y) { } function expand_(str, max, isTop) { const expansions = []; - const m = balanced("{", "}", str); - if (!m) - return [str]; - const pre = m.pre; - const post = m.post.length ? expand_(m.post, max, false) : [""]; - if (/\$$/.test(m.pre)) { - for (let k = 0; k < post.length && k < max; k++) { - const expansion = pre + "{" + m.body + "}" + post[k]; - expansions.push(expansion); + for (; ; ) { + const m = balanced("{", "}", str); + if (!m) + return [str]; + const pre = m.pre; + if (/\$$/.test(m.pre)) { + const post2 = m.post.length ? expand_(m.post, max, false) : [""]; + for (let k = 0; k < post2.length && k < max; k++) { + const expansion = pre + "{" + m.body + "}" + post2[k]; + expansions.push(expansion); + } + return expansions; } - } else { const isNumericSequence = /^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(m.body); const isAlphaSequence = /^[a-zA-Z]\.\.[a-zA-Z](?:\.\.-?\d+)?$/.test(m.body); const isSequence = isNumericSequence || isAlphaSequence; @@ -155484,10 +155493,12 @@ function expand_(str, max, isTop) { if (!isSequence && !isOptions) { if (m.post.match(/,(?!,).*\}/)) { str = m.pre + "{" + m.body + escClose + m.post; - return expand_(str, max, true); + isTop = true; + continue; } return [str]; } + const post = m.post.length ? expand_(m.post, max, false) : [""]; let n; if (isSequence) { n = m.body.split(/\.\./); @@ -155551,8 +155562,8 @@ function expand_(str, max, isTop) { } } } + return expansions; } - return expansions; } // node_modules/readdir-glob/node_modules/minimatch/dist/esm/assert-valid-pattern.js diff --git a/package-lock.json b/package-lock.json index d08a05a351..2eff997143 100644 --- a/package-lock.json +++ b/package-lock.json @@ -374,9 +374,9 @@ "license": "Apache-2.0" }, "node_modules/@actions/artifact/node_modules/brace-expansion": { - "version": "2.1.1", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.1.tgz", - "integrity": "sha512-WR1cURNjuvBLMZBMbqM0UoE+WAfdUcEV1ccD8PVBVOI+Z3ND4+SZbN8RsfT2bMuG1qwz5RFvPukSZm5fF2D5eA==", + "version": "2.1.2", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.2.tgz", + "integrity": "sha512-w5JZcKgdhDOgOwm8H+KgbosopHMuGcl6qbulwjtz3SM7I7P3yW1eAjzMPLrIE+NQ9vjgANKHWeMHnrT0OXW1oA==", "license": "MIT", "dependencies": { "balanced-match": "^1.0.0" @@ -1534,9 +1534,9 @@ } }, "node_modules/@eslint/eslintrc/node_modules/js-yaml": { - "version": "4.2.0", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.2.0.tgz", - "integrity": "sha512-ePWsvanv0DWuDRsW8dnt+R4jQ31SCRCQ7hhNcPXZPsoBZiemuZNYGf7adZdqX2D86j6rvKp3RpCxVTSb8WQlOw==", + "version": "4.3.0", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.0.tgz", + "integrity": "sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==", "dev": true, "funding": [ { @@ -1979,9 +1979,9 @@ } }, "node_modules/@microsoft/eslint-formatter-sarif/node_modules/js-yaml": { - "version": "4.2.0", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.2.0.tgz", - "integrity": "sha512-ePWsvanv0DWuDRsW8dnt+R4jQ31SCRCQ7hhNcPXZPsoBZiemuZNYGf7adZdqX2D86j6rvKp3RpCxVTSb8WQlOw==", + "version": "4.3.0", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.0.tgz", + "integrity": "sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==", "dev": true, "funding": [ { @@ -3864,9 +3864,9 @@ "license": "MIT" }, "node_modules/brace-expansion": { - "version": "1.1.14", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.14.tgz", - "integrity": "sha512-MWPGfDxnyzKU7rNOW9SP/c50vi3xrmrua/+6hfPbCS2ABNWfx24vPidzvC7krjU/RTo235sV776ymlsMtGKj8g==", + "version": "1.1.16", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.16.tgz", + "integrity": "sha512-IDw48K2/2kRkg9LdJxurvq3lV3aBgq0REY89duEqFRthjlPdXHKMj7EnQOXVckxzgisinf3nHfrcE2FufFLXMw==", "license": "MIT", "dependencies": { "balanced-match": "^1.0.0", @@ -5115,9 +5115,9 @@ } }, "node_modules/eslint-plugin-import-x/node_modules/brace-expansion": { - "version": "5.0.6", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.6.tgz", - "integrity": "sha512-kLpxurY4Z4r9sgMsyG0Z9uzsBlgiU/EFKhj/h91/8yHu0edo7XuixOIH3VcJ8kkxs6/jPzoI6U9Vj3WqbMQ94g==", + "version": "5.0.7", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.7.tgz", + "integrity": "sha512-7oFy703dxfY3/NLxC1fh2SUCQ0H9rmAY+5EpDVfXjUTTs+HEwR2nYaqLv+GWcTsumwxPfiz6CzCNkwXwBUwqCA==", "dev": true, "license": "MIT", "dependencies": { @@ -6051,9 +6051,9 @@ } }, "node_modules/glob/node_modules/brace-expansion": { - "version": "5.0.6", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.6.tgz", - "integrity": "sha512-kLpxurY4Z4r9sgMsyG0Z9uzsBlgiU/EFKhj/h91/8yHu0edo7XuixOIH3VcJ8kkxs6/jPzoI6U9Vj3WqbMQ94g==", + "version": "5.0.7", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.7.tgz", + "integrity": "sha512-7oFy703dxfY3/NLxC1fh2SUCQ0H9rmAY+5EpDVfXjUTTs+HEwR2nYaqLv+GWcTsumwxPfiz6CzCNkwXwBUwqCA==", "license": "MIT", "dependencies": { "balanced-match": "^4.0.2" @@ -8030,9 +8030,9 @@ } }, "node_modules/readdir-glob/node_modules/brace-expansion": { - "version": "5.0.6", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.6.tgz", - "integrity": "sha512-kLpxurY4Z4r9sgMsyG0Z9uzsBlgiU/EFKhj/h91/8yHu0edo7XuixOIH3VcJ8kkxs6/jPzoI6U9Vj3WqbMQ94g==", + "version": "5.0.7", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.7.tgz", + "integrity": "sha512-7oFy703dxfY3/NLxC1fh2SUCQ0H9rmAY+5EpDVfXjUTTs+HEwR2nYaqLv+GWcTsumwxPfiz6CzCNkwXwBUwqCA==", "license": "MIT", "dependencies": { "balanced-match": "^4.0.2" From 909828cd53976350516a8ab34d4c50cec7511d32 Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Wed, 22 Jul 2026 06:43:21 +0100 Subject: [PATCH 09/95] Base custom request options on defaults, and add basic tests for `makeProxyRequestOptions` --- lib/entry-points.js | 6 +++++- src/api-client.test.ts | 21 +++++++++++++++++++++ src/api-client.ts | 18 +++++++++++------- 3 files changed, 37 insertions(+), 8 deletions(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index 0183005a70..b91e8c1e06 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -145788,7 +145788,11 @@ function getRegistryProxy(action) { return void 0; } function makeProxyRequestOptions(dispatcher) { + if (dispatcher === void 0) { + return githubUtils.defaults.request; + } return { + ...githubUtils.defaults.request, fetch: (req, init2) => { return (0, import_undici.fetch)(req, { ...init2, dispatcher }); } @@ -145797,7 +145801,7 @@ function makeProxyRequestOptions(dispatcher) { function createApiClientWithDetails(apiDetails, { allowExternal = false, proxy = void 0 } = {}) { const auth2 = allowExternal && apiDetails.externalRepoAuth || apiDetails.auth; const retryingOctokit = githubUtils.GitHub.plugin(retry); - const requestOptions = proxy === void 0 ? githubUtils.defaults.request : makeProxyRequestOptions(proxy); + const requestOptions = makeProxyRequestOptions(proxy); return new retryingOctokit( githubUtils.getOctokitOptions(auth2, { baseUrl: apiDetails.apiURL, diff --git a/src/api-client.test.ts b/src/api-client.test.ts index e43f16ef29..ae8c6269b1 100644 --- a/src/api-client.test.ts +++ b/src/api-client.test.ts @@ -2,6 +2,7 @@ import * as github from "@actions/github"; import * as githubUtils from "@actions/github/lib/utils"; import test from "ava"; import * as sinon from "sinon"; +import { ProxyAgent } from "undici"; import * as actionsUtil from "./actions-util"; import * as api from "./api-client"; @@ -251,3 +252,23 @@ test("getRegistryProxyConfig - gets the configuration from the env vars", async ) .passes(t.like, { host, port, ca }); }); + +test("makeProxyRequestOptions - returns defaults without custom proxy", async (t) => { + t.deepEqual( + api.makeProxyRequestOptions(undefined), + githubUtils.defaults.request, + ); +}); + +test("makeProxyRequestOptions - returns fetch with custom proxy", async (t) => { + const opts = api.makeProxyRequestOptions( + new ProxyAgent("http://localhost:1080"), + ); + // Fetch should be different from the defaults. + t.notDeepEqual(opts?.fetch, githubUtils.defaults.request?.fetch); + // The options should be the same aside from that. + t.deepEqual( + { ...opts, fetch: githubUtils.defaults.request?.fetch }, + githubUtils.defaults.request, + ); +}); diff --git a/src/api-client.ts b/src/api-client.ts index 7c63b5a6fe..ba800a2587 100644 --- a/src/api-client.ts +++ b/src/api-client.ts @@ -108,12 +108,19 @@ export function getRegistryProxy( * Constructs a `RequestRequestOptions` with a custom `fetch` implementation * that uses `dispatcher` as a proxy for requests. * - * @param dispatcher The proxy to use. + * @param dispatcher The proxy to use, if any. */ export function makeProxyRequestOptions( - dispatcher: ProxyAgent, -): RequestRequestOptions { + dispatcher: ProxyAgent | undefined, +): RequestRequestOptions | undefined { + // If we don't have a custom `ProxyAgent`, return the defaults. + if (dispatcher === undefined) { + return githubUtils.defaults.request; + } + + // Otherwise, construct the custom `fetch` and add it onto the defaults. return { + ...githubUtils.defaults.request, fetch: (req: RequestInfo, init?: RequestInit) => { return undiciFetch(req, { ...init, dispatcher }); }, @@ -136,10 +143,7 @@ function createApiClientWithDetails( const auth = (allowExternal && apiDetails.externalRepoAuth) || apiDetails.auth; const retryingOctokit = githubUtils.GitHub.plugin(retry.retry); - const requestOptions = - proxy === undefined - ? githubUtils.defaults.request - : makeProxyRequestOptions(proxy); + const requestOptions = makeProxyRequestOptions(proxy); return new retryingOctokit( githubUtils.getOctokitOptions(auth, { baseUrl: apiDetails.apiURL, From 84ae30d972fec62c064734759d8ba9c3ee34746c Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Wed, 22 Jul 2026 07:23:08 +0100 Subject: [PATCH 10/95] Only allow traffic via the proxy in `global-proxy` test --- .github/workflows/__global-proxy.yml | 19 +++++++++++++++++++ pr-checks/checks/global-proxy.yml | 19 +++++++++++++++++++ 2 files changed, 38 insertions(+) diff --git a/.github/workflows/__global-proxy.yml b/.github/workflows/__global-proxy.yml index e3ba6ff101..6fc7a2da59 100644 --- a/.github/workflows/__global-proxy.yml +++ b/.github/workflows/__global-proxy.yml @@ -55,6 +55,24 @@ jobs: version: ${{ matrix.version }} use-all-platform-bundle: 'false' setup-kotlin: 'false' + - name: Block direct internet access to force proxy usage + run: | + apt-get update -qq && apt-get install -y -qq iptables >/dev/null 2>&1 + PROXY_IP=$(getent hosts squid-proxy | awk '{ print $1 }') + echo "Squid proxy IP: $PROXY_IP" + # Allow all traffic to the proxy container + iptables -A OUTPUT -d "$PROXY_IP" -j ACCEPT + # Allow DNS resolution + iptables -A OUTPUT -p udp --dport 53 -j ACCEPT + iptables -A OUTPUT -p tcp --dport 53 -j ACCEPT + # Allow loopback + iptables -A OUTPUT -o lo -j ACCEPT + # Allow already-established connections (from checkout/prepare-test) + iptables -A OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT + # Block all other outbound HTTP and HTTPS, ensuring direct access fails + iptables -A OUTPUT -p tcp --dport 80 -j REJECT --reject-with tcp-reset + iptables -A OUTPUT -p tcp --dport 443 -j REJECT --reject-with tcp-reset + echo "Direct HTTP/HTTPS access is now blocked - all traffic must go through the proxy" - uses: ./../action/init with: languages: javascript @@ -66,6 +84,7 @@ jobs: CODEQL_ACTION_TEST_MODE: true container: image: ubuntu:22.04 + options: --cap-add=NET_ADMIN services: squid-proxy: image: ubuntu/squid:latest diff --git a/pr-checks/checks/global-proxy.yml b/pr-checks/checks/global-proxy.yml index 5f90022c04..8debe3c5b9 100644 --- a/pr-checks/checks/global-proxy.yml +++ b/pr-checks/checks/global-proxy.yml @@ -5,6 +5,7 @@ versions: - nightly-latest container: image: ubuntu:22.04 + options: --cap-add=NET_ADMIN services: squid-proxy: image: ubuntu/squid:latest @@ -14,6 +15,24 @@ env: https_proxy: http://squid-proxy:3128 CODEQL_ACTION_TOLERATE_MISSING_GIT_VERSION: true steps: + - name: Block direct internet access to force proxy usage + run: | + apt-get update -qq && apt-get install -y -qq iptables >/dev/null 2>&1 + PROXY_IP=$(getent hosts squid-proxy | awk '{ print $1 }') + echo "Squid proxy IP: $PROXY_IP" + # Allow all traffic to the proxy container + iptables -A OUTPUT -d "$PROXY_IP" -j ACCEPT + # Allow DNS resolution + iptables -A OUTPUT -p udp --dport 53 -j ACCEPT + iptables -A OUTPUT -p tcp --dport 53 -j ACCEPT + # Allow loopback + iptables -A OUTPUT -o lo -j ACCEPT + # Allow already-established connections (from checkout/prepare-test) + iptables -A OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT + # Block all other outbound HTTP and HTTPS, ensuring direct access fails + iptables -A OUTPUT -p tcp --dport 80 -j REJECT --reject-with tcp-reset + iptables -A OUTPUT -p tcp --dport 443 -j REJECT --reject-with tcp-reset + echo "Direct HTTP/HTTPS access is now blocked - all traffic must go through the proxy" - uses: ./../action/init with: languages: javascript From a2bfb64790ec008b14f219b15582931a21495a31 Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Wed, 22 Jul 2026 07:26:00 +0100 Subject: [PATCH 11/95] Set other proxy env vars --- .github/workflows/__global-proxy.yml | 11 ++++++++++- pr-checks/checks/global-proxy.yml | 11 ++++++++++- 2 files changed, 20 insertions(+), 2 deletions(-) diff --git a/.github/workflows/__global-proxy.yml b/.github/workflows/__global-proxy.yml index 6fc7a2da59..45df36f268 100644 --- a/.github/workflows/__global-proxy.yml +++ b/.github/workflows/__global-proxy.yml @@ -73,13 +73,22 @@ jobs: iptables -A OUTPUT -p tcp --dport 80 -j REJECT --reject-with tcp-reset iptables -A OUTPUT -p tcp --dport 443 -j REJECT --reject-with tcp-reset echo "Direct HTTP/HTTPS access is now blocked - all traffic must go through the proxy" + + - name: Set proxy environment variables + shell: bash + run: | + echo "http_proxy=http://squid-proxy:3128" >> $GITHUB_ENV + echo "HTTP_PROXY=http://squid-proxy:3128" >> $GITHUB_ENV + echo "https_proxy=http://squid-proxy:3128" >> $GITHUB_ENV + echo "HTTPS_PROXY=http://squid-proxy:3128" >> $GITHUB_ENV + - uses: ./../action/init with: languages: javascript tools: ${{ steps.prepare-test.outputs.tools-url }} + - uses: ./../action/analyze env: - https_proxy: http://squid-proxy:3128 CODEQL_ACTION_TOLERATE_MISSING_GIT_VERSION: true CODEQL_ACTION_TEST_MODE: true container: diff --git a/pr-checks/checks/global-proxy.yml b/pr-checks/checks/global-proxy.yml index 8debe3c5b9..9d9653c13c 100644 --- a/pr-checks/checks/global-proxy.yml +++ b/pr-checks/checks/global-proxy.yml @@ -12,7 +12,6 @@ services: ports: - 3128:3128 env: - https_proxy: http://squid-proxy:3128 CODEQL_ACTION_TOLERATE_MISSING_GIT_VERSION: true steps: - name: Block direct internet access to force proxy usage @@ -33,8 +32,18 @@ steps: iptables -A OUTPUT -p tcp --dport 80 -j REJECT --reject-with tcp-reset iptables -A OUTPUT -p tcp --dport 443 -j REJECT --reject-with tcp-reset echo "Direct HTTP/HTTPS access is now blocked - all traffic must go through the proxy" + + - name: Set proxy environment variables + shell: bash + run: | + echo "http_proxy=http://squid-proxy:3128" >> $GITHUB_ENV + echo "HTTP_PROXY=http://squid-proxy:3128" >> $GITHUB_ENV + echo "https_proxy=http://squid-proxy:3128" >> $GITHUB_ENV + echo "HTTPS_PROXY=http://squid-proxy:3128" >> $GITHUB_ENV + - uses: ./../action/init with: languages: javascript tools: ${{ steps.prepare-test.outputs.tools-url }} + - uses: ./../action/analyze From f342ca924759c9d70dc7d5cdd8afb977f2747921 Mon Sep 17 00:00:00 2001 From: Henry Mercer Date: Tue, 21 Jul 2026 13:05:33 +0100 Subject: [PATCH 12/95] Preserve bundle compression coverage Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- src/setup-codeql.test.ts | 85 +++++++++++++++++++++++++++++----------- 1 file changed, 62 insertions(+), 23 deletions(-) diff --git a/src/setup-codeql.test.ts b/src/setup-codeql.test.ts index 1f0318d9f0..33dfc079ba 100644 --- a/src/setup-codeql.test.ts +++ b/src/setup-codeql.test.ts @@ -117,30 +117,69 @@ test.serial( }, ); -test.serial( - "getCodeQLSource correctly returns bundled CLI version when tools == linked", - async (t) => { - const features = createFeatures([]); - - await withTmpDir(async (tmpDir) => { - setupActionsVars(tmpDir, tmpDir); - const source = await setupCodeql.getCodeQLSource( - "linked", - SAMPLE_DEFAULT_CLI_VERSION, - undefined, // rawLanguages - false, // useOverlayAwareDefaultCliVersion - SAMPLE_DOTCOM_API_DETAILS, - GitHubVariant.DOTCOM, - false, - features, - getRunnerLogger(true), - ); - - t.is(source.toolsVersion, LINKED_CLI_VERSION.cliVersion); - t.is(source.sourceType, "download"); - }); +const LINKED_BUNDLE_TEST_CASES = [ + { + platform: "linux", + tarSupportsZstd: true, + expectedBundleName: "codeql-bundle-linux64.tar.zst", + expectedCompressionMethod: "zstd", }, -); + { + platform: "darwin", + tarSupportsZstd: true, + expectedBundleName: "codeql-bundle-osx64.tar.zst", + expectedCompressionMethod: "zstd", + }, + { + platform: "win32", + tarSupportsZstd: true, + expectedBundleName: "codeql-bundle-win64.tar.gz", + expectedCompressionMethod: "gzip", + }, + { + platform: "linux", + tarSupportsZstd: false, + expectedBundleName: "codeql-bundle-linux64.tar.gz", + expectedCompressionMethod: "gzip", + }, +] as const; + +for (const { + platform, + tarSupportsZstd, + expectedBundleName, + expectedCompressionMethod, +} of LINKED_BUNDLE_TEST_CASES) { + test.serial( + `getCodeQLSource selects ${expectedBundleName} for linked tools`, + async (t) => { + const features = createFeatures([]); + sinon.stub(process, "platform").value(platform); + + await withTmpDir(async (tmpDir) => { + setupActionsVars(tmpDir, tmpDir); + const source = await setupCodeql.getCodeQLSource( + "linked", + SAMPLE_DEFAULT_CLI_VERSION, + undefined, // rawLanguages + false, // useOverlayAwareDefaultCliVersion + SAMPLE_DOTCOM_API_DETAILS, + GitHubVariant.DOTCOM, + tarSupportsZstd, + features, + getRunnerLogger(true), + ); + + t.is(source.toolsVersion, LINKED_CLI_VERSION.cliVersion); + t.is(source.sourceType, "download"); + if (source.sourceType === "download") { + t.is(source.compressionMethod, expectedCompressionMethod); + t.true(source.codeqlURL.endsWith(`/${expectedBundleName}`)); + } + }); + }, + ); +} test.serial( "getCodeQLSource correctly returns bundled CLI version when tools == latest", From 90ea144182f24a0744e76f0d12f930690f566933 Mon Sep 17 00:00:00 2001 From: Henry Mercer Date: Tue, 21 Jul 2026 13:08:21 +0100 Subject: [PATCH 13/95] Strengthen download status report tests Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- src/codeql.test.ts | 33 +++++----------- src/tools-download.test.ts | 78 ++++++++++++++++++++++++++++++++++++++ 2 files changed, 87 insertions(+), 24 deletions(-) create mode 100644 src/tools-download.test.ts diff --git a/src/codeql.test.ts b/src/codeql.test.ts index d83bc763be..84f48b83c9 100644 --- a/src/codeql.test.ts +++ b/src/codeql.test.ts @@ -156,6 +156,7 @@ test.serial( t.assert(toolcache.find("CodeQL", `0.0.0-${version}`)); t.is(result.toolsVersion, `0.0.0-${version}`); t.is(result.toolsSource, ToolsSource.Download); + assertDownloadDurationInteger(t, result.toolsDownloadStatusReport); } t.is(toolcache.findAllVersions("CodeQL").length, 2); @@ -191,9 +192,7 @@ test.serial( t.assert(toolcache.find("CodeQL", `2.15.0`)); t.is(result.toolsVersion, `2.15.0`); t.is(result.toolsSource, ToolsSource.Download); - if (result.toolsDownloadStatusReport) { - assertDownloadDurationInteger(t, result.toolsDownloadStatusReport); - } + assertDownloadDurationInteger(t, result.toolsDownloadStatusReport); }); }, ); @@ -230,9 +229,7 @@ test.serial( t.assert(toolcache.find("CodeQL", "0.0.0-20200610")); t.deepEqual(result.toolsVersion, "0.0.0-20200610"); t.is(result.toolsSource, ToolsSource.Download); - if (result.toolsDownloadStatusReport) { - assertDownloadDurationInteger(t, result.toolsDownloadStatusReport); - } + assertDownloadDurationInteger(t, result.toolsDownloadStatusReport); }); }, ); @@ -282,11 +279,7 @@ for (const { t.assert(toolcache.find("CodeQL", expectedToolcacheVersion)); t.deepEqual(result.toolsVersion, expectedToolcacheVersion); t.is(result.toolsSource, ToolsSource.Download); - t.assert( - Number.isInteger( - result.toolsDownloadStatusReport?.downloadDurationMs, - ), - ); + assertDownloadDurationInteger(t, result.toolsDownloadStatusReport); }); }, ); @@ -417,9 +410,7 @@ test.serial( ); t.deepEqual(result.toolsVersion, defaults.cliVersion); t.is(result.toolsSource, ToolsSource.Download); - if (result.toolsDownloadStatusReport) { - assertDownloadDurationInteger(t, result.toolsDownloadStatusReport); - } + t.truthy(result.toolsDownloadStatusReport); const cachedVersions = toolcache.findAllVersions("CodeQL"); t.is(cachedVersions.length, 2); @@ -458,9 +449,7 @@ test.serial( ); t.deepEqual(result.toolsVersion, defaults.cliVersion); t.is(result.toolsSource, ToolsSource.Download); - if (result.toolsDownloadStatusReport) { - assertDownloadDurationInteger(t, result.toolsDownloadStatusReport); - } + t.truthy(result.toolsDownloadStatusReport); const cachedVersions = toolcache.findAllVersions("CodeQL"); t.is(cachedVersions.length, 2); @@ -502,9 +491,7 @@ test.serial( t.is(result.toolsVersion, "0.0.0-20230203"); t.is(result.toolsSource, ToolsSource.Download); - if (result.toolsDownloadStatusReport) { - assertDownloadDurationInteger(t, result.toolsDownloadStatusReport); - } + assertDownloadDurationInteger(t, result.toolsDownloadStatusReport); const cachedVersions = toolcache.findAllVersions("CodeQL"); t.is(cachedVersions.length, 1); @@ -517,11 +504,9 @@ test.serial( function assertDownloadDurationInteger( t: ExecutionContext, - statusReport: ToolsDownloadStatusReport, + statusReport: ToolsDownloadStatusReport | undefined, ) { - if (statusReport.downloadDurationMs !== undefined) { - t.assert(Number.isInteger(statusReport.downloadDurationMs)); - } + t.assert(Number.isInteger(statusReport?.downloadDurationMs)); } test.serial("getExtraOptions works for explicit paths", (t) => { diff --git a/src/tools-download.test.ts b/src/tools-download.test.ts new file mode 100644 index 0000000000..e17d38c5be --- /dev/null +++ b/src/tools-download.test.ts @@ -0,0 +1,78 @@ +import { once } from "events"; +import * as path from "path"; + +import * as toolcache from "@actions/tool-cache"; +import test from "ava"; +import nock from "nock"; +import * as sinon from "sinon"; + +import { getRunnerLogger } from "./logging"; +import * as tar from "./tar"; +import { setupTests } from "./testing-utils"; +import { downloadAndExtract } from "./tools-download"; +import { withTmpDir } from "./util"; + +setupTests(test); + +test.serial( + "downloadAndExtract reports the duration when downloading before extracting", + async (t) => { + await withTmpDir(async (tmpDir) => { + const archivePath = path.join(tmpDir, "codeql-bundle.tar.gz"); + const destination = path.join(tmpDir, "codeql"); + sinon.stub(toolcache, "downloadTool").resolves(archivePath); + sinon.stub(tar, "extract").resolves(destination); + + const statusReport = await downloadAndExtract( + "https://example.com/codeql-bundle.tar.gz", + "gzip", + destination, + undefined, + {}, + undefined, + getRunnerLogger(true), + ); + + t.assert(Number.isInteger(statusReport.downloadDurationMs)); + }); + }, +); + +test.serial( + "downloadAndExtract omits the download duration when streaming extraction", + async (t) => { + await withTmpDir(async (tmpDir) => { + sinon.stub(process, "platform").value("linux"); + const downloadTool = sinon.stub(toolcache, "downloadTool"); + const extractTarZst = sinon + .stub(tar, "extractTarZst") + .callsFake(async (archive) => { + if (typeof archive === "string") { + t.fail("Expected the Zstandard archive to be streamed."); + return; + } + const end = once(archive, "end"); + archive.resume(); + await end; + }); + const request = nock("https://example.com") + .get("/codeql-bundle.tar.zst") + .reply(200, "archive"); + + const statusReport = await downloadAndExtract( + "https://example.com/codeql-bundle.tar.zst", + "zstd", + path.join(tmpDir, "codeql"), + undefined, + {}, + { type: "gnu", version: "1.34" }, + getRunnerLogger(true), + ); + + t.deepEqual(statusReport, {}); + t.false(downloadTool.called); + t.true(extractTarZst.calledOnce); + t.true(request.isDone()); + }); + }, +); From 009715ddbfe6fa887b1ac76fe840f953d7bf8db8 Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Wed, 22 Jul 2026 13:28:48 +0100 Subject: [PATCH 14/95] Add `github-codeql-tools` property --- lib/entry-points.js | 4 +++- src/feature-flags/properties.test.ts | 18 ++++++++++++------ src/feature-flags/properties.ts | 4 ++++ 3 files changed, 19 insertions(+), 7 deletions(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index 0183005a70..6d64de80e2 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -147902,6 +147902,7 @@ var RepositoryPropertyName = /* @__PURE__ */ ((RepositoryPropertyName2) => { RepositoryPropertyName2["DISABLE_OVERLAY"] = "github-codeql-disable-overlay"; RepositoryPropertyName2["EXTRA_QUERIES"] = "github-codeql-extra-queries"; RepositoryPropertyName2["FILE_COVERAGE_ON_PRS"] = "github-codeql-file-coverage-on-prs"; + RepositoryPropertyName2["TOOLS"] = "github-codeql-tools"; return RepositoryPropertyName2; })(RepositoryPropertyName || {}); function isString2(value) { @@ -147920,7 +147921,8 @@ var repositoryPropertyParsers = { ["github-codeql-config-file" /* CONFIG_FILE */]: stringProperty, ["github-codeql-disable-overlay" /* DISABLE_OVERLAY */]: booleanProperty, ["github-codeql-extra-queries" /* EXTRA_QUERIES */]: stringProperty, - ["github-codeql-file-coverage-on-prs" /* FILE_COVERAGE_ON_PRS */]: booleanProperty + ["github-codeql-file-coverage-on-prs" /* FILE_COVERAGE_ON_PRS */]: booleanProperty, + ["github-codeql-tools" /* TOOLS */]: stringProperty }; async function loadPropertiesFromApi(logger, repositoryNwo) { try { diff --git a/src/feature-flags/properties.test.ts b/src/feature-flags/properties.test.ts index 66526b1fb2..d3094a8d1c 100644 --- a/src/feature-flags/properties.test.ts +++ b/src/feature-flags/properties.test.ts @@ -72,13 +72,17 @@ test.serial( ); test.serial("loadPropertiesFromApi loads known properties", async (t) => { + const knownProperties = [ + { property_name: "github-codeql-config-file", value: "owner/repo" }, + { property_name: "github-codeql-extra-queries", value: "+queries" }, + { property_name: "github-codeql-tools", value: "nightly" }, + ]; sinon.stub(api, "getRepositoryProperties").resolves({ headers: {}, status: 200, url: "", data: [ - { property_name: "github-codeql-config-file", value: "owner/repo" }, - { property_name: "github-codeql-extra-queries", value: "+queries" }, + ...knownProperties, { property_name: "unknown-property", value: "something" }, ] satisfies properties.GitHubPropertiesResponse, }); @@ -88,10 +92,12 @@ test.serial("loadPropertiesFromApi loads known properties", async (t) => { logger, mockRepositoryNwo, ); - t.deepEqual(response, { - "github-codeql-config-file": "owner/repo", - "github-codeql-extra-queries": "+queries", - }); + t.deepEqual( + response, + Object.fromEntries( + knownProperties.map((prop) => [prop.property_name, prop.value]), + ), + ); }); test.serial("loadPropertiesFromApi parses true boolean property", async (t) => { diff --git a/src/feature-flags/properties.ts b/src/feature-flags/properties.ts index e239c71947..82c1c748e0 100644 --- a/src/feature-flags/properties.ts +++ b/src/feature-flags/properties.ts @@ -14,6 +14,7 @@ export enum RepositoryPropertyName { DISABLE_OVERLAY = "github-codeql-disable-overlay", EXTRA_QUERIES = "github-codeql-extra-queries", FILE_COVERAGE_ON_PRS = "github-codeql-file-coverage-on-prs", + TOOLS = "github-codeql-tools", } /** Parsed types of the known repository properties. */ @@ -22,6 +23,7 @@ export type AllRepositoryProperties = { [RepositoryPropertyName.DISABLE_OVERLAY]: boolean; [RepositoryPropertyName.EXTRA_QUERIES]: string; [RepositoryPropertyName.FILE_COVERAGE_ON_PRS]: boolean; + [RepositoryPropertyName.TOOLS]: string; }; /** Parsed repository properties. */ @@ -33,6 +35,7 @@ export type RepositoryPropertyApiType = { [RepositoryPropertyName.DISABLE_OVERLAY]: string; [RepositoryPropertyName.EXTRA_QUERIES]: string; [RepositoryPropertyName.FILE_COVERAGE_ON_PRS]: string; + [RepositoryPropertyName.TOOLS]: string; }; /** The type of functions which take the `value` from the API and try to convert it to the type we want. */ @@ -81,6 +84,7 @@ const repositoryPropertyParsers: { [RepositoryPropertyName.DISABLE_OVERLAY]: booleanProperty, [RepositoryPropertyName.EXTRA_QUERIES]: stringProperty, [RepositoryPropertyName.FILE_COVERAGE_ON_PRS]: booleanProperty, + [RepositoryPropertyName.TOOLS]: stringProperty, }; /** From 1f57eb0ff5042ed1e738ac840f6adfe9f20bd269 Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Wed, 22 Jul 2026 13:43:43 +0100 Subject: [PATCH 15/95] Add FF for `tools` repository property --- lib/entry-points.js | 5 +++++ src/feature-flags.ts | 7 +++++++ 2 files changed, 12 insertions(+) diff --git a/lib/entry-points.js b/lib/entry-points.js index 6d64de80e2..04be134c22 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -146931,6 +146931,11 @@ var featureConfig = { envVar: "CODEQL_ACTION_START_PROXY_USE_FEATURES_RELEASE", minimumVersion: void 0 }, + ["tools_repository_property" /* ToolsRepositoryProperty */]: { + defaultValue: false, + envVar: "CODEQL_ACTION_TOOLS_REPOSITORY_PROPERTY", + minimumVersion: void 0 + }, ["upload_overlay_db_to_api" /* UploadOverlayDbToApi */]: { defaultValue: false, envVar: "CODEQL_ACTION_UPLOAD_OVERLAY_DB_TO_API", diff --git a/src/feature-flags.ts b/src/feature-flags.ts index 0c92ac69af..33c02c13eb 100644 --- a/src/feature-flags.ts +++ b/src/feature-flags.ts @@ -141,6 +141,8 @@ export enum Feature { /** Note that this currently only disables baseline file coverage information. */ SkipFileCoverageOnPrs = "skip_file_coverage_on_prs", StartProxyUseFeaturesRelease = "start_proxy_use_features_release", + /** Whether to allow the `tools` input to be specified via a repository property. */ + ToolsRepositoryProperty = "tools_repository_property", UploadOverlayDbToApi = "upload_overlay_db_to_api", ValidateDbConfig = "validate_db_config", } @@ -400,6 +402,11 @@ export const featureConfig = { envVar: "CODEQL_ACTION_START_PROXY_USE_FEATURES_RELEASE", minimumVersion: undefined, }, + [Feature.ToolsRepositoryProperty]: { + defaultValue: false, + envVar: "CODEQL_ACTION_TOOLS_REPOSITORY_PROPERTY", + minimumVersion: undefined, + }, [Feature.UploadOverlayDbToApi]: { defaultValue: false, envVar: "CODEQL_ACTION_UPLOAD_OVERLAY_DB_TO_API", From f58d69685da7d9984428bdabe7f997f5ebe782fe Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Wed, 22 Jul 2026 14:16:24 +0100 Subject: [PATCH 16/95] Move `loadRepositoryProperties` to `properties.ts` --- lib/entry-points.js | 50 ++++++++++++++++----------------- src/feature-flags/properties.ts | 35 +++++++++++++++++++++++ src/init-action.ts | 43 ++-------------------------- 3 files changed, 62 insertions(+), 66 deletions(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index 04be134c22..1994e3b7c8 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -147901,6 +147901,7 @@ function getUnknownLanguagesError(languages) { } // src/feature-flags/properties.ts +var github2 = __toESM(require_github()); var GITHUB_CODEQL_PROPERTY_PREFIX = "github-codeql-"; var RepositoryPropertyName = /* @__PURE__ */ ((RepositoryPropertyName2) => { RepositoryPropertyName2["CONFIG_FILE"] = "github-codeql-config-file"; @@ -148007,6 +148008,26 @@ var KNOWN_REPOSITORY_PROPERTY_NAMES = new Set( function isKnownPropertyName(name) { return KNOWN_REPOSITORY_PROPERTY_NAMES.has(name); } +async function loadRepositoryProperties(repositoryNwo, logger) { + const repositoryOwnerType = github2.context.payload.repository?.owner.type; + logger.debug( + `Repository owner type is '${repositoryOwnerType ?? "unknown"}'.` + ); + if (repositoryOwnerType === "User") { + logger.debug( + "Skipping loading repository properties because the repository is owned by a user and therefore cannot have repository properties." + ); + return new Success({}); + } + try { + return new Success(await loadPropertiesFromApi(logger, repositoryNwo)); + } catch (error3) { + logger.warning( + `Failed to load repository properties: ${getErrorMessage(error3)}` + ); + return new Failure(error3); + } +} // src/config/db-config.ts var ORG_SCHEMA = { @@ -154021,7 +154042,7 @@ var fs19 = __toESM(require("fs")); var path17 = __toESM(require("path")); var core14 = __toESM(require_core()); var toolrunner4 = __toESM(require_toolrunner()); -var github2 = __toESM(require_github()); +var github3 = __toESM(require_github()); var io6 = __toESM(require_io()); async function initCodeQL(toolsInput, apiDetails, tempDir, variant, defaultCliVersion, rawLanguages, useOverlayAwareDefaultCliVersion, features, logger) { logger.startGroup("Setup CodeQL tools"); @@ -154225,7 +154246,7 @@ function logFileCoverageOnPrsDeprecationWarning(logger) { if (process.env["CODEQL_ACTION_DID_LOG_FILE_COVERAGE_ON_PRS_DEPRECATION" /* DID_LOG_FILE_COVERAGE_ON_PRS_DEPRECATION */]) { return; } - const repositoryOwnerType = github2.context.payload.repository?.owner.type; + const repositoryOwnerType = github3.context.payload.repository?.owner.type; let message = "Starting April 2026, the CodeQL Action will skip computing file coverage information on pull requests to improve analysis performance. File coverage information will still be computed on non-PR analyses."; const envVarOptOut = "set the `CODEQL_ACTION_FILE_COVERAGE_ON_PRS` environment variable to `true`."; const repoPropertyOptOut = 'create a custom repository property with the name `github-codeql-file-coverage-on-prs` and the type "True/false", then set this property to `true` in the repository\'s settings.'; @@ -157348,7 +157369,7 @@ var import_async = __toESM(require_async(), 1); var import_path6 = require("path"); // node_modules/archiver/lib/error.js -var import_util32 = __toESM(require("util"), 1); +var import_util33 = __toESM(require("util"), 1); var ERROR_CODES = { ABORTED: "archive was aborted", DIRECTORYDIRPATHREQUIRED: "diretory dirpath argument must be a non-empty string value", @@ -157373,7 +157394,7 @@ function ArchiverError(code, data) { this.code = code; this.data = data; } -import_util32.default.inherits(ArchiverError, Error); +import_util33.default.inherits(ArchiverError, Error); // node_modules/archiver/lib/core.js var import_readable_stream2 = __toESM(require_ours(), 1); @@ -160304,7 +160325,6 @@ async function runWrapper3() { var fs28 = __toESM(require("fs")); var path24 = __toESM(require("path")); var core21 = __toESM(require_core()); -var github3 = __toESM(require_github()); var io7 = __toESM(require_io()); var semver10 = __toESM(require_semver2()); @@ -161076,26 +161096,6 @@ exec ${goBinaryPath} "$@"` logger ); } -async function loadRepositoryProperties(repositoryNwo, logger) { - const repositoryOwnerType = github3.context.payload.repository?.owner.type; - logger.debug( - `Repository owner type is '${repositoryOwnerType ?? "unknown"}'.` - ); - if (repositoryOwnerType === "User") { - logger.debug( - "Skipping loading repository properties because the repository is owned by a user and therefore cannot have repository properties." - ); - return new Success({}); - } - try { - return new Success(await loadPropertiesFromApi(logger, repositoryNwo)); - } catch (error3) { - logger.warning( - `Failed to load repository properties: ${getErrorMessage(error3)}` - ); - return new Failure(error3); - } -} async function recordZstdAvailability(config, zstdAvailability) { addNoLanguageDiagnostic( config, diff --git a/src/feature-flags/properties.ts b/src/feature-flags/properties.ts index 82c1c748e0..4c888bd5ec 100644 --- a/src/feature-flags/properties.ts +++ b/src/feature-flags/properties.ts @@ -1,7 +1,10 @@ +import * as github from "@actions/github"; + import { isDynamicWorkflow } from "../actions-util"; import { getRepositoryProperties } from "../api-client"; import { Logger } from "../logging"; import { RepositoryNwo } from "../repository"; +import { Failure, getErrorMessage, Result, Success } from "../util"; /** The common prefix that we expect all of our repository properties to have. */ export const GITHUB_CODEQL_PROPERTY_PREFIX = "github-codeql-"; @@ -234,3 +237,35 @@ const KNOWN_REPOSITORY_PROPERTY_NAMES = new Set( function isKnownPropertyName(name: string): name is RepositoryPropertyName { return KNOWN_REPOSITORY_PROPERTY_NAMES.has(name); } + +/** + * Loads [repository properties](https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization) if applicable. + */ +export async function loadRepositoryProperties( + repositoryNwo: RepositoryNwo, + logger: Logger, +): Promise> { + // See if we can skip loading repository properties early. In particular, + // repositories owned by users cannot have repository properties, so we can + // skip the API call entirely in that case. + const repositoryOwnerType = github.context.payload.repository?.owner.type; + logger.debug( + `Repository owner type is '${repositoryOwnerType ?? "unknown"}'.`, + ); + if (repositoryOwnerType === "User") { + logger.debug( + "Skipping loading repository properties because the repository is owned by a user and " + + "therefore cannot have repository properties.", + ); + return new Success({}); + } + + try { + return new Success(await loadPropertiesFromApi(logger, repositoryNwo)); + } catch (error) { + logger.warning( + `Failed to load repository properties: ${getErrorMessage(error)}`, + ); + return new Failure(error); + } +} diff --git a/src/init-action.ts b/src/init-action.ts index 8d0434160b..4dc3132302 100644 --- a/src/init-action.ts +++ b/src/init-action.ts @@ -2,7 +2,6 @@ import * as fs from "fs"; import * as path from "path"; import * as core from "@actions/core"; -import * as github from "@actions/github"; import * as io from "@actions/io"; import * as semver from "semver"; import { v4 as uuidV4 } from "uuid"; @@ -41,10 +40,7 @@ import { } from "./diagnostics"; import { EnvVar } from "./environment"; import { Feature, FeatureEnablement, initFeatures } from "./feature-flags"; -import { - loadPropertiesFromApi, - RepositoryProperties, -} from "./feature-flags/properties"; +import { loadRepositoryProperties } from "./feature-flags/properties"; import { checkInstallPython311, checkPacksForOverlayCompatibility, @@ -62,7 +58,7 @@ import { OverlayBaseDatabaseDownloadStats, } from "./overlay/caching"; import { OverlayDatabaseMode } from "./overlay/overlay-database-mode"; -import { getRepositoryNwo, RepositoryNwo } from "./repository"; +import { getRepositoryNwo } from "./repository"; import { ToolsSource } from "./setup-codeql"; import { ActionName, @@ -94,10 +90,7 @@ import { checkActionVersion, getErrorMessage, BuildMode, - Result, getOptionalEnvVar, - Success, - Failure, } from "./util"; import { checkWorkflow } from "./workflow"; @@ -805,38 +798,6 @@ async function run( ); } -/** - * Loads [repository properties](https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization) if applicable. - */ -async function loadRepositoryProperties( - repositoryNwo: RepositoryNwo, - logger: Logger, -): Promise> { - // See if we can skip loading repository properties early. In particular, - // repositories owned by users cannot have repository properties, so we can - // skip the API call entirely in that case. - const repositoryOwnerType = github.context.payload.repository?.owner.type; - logger.debug( - `Repository owner type is '${repositoryOwnerType ?? "unknown"}'.`, - ); - if (repositoryOwnerType === "User") { - logger.debug( - "Skipping loading repository properties because the repository is owned by a user and " + - "therefore cannot have repository properties.", - ); - return new Success({}); - } - - try { - return new Success(await loadPropertiesFromApi(logger, repositoryNwo)); - } catch (error) { - logger.warning( - `Failed to load repository properties: ${getErrorMessage(error)}`, - ); - return new Failure(error); - } -} - async function recordZstdAvailability( config: configUtils.Config, zstdAvailability: ZstdAvailability, From 3479f3fca19dc5dc7df5dba2e016f6a8de6a2748 Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Wed, 22 Jul 2026 14:21:53 +0100 Subject: [PATCH 17/95] Load repository properties in `setup-codeql` action --- src/setup-codeql-action.ts | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/src/setup-codeql-action.ts b/src/setup-codeql-action.ts index 3336afc1a2..d592ea8401 100644 --- a/src/setup-codeql-action.ts +++ b/src/setup-codeql-action.ts @@ -14,6 +14,7 @@ import { CodeQL } from "./codeql"; import { getRawLanguagesNoAutodetect } from "./config-utils"; import { EnvVar } from "./environment"; import { initFeatures } from "./feature-flags"; +import { loadRepositoryProperties } from "./feature-flags/properties"; import { initCodeQL } from "./init"; import { Logger } from "./logging"; import { getRepositoryNwo } from "./repository"; @@ -123,6 +124,13 @@ async function run({ logger, ); + // Fetch the values of known repository properties that affect us. + const repositoryPropertiesResult = await loadRepositoryProperties( + repositoryNwo, + logger, + ); + const repositoryProperties = repositoryPropertiesResult.orElse({}); + const jobRunUuid = uuidV4(); logger.info(`Job run UUID is ${jobRunUuid}.`); core.exportVariable(EnvVar.JOB_RUN_UUID, jobRunUuid); From 49f2e373108b82d79ac36307bc528470f6b6ca60 Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Wed, 22 Jul 2026 14:23:46 +0100 Subject: [PATCH 18/95] Add and use `getToolsInput` --- lib/entry-points.js | 73 +++++++++++++++++++++++++----- src/config/inputs.test.ts | 92 ++++++++++++++++++++++++++++++++++++++ src/config/inputs.ts | 84 ++++++++++++++++++++++++++++++++++ src/init-action.ts | 15 ++++++- src/setup-codeql-action.ts | 25 ++++++++--- 5 files changed, 271 insertions(+), 18 deletions(-) create mode 100644 src/config/inputs.test.ts create mode 100644 src/config/inputs.ts diff --git a/lib/entry-points.js b/lib/entry-points.js index 1994e3b7c8..3219bacfd6 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -160328,6 +160328,42 @@ var core21 = __toESM(require_core()); var io7 = __toESM(require_io()); var semver10 = __toESM(require_semver2()); +// src/config/inputs.ts +async function getToolsInput(action, repositoryProperties) { + const name = "tools" /* Tools */; + const input = action.actions.getOptionalInput(name); + const propertyValue = repositoryProperties["github-codeql-tools" /* TOOLS */]; + const allowRepositoryProperty = await action.features.getValue( + "tools_repository_property" /* ToolsRepositoryProperty */ + ); + if (allowRepositoryProperty && propertyValue?.startsWith("!")) { + action.logger.info( + `Using ${name} input from repository property (enforced): ${propertyValue}` + ); + return { + name, + // Drop the '!' from the value. + value: propertyValue.substring(1), + source: "repository-property" /* RepositoryProperty */ + }; + } + if (input !== void 0) { + action.logger.info(`Using ${name} input from workflow: ${input}`); + return { name, value: input, source: "workflow" /* Workflow */ }; + } + if (allowRepositoryProperty && propertyValue !== void 0) { + action.logger.info( + `Using ${name} input from repository property: ${propertyValue}` + ); + return { + name, + value: propertyValue, + source: "repository-property" /* RepositoryProperty */ + }; + } + return void 0; +} + // src/workflow.ts var fs27 = __toESM(require("fs")); var path23 = __toESM(require("path")); @@ -160618,7 +160654,7 @@ async function sendStartingStatusReport(startedAt, config, logger) { await sendStatusReport(statusReportBase); } } -async function sendCompletedStatusReport2(startedAt, config, configFile, toolsDownloadStatusReport, toolsFeatureFlagsValid, toolsSource, toolsVersion, overlayBaseDatabaseStats, dependencyCachingResults, logger, error3) { +async function sendCompletedStatusReport2(startedAt, config, configFile, toolsInput, toolsDownloadStatusReport, toolsFeatureFlagsValid, toolsSource, toolsVersion, overlayBaseDatabaseStats, dependencyCachingResults, logger, error3) { const statusReportBase = await createStatusReportBase( "init" /* Init */, getActionsStatus(error3), @@ -160635,7 +160671,7 @@ async function sendCompletedStatusReport2(startedAt, config, configFile, toolsDo const workflowLanguages = getOptionalInput("languages"); const initStatusReport = { ...statusReportBase, - tools_input: getOptionalInput("tools") || "", + tools_input: toolsInput?.value || "", tools_resolved_version: toolsVersion, tools_source: toolsSource || "UNKNOWN" /* Unknown */, workflow_languages: workflowLanguages || "" @@ -160675,6 +160711,7 @@ async function run3(actionState) { let codeql; let features; let sourceRoot; + let toolsInput; let toolsDownloadStatusReport; let toolsFeatureFlagsValid; let toolsSource; @@ -160731,6 +160768,10 @@ async function run3(actionState) { `The 'init' action should not be run in the same workflow as 'setup-codeql'.` ); } + toolsInput = await getToolsInput( + actionStateWithFeatures, + repositoryProperties + ); const codeQLDefaultVersionInfo = await features.getEnabledDefaultCliVersions(gitHubVersion.type); toolsFeatureFlagsValid = codeQLDefaultVersionInfo.toolsFeatureFlagsValid; const rawLanguages = getRawLanguagesNoAutodetect( @@ -160738,7 +160779,7 @@ async function run3(actionState) { ); const useOverlayAwareDefaultCliVersion = analysisKinds?.length === 1 && analysisKinds[0] === "code-scanning" /* CodeScanning */; const initCodeQLResult = await initCodeQL( - getOptionalInput("tools"), + toolsInput?.value, apiDetails, getTemporaryDirectory(), gitHubVersion.type, @@ -161070,6 +161111,7 @@ exec ${goBinaryPath} "$@"` config, void 0, // We only report config info on success. + toolsInput, toolsDownloadStatusReport, toolsFeatureFlagsValid, toolsSource, @@ -161087,6 +161129,7 @@ exec ${goBinaryPath} "$@"` startedAt, config, configFile, + toolsInput, toolsDownloadStatusReport, toolsFeatureFlagsValid, toolsSource, @@ -161656,7 +161699,7 @@ async function runWrapper6() { // src/setup-codeql-action.ts var core24 = __toESM(require_core()); -async function sendCompletedStatusReport3(startedAt, toolsDownloadStatusReport, toolsFeatureFlagsValid, toolsSource, toolsVersion, logger, error3) { +async function sendCompletedStatusReport3(startedAt, toolsInput, toolsDownloadStatusReport, toolsFeatureFlagsValid, toolsSource, toolsVersion, logger, error3) { const statusReportBase = await createStatusReportBase( "setup-codeql" /* SetupCodeQL */, getActionsStatus(error3), @@ -161672,7 +161715,7 @@ async function sendCompletedStatusReport3(startedAt, toolsDownloadStatusReport, } const initStatusReport = { ...statusReportBase, - tools_input: getOptionalInput("tools") || "", + tools_input: toolsInput?.value || "", tools_resolved_version: toolsVersion, tools_source: toolsSource || "UNKNOWN" /* Unknown */, workflow_languages: "" @@ -161686,11 +161729,10 @@ async function sendCompletedStatusReport3(startedAt, toolsDownloadStatusReport, } await sendStatusReport({ ...initStatusReport, ...initToolsDownloadFields }); } -async function run6({ - startedAt, - logger -}) { +async function run6(actionState) { + const { logger, startedAt } = actionState; let codeql; + let toolsInput; let toolsDownloadStatusReport; let toolsFeatureFlagsValid; let toolsSource; @@ -161713,6 +161755,12 @@ async function run6({ getTemporaryDirectory(), logger ); + const repositoryPropertiesResult = await loadRepositoryProperties( + repositoryNwo, + logger + ); + const repositoryProperties = repositoryPropertiesResult.orElse({}); + const actionStateWithFeatures = { ...actionState, features }; const jobRunUuid = v4_default(); logger.info(`Job run UUID is ${jobRunUuid}.`); core24.exportVariable("JOB_RUN_UUID" /* JOB_RUN_UUID */, jobRunUuid); @@ -161727,6 +161775,10 @@ async function run6({ if (statusReportBase !== void 0) { await sendStatusReport(statusReportBase); } + toolsInput = await getToolsInput( + actionStateWithFeatures, + repositoryProperties + ); const codeQLDefaultVersionInfo = await features.getEnabledDefaultCliVersions(gitHubVersion.type); toolsFeatureFlagsValid = codeQLDefaultVersionInfo.toolsFeatureFlagsValid; const rawLanguages = getRawLanguagesNoAutodetect( @@ -161734,7 +161786,7 @@ async function run6({ ); const analysisKinds = await getAnalysisKinds(logger, features); const initCodeQLResult = await initCodeQL( - getOptionalInput("tools"), + toolsInput?.value, apiDetails, getTemporaryDirectory(), gitHubVersion.type, @@ -161771,6 +161823,7 @@ async function run6({ } await sendCompletedStatusReport3( startedAt, + toolsInput, toolsDownloadStatusReport, toolsFeatureFlagsValid, toolsSource, diff --git a/src/config/inputs.test.ts b/src/config/inputs.test.ts new file mode 100644 index 0000000000..bf200bcf1f --- /dev/null +++ b/src/config/inputs.test.ts @@ -0,0 +1,92 @@ +import test from "ava"; +import sinon from "sinon"; + +import { getActionsEnv } from "../actions-util"; +import { Feature } from "../feature-flags"; +import { RepositoryPropertyName } from "../feature-flags/properties"; +import { callee } from "../testing-utils"; + +import { + EffectiveInput, + getToolsInput, + InputName, + InputSource, +} from "./inputs"; + +test("getToolsInput - undefined if there's no input", async (t) => { + await callee(getToolsInput).withArgs({}).passes(t.is, undefined); +}); + +const expectedWorkflowResult: EffectiveInput = { + name: InputName.Tools, + source: InputSource.Workflow, + value: "workflow-input-value", +}; + +const expectedRepositoryPropertyResult: EffectiveInput = { + name: InputName.Tools, + source: InputSource.RepositoryProperty, + value: "repo-property-input-value", +}; + +function stubGetToolsInput() { + const actions = getActionsEnv(); + sinon + .stub(actions, "getOptionalInput") + .withArgs(InputName.Tools) + .returns(expectedWorkflowResult.value); + return actions; +} + +test("getToolsInput - returns workflow input if available", async (t) => { + const actions = stubGetToolsInput(); + + await callee(getToolsInput) + .withActions(actions) + .withArgs({}) + .passes(t.deepEqual, expectedWorkflowResult); +}); + +test("getToolsInput - returns repository property value if enforced", async (t) => { + const actions = stubGetToolsInput(); + + const target = callee(getToolsInput) + .withActions(actions) + .withArgs({ + [RepositoryPropertyName.TOOLS]: `!${expectedRepositoryPropertyResult.value}`, + }); + + // We expect the repository value if provided and the FF is enabled. + await target + .withFeatures([Feature.ToolsRepositoryProperty]) + .passes(t.deepEqual, expectedRepositoryPropertyResult); + await target.passes(t.deepEqual, expectedWorkflowResult); +}); + +test("getToolsInput - prefers workflow input", async (t) => { + const actions = stubGetToolsInput(); + + const target = callee(getToolsInput) + .withActions(actions) + .withArgs({ + [RepositoryPropertyName.TOOLS]: expectedRepositoryPropertyResult.value, + }); + + // We expect the workflow input regardless of the FF state. + await target + .withFeatures([Feature.ToolsRepositoryProperty]) + .passes(t.deepEqual, expectedWorkflowResult); + await target.passes(t.deepEqual, expectedWorkflowResult); +}); + +test("getToolsInput - returns repository property", async (t) => { + const target = callee(getToolsInput).withArgs({ + [RepositoryPropertyName.TOOLS]: expectedRepositoryPropertyResult.value, + }); + + // We expect the repository property if the FF is enabled or undefined otherwise. + await target + .withFeatures([Feature.ToolsRepositoryProperty]) + .passes(t.deepEqual, expectedRepositoryPropertyResult); + await target.passes(t.is, undefined); +}); diff --git a/src/config/inputs.ts b/src/config/inputs.ts new file mode 100644 index 0000000000..1e3baa9218 --- /dev/null +++ b/src/config/inputs.ts @@ -0,0 +1,84 @@ +import { ActionState } from "../action-common"; +import { Feature } from "../feature-flags"; +import { + RepositoryProperties, + RepositoryPropertyName, +} from "../feature-flags/properties"; + +/** Enumerates input names. */ +export enum InputName { + Tools = "tools", +} + +/** Enumerates input sources. */ +export enum InputSource { + Workflow = "workflow", + RepositoryProperty = "repository-property", +} + +/** + * Represents an effective input to the CodeQL Action. That is, + * the input value that was computed or selected from multiple sources. + */ +export type EffectiveInput = { + /** The name of the property. */ + name: InputName; + /** The value of the property. */ + value: string; + /** The source of the property. */ + source: InputSource; +}; + +/** + * Gets the effective `tools` input. This comes from either the workflow or + * the repository property. + * + * @param action The Action state. + * @param repositoryProperties The values of known repository properties. + * @returns The effective input or `undefined` if there is no input. + */ +export async function getToolsInput( + action: ActionState<["Logger", "Actions", "FeatureFlags"]>, + repositoryProperties: Partial, +): Promise { + const name = InputName.Tools; + const input = action.actions.getOptionalInput(name); + const propertyValue = repositoryProperties[RepositoryPropertyName.TOOLS]; + const allowRepositoryProperty = await action.features.getValue( + Feature.ToolsRepositoryProperty, + ); + + // The repository property takes precedence if it starts with an '!'. + if (allowRepositoryProperty && propertyValue?.startsWith("!")) { + action.logger.info( + `Using ${name} input from repository property (enforced): ${propertyValue}`, + ); + return { + name, + // Drop the '!' from the value. + value: propertyValue.substring(1), + source: InputSource.RepositoryProperty, + }; + } + + // Otherwise, the input from the workflow takes precedence. + if (input !== undefined) { + action.logger.info(`Using ${name} input from workflow: ${input}`); + return { name, value: input, source: InputSource.Workflow }; + } + + // Use the repository property if there's no workflow input. + if (allowRepositoryProperty && propertyValue !== undefined) { + action.logger.info( + `Using ${name} input from repository property: ${propertyValue}`, + ); + return { + name, + value: propertyValue, + source: InputSource.RepositoryProperty, + }; + } + + // There's no input. + return undefined; +} diff --git a/src/init-action.ts b/src/init-action.ts index 4dc3132302..899a6d54e6 100644 --- a/src/init-action.ts +++ b/src/init-action.ts @@ -25,6 +25,7 @@ import { } from "./caching-utils"; import { CodeQL } from "./codeql"; import { getConfigFileInput } from "./config/file"; +import { EffectiveInput, getToolsInput } from "./config/inputs"; import * as configUtils from "./config-utils"; import { DependencyCacheRestoreStatusReport, @@ -130,6 +131,7 @@ async function sendCompletedStatusReport( startedAt: Date, config: configUtils.Config | undefined, configFile: string | undefined, + toolsInput: EffectiveInput | undefined, toolsDownloadStatusReport: ToolsDownloadStatusReport | undefined, toolsFeatureFlagsValid: boolean | undefined, toolsSource: ToolsSource, @@ -158,7 +160,7 @@ async function sendCompletedStatusReport( const initStatusReport: InitStatusReport = { ...statusReportBase, - tools_input: getOptionalInput("tools") || "", + tools_input: toolsInput?.value || "", tools_resolved_version: toolsVersion, tools_source: toolsSource || ToolsSource.Unknown, workflow_languages: workflowLanguages || "", @@ -211,6 +213,7 @@ async function run( let codeql: CodeQL; let features: FeatureEnablement; let sourceRoot: string; + let toolsInput: EffectiveInput | undefined; let toolsDownloadStatusReport: ToolsDownloadStatusReport | undefined; let toolsFeatureFlagsValid: boolean | undefined; let toolsSource: ToolsSource; @@ -295,6 +298,12 @@ async function run( ); } + // Get the effective `tools` input. + toolsInput = await getToolsInput( + actionStateWithFeatures, + repositoryProperties, + ); + const codeQLDefaultVersionInfo = await features.getEnabledDefaultCliVersions(gitHubVersion.type); toolsFeatureFlagsValid = codeQLDefaultVersionInfo.toolsFeatureFlagsValid; @@ -305,7 +314,7 @@ async function run( analysisKinds?.length === 1 && analysisKinds[0] === AnalysisKind.CodeScanning; const initCodeQLResult = await initCodeQL( - getOptionalInput("tools"), + toolsInput?.value, apiDetails, getTemporaryDirectory(), gitHubVersion.type, @@ -771,6 +780,7 @@ async function run( startedAt, config, undefined, // We only report config info on success. + toolsInput, toolsDownloadStatusReport, toolsFeatureFlagsValid, toolsSource, @@ -788,6 +798,7 @@ async function run( startedAt, config, configFile, + toolsInput, toolsDownloadStatusReport, toolsFeatureFlagsValid, toolsSource, diff --git a/src/setup-codeql-action.ts b/src/setup-codeql-action.ts index d592ea8401..6ebe6b3ce2 100644 --- a/src/setup-codeql-action.ts +++ b/src/setup-codeql-action.ts @@ -11,6 +11,7 @@ import { import { AnalysisKind, getAnalysisKinds } from "./analyses"; import { getGitHubVersion } from "./api-client"; import { CodeQL } from "./codeql"; +import { EffectiveInput, getToolsInput } from "./config/inputs"; import { getRawLanguagesNoAutodetect } from "./config-utils"; import { EnvVar } from "./environment"; import { initFeatures } from "./feature-flags"; @@ -44,6 +45,7 @@ import { */ async function sendCompletedStatusReport( startedAt: Date, + toolsInput: EffectiveInput | undefined, toolsDownloadStatusReport: ToolsDownloadStatusReport | undefined, toolsFeatureFlagsValid: boolean | undefined, toolsSource: ToolsSource, @@ -68,7 +70,7 @@ async function sendCompletedStatusReport( const initStatusReport: InitStatusReport = { ...statusReportBase, - tools_input: getOptionalInput("tools") || "", + tools_input: toolsInput?.value || "", tools_resolved_version: toolsVersion, tools_source: toolsSource || ToolsSource.Unknown, workflow_languages: "", @@ -88,14 +90,15 @@ async function sendCompletedStatusReport( } /** The main behaviour of this action. */ -async function run({ - startedAt, - logger, -}: ActionState<["Base", "Logger"]>): Promise { +async function run( + actionState: ActionState<["Base", "Logger", "Actions"]>, +): Promise { // To capture errors appropriately, keep as much code within the try-catch as // possible, and only use safe functions outside. + const { logger, startedAt } = actionState; let codeql: CodeQL; + let toolsInput: EffectiveInput | undefined; let toolsDownloadStatusReport: ToolsDownloadStatusReport | undefined; let toolsFeatureFlagsValid: boolean | undefined; let toolsSource: ToolsSource; @@ -131,6 +134,8 @@ async function run({ ); const repositoryProperties = repositoryPropertiesResult.orElse({}); + const actionStateWithFeatures = { ...actionState, features }; + const jobRunUuid = uuidV4(); logger.info(`Job run UUID is ${jobRunUuid}.`); core.exportVariable(EnvVar.JOB_RUN_UUID, jobRunUuid); @@ -146,6 +151,13 @@ async function run({ if (statusReportBase !== undefined) { await sendStatusReport(statusReportBase); } + + // Get the effective `tools` input. + toolsInput = await getToolsInput( + actionStateWithFeatures, + repositoryProperties, + ); + const codeQLDefaultVersionInfo = await features.getEnabledDefaultCliVersions(gitHubVersion.type); toolsFeatureFlagsValid = codeQLDefaultVersionInfo.toolsFeatureFlagsValid; @@ -154,7 +166,7 @@ async function run({ ); const analysisKinds = await getAnalysisKinds(logger, features); const initCodeQLResult = await initCodeQL( - getOptionalInput("tools"), + toolsInput?.value, apiDetails, getTemporaryDirectory(), gitHubVersion.type, @@ -195,6 +207,7 @@ async function run({ await sendCompletedStatusReport( startedAt, + toolsInput, toolsDownloadStatusReport, toolsFeatureFlagsValid, toolsSource, From 32ed58dc59670b008aef189b9337abd58ea2f870 Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Wed, 22 Jul 2026 14:27:33 +0100 Subject: [PATCH 19/95] Check log messages in tests --- src/config/inputs.test.ts | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/src/config/inputs.test.ts b/src/config/inputs.test.ts index bf200bcf1f..ae0299d2ee 100644 --- a/src/config/inputs.test.ts +++ b/src/config/inputs.test.ts @@ -38,12 +38,15 @@ function stubGetToolsInput() { return actions; } +const workflowLogMessage = `Using ${InputName.Tools} input from workflow:`; + test("getToolsInput - returns workflow input if available", async (t) => { const actions = stubGetToolsInput(); await callee(getToolsInput) .withActions(actions) .withArgs({}) + .logs(t, workflowLogMessage) .passes(t.deepEqual, expectedWorkflowResult); }); @@ -57,10 +60,15 @@ test("getToolsInput - returns repository property value if enforced", async (t) }); // We expect the repository value if provided and the FF is enabled. + const enforcedLogMessage = `Using ${InputName.Tools} input from repository property (enforced):`; await target .withFeatures([Feature.ToolsRepositoryProperty]) + .logs(t, enforcedLogMessage) .passes(t.deepEqual, expectedRepositoryPropertyResult); - await target.passes(t.deepEqual, expectedWorkflowResult); + await target + .notLogs(t, enforcedLogMessage) + .logs(t, workflowLogMessage) + .passes(t.deepEqual, expectedWorkflowResult); }); test("getToolsInput - prefers workflow input", async (t) => { @@ -75,8 +83,11 @@ test("getToolsInput - prefers workflow input", async (t) => { // We expect the workflow input regardless of the FF state. await target .withFeatures([Feature.ToolsRepositoryProperty]) + .logs(t, workflowLogMessage) + .passes(t.deepEqual, expectedWorkflowResult); + await target + .logs(t, workflowLogMessage) .passes(t.deepEqual, expectedWorkflowResult); - await target.passes(t.deepEqual, expectedWorkflowResult); }); test("getToolsInput - returns repository property", async (t) => { @@ -87,6 +98,7 @@ test("getToolsInput - returns repository property", async (t) => { // We expect the repository property if the FF is enabled or undefined otherwise. await target .withFeatures([Feature.ToolsRepositoryProperty]) + .logs(t, `Using ${InputName.Tools} input from repository property:`) .passes(t.deepEqual, expectedRepositoryPropertyResult); await target.passes(t.is, undefined); }); From 60339edd56fae4f0289b4dbab6b47999b93ec25c Mon Sep 17 00:00:00 2001 From: Henry Mercer Date: Wed, 22 Jul 2026 15:45:01 +0100 Subject: [PATCH 20/95] Exclude Copilot review from required checks Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- pr-checks/excluded.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/pr-checks/excluded.yml b/pr-checks/excluded.yml index d8d643d107..1a5262fc0b 100644 --- a/pr-checks/excluded.yml +++ b/pr-checks/excluded.yml @@ -10,6 +10,7 @@ is: - "check-expected-release-files" - "Cleanup artifacts" - "CodeQL" + - "copilot-pull-request-reviewer" - "Dependabot" - "Label PR with size" - "Post repo size comment" From be24c11a39168a91880fdb86e4db14793d0969d2 Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Wed, 22 Jul 2026 16:54:09 +0100 Subject: [PATCH 21/95] Rename to `ComputedInput` --- src/config/inputs.test.ts | 11 +++-------- src/config/inputs.ts | 8 ++++---- src/init-action.ts | 8 ++++---- src/setup-codeql-action.ts | 8 ++++---- 4 files changed, 15 insertions(+), 20 deletions(-) diff --git a/src/config/inputs.test.ts b/src/config/inputs.test.ts index ae0299d2ee..a484c76d73 100644 --- a/src/config/inputs.test.ts +++ b/src/config/inputs.test.ts @@ -6,24 +6,19 @@ import { Feature } from "../feature-flags"; import { RepositoryPropertyName } from "../feature-flags/properties"; import { callee } from "../testing-utils"; -import { - EffectiveInput, - getToolsInput, - InputName, - InputSource, -} from "./inputs"; +import { ComputedInput, getToolsInput, InputName, InputSource } from "./inputs"; test("getToolsInput - undefined if there's no input", async (t) => { await callee(getToolsInput).withArgs({}).passes(t.is, undefined); }); -const expectedWorkflowResult: EffectiveInput = { +const expectedWorkflowResult: ComputedInput = { name: InputName.Tools, source: InputSource.Workflow, value: "workflow-input-value", }; -const expectedRepositoryPropertyResult: EffectiveInput = { +const expectedRepositoryPropertyResult: ComputedInput = { name: InputName.Tools, source: InputSource.RepositoryProperty, value: "repo-property-input-value", diff --git a/src/config/inputs.ts b/src/config/inputs.ts index 1e3baa9218..06cfcfdb6c 100644 --- a/src/config/inputs.ts +++ b/src/config/inputs.ts @@ -20,7 +20,7 @@ export enum InputSource { * Represents an effective input to the CodeQL Action. That is, * the input value that was computed or selected from multiple sources. */ -export type EffectiveInput = { +export type ComputedInput = { /** The name of the property. */ name: InputName; /** The value of the property. */ @@ -30,17 +30,17 @@ export type EffectiveInput = { }; /** - * Gets the effective `tools` input. This comes from either the workflow or + * Gets the computed `tools` input. This comes from either the workflow or * the repository property. * * @param action The Action state. * @param repositoryProperties The values of known repository properties. - * @returns The effective input or `undefined` if there is no input. + * @returns The computed input or `undefined` if there is no input. */ export async function getToolsInput( action: ActionState<["Logger", "Actions", "FeatureFlags"]>, repositoryProperties: Partial, -): Promise { +): Promise { const name = InputName.Tools; const input = action.actions.getOptionalInput(name); const propertyValue = repositoryProperties[RepositoryPropertyName.TOOLS]; diff --git a/src/init-action.ts b/src/init-action.ts index 899a6d54e6..051a4a4908 100644 --- a/src/init-action.ts +++ b/src/init-action.ts @@ -25,7 +25,7 @@ import { } from "./caching-utils"; import { CodeQL } from "./codeql"; import { getConfigFileInput } from "./config/file"; -import { EffectiveInput, getToolsInput } from "./config/inputs"; +import { ComputedInput, getToolsInput } from "./config/inputs"; import * as configUtils from "./config-utils"; import { DependencyCacheRestoreStatusReport, @@ -131,7 +131,7 @@ async function sendCompletedStatusReport( startedAt: Date, config: configUtils.Config | undefined, configFile: string | undefined, - toolsInput: EffectiveInput | undefined, + toolsInput: ComputedInput | undefined, toolsDownloadStatusReport: ToolsDownloadStatusReport | undefined, toolsFeatureFlagsValid: boolean | undefined, toolsSource: ToolsSource, @@ -213,7 +213,7 @@ async function run( let codeql: CodeQL; let features: FeatureEnablement; let sourceRoot: string; - let toolsInput: EffectiveInput | undefined; + let toolsInput: ComputedInput | undefined; let toolsDownloadStatusReport: ToolsDownloadStatusReport | undefined; let toolsFeatureFlagsValid: boolean | undefined; let toolsSource: ToolsSource; @@ -298,7 +298,7 @@ async function run( ); } - // Get the effective `tools` input. + // Get the computed `tools` input. toolsInput = await getToolsInput( actionStateWithFeatures, repositoryProperties, diff --git a/src/setup-codeql-action.ts b/src/setup-codeql-action.ts index 6ebe6b3ce2..a64e05b17a 100644 --- a/src/setup-codeql-action.ts +++ b/src/setup-codeql-action.ts @@ -11,7 +11,7 @@ import { import { AnalysisKind, getAnalysisKinds } from "./analyses"; import { getGitHubVersion } from "./api-client"; import { CodeQL } from "./codeql"; -import { EffectiveInput, getToolsInput } from "./config/inputs"; +import { ComputedInput, getToolsInput } from "./config/inputs"; import { getRawLanguagesNoAutodetect } from "./config-utils"; import { EnvVar } from "./environment"; import { initFeatures } from "./feature-flags"; @@ -45,7 +45,7 @@ import { */ async function sendCompletedStatusReport( startedAt: Date, - toolsInput: EffectiveInput | undefined, + toolsInput: ComputedInput | undefined, toolsDownloadStatusReport: ToolsDownloadStatusReport | undefined, toolsFeatureFlagsValid: boolean | undefined, toolsSource: ToolsSource, @@ -98,7 +98,7 @@ async function run( const { logger, startedAt } = actionState; let codeql: CodeQL; - let toolsInput: EffectiveInput | undefined; + let toolsInput: ComputedInput | undefined; let toolsDownloadStatusReport: ToolsDownloadStatusReport | undefined; let toolsFeatureFlagsValid: boolean | undefined; let toolsSource: ToolsSource; @@ -152,7 +152,7 @@ async function run( await sendStatusReport(statusReportBase); } - // Get the effective `tools` input. + // Get the computed `tools` input. toolsInput = await getToolsInput( actionStateWithFeatures, repositoryProperties, From f9442c40ccb97381cac788e90ff807e85a473827 Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Wed, 22 Jul 2026 17:03:32 +0100 Subject: [PATCH 22/95] Include computed `tools` value in `computed_inputs` --- lib/entry-points.js | 7 +++++++ src/init-action.ts | 4 ++++ src/setup-codeql-action.ts | 4 ++++ src/status-report.test.ts | 1 + src/status-report.ts | 4 ++++ 5 files changed, 20 insertions(+) diff --git a/lib/entry-points.js b/lib/entry-points.js index 3219bacfd6..93f26642ae 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -146353,6 +146353,7 @@ async function createStatusReportBase(actionName, status, actionStartedAt, confi analysis_key, build_mode: config?.buildMode, commit_oid: commitOid, + computed_inputs: {}, first_party_analysis: isFirstPartyAnalysis(actionName), job_name: jobName, job_run_uuid: jobRunUUID, @@ -160676,6 +160677,9 @@ async function sendCompletedStatusReport2(startedAt, config, configFile, toolsIn tools_source: toolsSource || "UNKNOWN" /* Unknown */, workflow_languages: workflowLanguages || "" }; + if (toolsInput !== void 0) { + initStatusReport.computed_inputs.tools = toolsInput; + } const initToolsDownloadFields = {}; if (toolsDownloadStatusReport?.downloadDurationMs !== void 0) { initToolsDownloadFields.tools_download_duration_ms = toolsDownloadStatusReport.downloadDurationMs; @@ -161720,6 +161724,9 @@ async function sendCompletedStatusReport3(startedAt, toolsInput, toolsDownloadSt tools_source: toolsSource || "UNKNOWN" /* Unknown */, workflow_languages: "" }; + if (toolsInput !== void 0) { + initStatusReport.computed_inputs.tools = toolsInput; + } const initToolsDownloadFields = {}; if (toolsDownloadStatusReport?.downloadDurationMs !== void 0) { initToolsDownloadFields.tools_download_duration_ms = toolsDownloadStatusReport.downloadDurationMs; diff --git a/src/init-action.ts b/src/init-action.ts index 051a4a4908..0fdff05721 100644 --- a/src/init-action.ts +++ b/src/init-action.ts @@ -166,6 +166,10 @@ async function sendCompletedStatusReport( workflow_languages: workflowLanguages || "", }; + if (toolsInput !== undefined) { + initStatusReport.computed_inputs.tools = toolsInput; + } + const initToolsDownloadFields: InitToolsDownloadFields = {}; if (toolsDownloadStatusReport?.downloadDurationMs !== undefined) { diff --git a/src/setup-codeql-action.ts b/src/setup-codeql-action.ts index a64e05b17a..b2a9e90f36 100644 --- a/src/setup-codeql-action.ts +++ b/src/setup-codeql-action.ts @@ -76,6 +76,10 @@ async function sendCompletedStatusReport( workflow_languages: "", }; + if (toolsInput !== undefined) { + initStatusReport.computed_inputs.tools = toolsInput; + } + const initToolsDownloadFields: InitToolsDownloadFields = {}; if (toolsDownloadStatusReport?.downloadDurationMs !== undefined) { diff --git a/src/status-report.test.ts b/src/status-report.test.ts index 52132b7649..9086dd34ef 100644 --- a/src/status-report.test.ts +++ b/src/status-report.test.ts @@ -71,6 +71,7 @@ test.serial("createStatusReportBase", async (t) => { t.is(statusReport.build_mode, BuildMode.None); t.is(statusReport.cause, "failure cause"); t.is(statusReport.commit_oid, process.env["GITHUB_SHA"]!); + t.deepEqual(statusReport.computed_inputs, {}); t.is(statusReport.exception, "exception stack trace"); t.is(statusReport.job_name, process.env["GITHUB_JOB"] || ""); t.is(typeof statusReport.job_run_uuid, "string"); diff --git a/src/status-report.ts b/src/status-report.ts index a0c0b3ab40..d9d2a7ba4c 100644 --- a/src/status-report.ts +++ b/src/status-report.ts @@ -13,6 +13,7 @@ import { } from "./actions-util"; import { getAnalysisKey, getApiClient } from "./api-client"; import type { Config } from "./config/action-config"; +import type { ComputedInput, InputName } from "./config/inputs"; import { parseRegistriesWithoutCredentials } from "./config/pack-registries"; import type { DependencyCacheRestoreStatusReport } from "./dependency-caching"; import { DocUrl } from "./doc-url"; @@ -122,6 +123,8 @@ export interface StatusReportBase { commit_oid: string; /** Time this action completed, or undefined if not yet completed. */ completed_at?: string; + /** A mapping of input names to their computed values. */ + computed_inputs: Partial>; /** Stack trace of the failure (or undefined if status is not failure). */ exception?: string; /** Whether this is a first-party (CodeQL) run of the action. */ @@ -316,6 +319,7 @@ export async function createStatusReportBase( analysis_key, build_mode: config?.buildMode, commit_oid: commitOid, + computed_inputs: {}, first_party_analysis: isFirstPartyAnalysis(actionName), job_name: jobName, job_run_uuid: jobRunUUID, From 96bc4c7e0f09ae05ee2909af7fdada8de6a7b2b5 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 22 Jul 2026 17:55:12 +0000 Subject: [PATCH 23/95] Bump the npm-minor group across 1 directory with 5 updates Bumps the npm-minor group with 5 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@actions/cache](https://github.com/actions/toolkit/tree/HEAD/packages/cache) | `5.1.0` | `5.2.0` | | [eslint](https://github.com/eslint/eslint) | `9.39.4` | `9.39.5` | | [eslint-plugin-github](https://github.com/github/eslint-plugin-github) | `6.1.0` | `6.1.1` | | [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) | `8.63.0` | `8.64.0` | | [tsx](https://github.com/privatenumber/tsx) | `4.23.0` | `4.23.1` | Updates `@actions/cache` from 5.1.0 to 5.2.0 - [Changelog](https://github.com/actions/toolkit/blob/main/packages/cache/RELEASES.md) - [Commits](https://github.com/actions/toolkit/commits/HEAD/packages/cache) Updates `eslint` from 9.39.4 to 9.39.5 - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](https://github.com/eslint/eslint/compare/v9.39.4...v9.39.5) Updates `eslint-plugin-github` from 6.1.0 to 6.1.1 - [Release notes](https://github.com/github/eslint-plugin-github/releases) - [Commits](https://github.com/github/eslint-plugin-github/compare/v6.1.0...v6.1.1) Updates `typescript-eslint` from 8.63.0 to 8.64.0 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.64.0/packages/typescript-eslint) Updates `tsx` from 4.23.0 to 4.23.1 - [Release notes](https://github.com/privatenumber/tsx/releases) - [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs) - [Commits](https://github.com/privatenumber/tsx/compare/v4.23.0...v4.23.1) --- updated-dependencies: - dependency-name: "@actions/cache" dependency-version: 5.2.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-minor - dependency-name: eslint dependency-version: 9.39.5 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-minor - dependency-name: eslint-plugin-github dependency-version: 6.1.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-minor - dependency-name: typescript-eslint dependency-version: 8.64.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-minor - dependency-name: tsx dependency-version: 4.23.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-minor ... Signed-off-by: dependabot[bot] --- package-lock.json | 226 ++++++++++++++++++++++++++--------------- package.json | 8 +- pr-checks/package.json | 2 +- 3 files changed, 148 insertions(+), 88 deletions(-) diff --git a/package-lock.json b/package-lock.json index b33e544db9..536f92c652 100644 --- a/package-lock.json +++ b/package-lock.json @@ -14,7 +14,7 @@ "dependencies": { "@actions/artifact": "^5.0.3", "@actions/artifact-legacy": "npm:@actions/artifact@^1.1.2", - "@actions/cache": "^5.1.0", + "@actions/cache": "^5.2.0", "@actions/core": "^2.0.3", "@actions/exec": "^2.0.0", "@actions/github": "^8.0.1", @@ -54,9 +54,9 @@ "@types/sinon": "^22.0.0", "ava": "^6.4.1", "esbuild": "^0.28.1", - "eslint": "^9.39.4", + "eslint": "^9.39.5", "eslint-import-resolver-typescript": "^4.4.5", - "eslint-plugin-github": "^6.1.0", + "eslint-plugin-github": "^6.1.1", "eslint-plugin-import-x": "^4.17.1", "eslint-plugin-jsdoc": "^62.9.0", "eslint-plugin-no-async-foreach": "^0.1.1", @@ -65,7 +65,7 @@ "nock": "^14.0.16", "sinon": "^22.0.0", "typescript": "^6.0.3", - "typescript-eslint": "^8.63.0" + "typescript-eslint": "^8.64.0" } }, "node_modules/@aashutoshrathi/word-wrap": { @@ -459,9 +459,9 @@ } }, "node_modules/@actions/cache": { - "version": "5.1.0", - "resolved": "https://registry.npmjs.org/@actions/cache/-/cache-5.1.0.tgz", - "integrity": "sha512-kTIj4YPrjjRPKSGlj7f8eq+Pijoy/SKBEbJcAwNsQTFGEF29NGqj1mqD02/PmhV6r4bRAixycexAWpmUJ2aCwg==", + "version": "5.2.0", + "resolved": "https://registry.npmjs.org/@actions/cache/-/cache-5.2.0.tgz", + "integrity": "sha512-1R1Oc8cuDNCygsIP7gLiKLGCymOw/k5FkGQkXZFcLz6/RWyMImkfP0dZX6kjA9SRAmANcKNocI2XrsIaZ1it8w==", "license": "MIT", "dependencies": { "@actions/core": "^2.0.0", @@ -1557,9 +1557,9 @@ } }, "node_modules/@eslint/js": { - "version": "9.39.4", - "resolved": "https://registry.npmjs.org/@eslint/js/-/js-9.39.4.tgz", - "integrity": "sha512-nE7DEIchvtiFTwBw4Lfbu59PG+kCofhjsKaCWzxTpt4lfRjRMqG6uMBzKXuEcyXhOHoUp9riAm7/aWYGhXZ9cw==", + "version": "9.39.5", + "resolved": "https://registry.npmjs.org/@eslint/js/-/js-9.39.5.tgz", + "integrity": "sha512-QywQuszQh77pIXCsq998c8hbhSTI/azTty1Z6N53dmAudKHhy573j3yvRLsX2BSp8YpLtoCEG8E9DJe+8zUh4A==", "dev": true, "license": "MIT", "engines": { @@ -2591,17 +2591,17 @@ "license": "MIT" }, "node_modules/@typescript-eslint/eslint-plugin": { - "version": "8.63.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-8.63.0.tgz", - "integrity": "sha512-rvwSgqT+DHpWdzfSzPatRLm02a0GlESt++9iy3hLCDY4BgkaLcl8LBi9Yh7XGFBpwcBE/K3024QuXWTpbz4FfQ==", + "version": "8.64.0", + "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-8.64.0.tgz", + "integrity": "sha512-CGvQPBxN3wZLu6Rz2kFUpZeoCm78xUic92ck39KPePkO1NPOwjCqdQnm5Q87tpWw9vcBvW8XLrDXjH9PWYtJ3Q==", "dev": true, "license": "MIT", "dependencies": { "@eslint-community/regexpp": "^4.12.2", - "@typescript-eslint/scope-manager": "8.63.0", - "@typescript-eslint/type-utils": "8.63.0", - "@typescript-eslint/utils": "8.63.0", - "@typescript-eslint/visitor-keys": "8.63.0", + "@typescript-eslint/scope-manager": "8.64.0", + "@typescript-eslint/type-utils": "8.64.0", + "@typescript-eslint/utils": "8.64.0", + "@typescript-eslint/visitor-keys": "8.64.0", "ignore": "^7.0.5", "natural-compare": "^1.4.0", "ts-api-utils": "^2.5.0" @@ -2614,7 +2614,7 @@ "url": "https://opencollective.com/typescript-eslint" }, "peerDependencies": { - "@typescript-eslint/parser": "^8.63.0", + "@typescript-eslint/parser": "^8.64.0", "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0", "typescript": ">=4.8.4 <6.1.0" } @@ -2630,16 +2630,16 @@ } }, "node_modules/@typescript-eslint/parser": { - "version": "8.63.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-8.63.0.tgz", - "integrity": "sha512-gwh4gvvlaVDKKxyfxMG+Gnu1u9X0OQBwyGLkbwB65dIzBKnxeRiJlNFqlI3zwVhNXJIs6qV7mlFCn/BIajlVig==", + "version": "8.64.0", + "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-8.64.0.tgz", + "integrity": "sha512-KA0OshtlcCCXmbfqyZkM5pV3/WNraJf7DkJRLpyrmwPtud57H5BDX7C3k0LPSPxpprfRL+cJDGabF10mvNCoCw==", "dev": true, "license": "MIT", "dependencies": { - "@typescript-eslint/scope-manager": "8.63.0", - "@typescript-eslint/types": "8.63.0", - "@typescript-eslint/typescript-estree": "8.63.0", - "@typescript-eslint/visitor-keys": "8.63.0", + "@typescript-eslint/scope-manager": "8.64.0", + "@typescript-eslint/types": "8.64.0", + "@typescript-eslint/typescript-estree": "8.64.0", + "@typescript-eslint/visitor-keys": "8.64.0", "debug": "^4.4.3" }, "engines": { @@ -2673,14 +2673,14 @@ } }, "node_modules/@typescript-eslint/project-service": { - "version": "8.63.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/project-service/-/project-service-8.63.0.tgz", - "integrity": "sha512-e5dh0/UI0ok53AlZ5wRkXCB32z/f2jUZqPR/ygAw5WYaSw8j9EoJWlS7wQjr/dmOaqWjnPIn2m+HhVPCMWGZVQ==", + "version": "8.64.0", + "resolved": "https://registry.npmjs.org/@typescript-eslint/project-service/-/project-service-8.64.0.tgz", + "integrity": "sha512-tk4WpOJ6IEbGrVHaNmM0YRrwAD3exZlIK3iadQNAxh4YKk6jvUQ4ecq18n+v7+meh+cJ3j+D8nbk8sRKhlwLQg==", "dev": true, "license": "MIT", "dependencies": { - "@typescript-eslint/tsconfig-utils": "^8.63.0", - "@typescript-eslint/types": "^8.63.0", + "@typescript-eslint/tsconfig-utils": "^8.64.0", + "@typescript-eslint/types": "^8.64.0", "debug": "^4.4.3" }, "engines": { @@ -2713,14 +2713,14 @@ } }, "node_modules/@typescript-eslint/scope-manager": { - "version": "8.63.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.63.0.tgz", - "integrity": "sha512-uUyfMWCnDSN8bCpcrY8nGP2BLkQ9Xn0GsipcONcpIDWhwhO4ZSyHvyS14U3X75mzxWxL3I2UZIrenTzdzcJO8A==", + "version": "8.64.0", + "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.64.0.tgz", + "integrity": "sha512-CXEaFdYXjSTgKhisNkwCcJwTP8Pl+fmRrEQrri4nm3vU743bALrxzLmq7fHG/7e6a5xO0lDYeURpZmBuhHk54w==", "dev": true, "license": "MIT", "dependencies": { - "@typescript-eslint/types": "8.63.0", - "@typescript-eslint/visitor-keys": "8.63.0" + "@typescript-eslint/types": "8.64.0", + "@typescript-eslint/visitor-keys": "8.64.0" }, "engines": { "node": "^18.18.0 || ^20.9.0 || >=21.1.0" @@ -2731,9 +2731,9 @@ } }, "node_modules/@typescript-eslint/tsconfig-utils": { - "version": "8.63.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/tsconfig-utils/-/tsconfig-utils-8.63.0.tgz", - "integrity": "sha512-sUAbkulqBAsncKnbRP3+7CtQFRKicexnj7ZwNC6ddCR7EmrXvjvdCYMJbUIqMd6lwoEriZjwLo08aS5tSjVMHg==", + "version": "8.64.0", + "resolved": "https://registry.npmjs.org/@typescript-eslint/tsconfig-utils/-/tsconfig-utils-8.64.0.tgz", + "integrity": "sha512-2yo8rRNKuzbVWQp5kslhANqZ2uDAeROQHBRZNPu8JDsHmeFNj/XJJhX/FhNUWmkHHvoNsKa6+tHJiig87EzsQw==", "dev": true, "license": "MIT", "engines": { @@ -2748,15 +2748,15 @@ } }, "node_modules/@typescript-eslint/type-utils": { - "version": "8.63.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/type-utils/-/type-utils-8.63.0.tgz", - "integrity": "sha512-Nzzh/OGxVCOjObjaj1CQF2RUasyYy2Jfuh+zZ3PjLzG2fYRriAiZLib9UKtO+CpQAS3YHiAS+ckZDclwqI1TPA==", + "version": "8.64.0", + "resolved": "https://registry.npmjs.org/@typescript-eslint/type-utils/-/type-utils-8.64.0.tgz", + "integrity": "sha512-XWG4Fmmv/6SvyS9nH8jWrKs6terwJvE8cyRt1CzYYqzp9OrPhCT4cMc/f7C6RZCwG+qMmiffJS1/qJP8G1URtg==", "dev": true, "license": "MIT", "dependencies": { - "@typescript-eslint/types": "8.63.0", - "@typescript-eslint/typescript-estree": "8.63.0", - "@typescript-eslint/utils": "8.63.0", + "@typescript-eslint/types": "8.64.0", + "@typescript-eslint/typescript-estree": "8.64.0", + "@typescript-eslint/utils": "8.64.0", "debug": "^4.4.3", "ts-api-utils": "^2.5.0" }, @@ -2791,9 +2791,9 @@ } }, "node_modules/@typescript-eslint/types": { - "version": "8.63.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.63.0.tgz", - "integrity": "sha512-xyLtl9DUBBFrcJS4x2pIqGLH68/tC2uOa4Z7pUteW09D3bXnnXUom4dyPikzWgB7llmIc1zoeI3aoUdC4rPK/Q==", + "version": "8.64.0", + "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.64.0.tgz", + "integrity": "sha512-qjhfuTfLXjA4IOzXvz0rTjT01BqEiIgPoUeMwiEjnaHKJMTNo8rH5pYW1a2L/0Dnux2fPC85AeyJoWaGa8WxTA==", "dev": true, "license": "MIT", "engines": { @@ -2805,16 +2805,16 @@ } }, "node_modules/@typescript-eslint/typescript-estree": { - "version": "8.63.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.63.0.tgz", - "integrity": "sha512-ygBkU+B7ex5UI/gKhaqexWev79uISfIv7XQCRNYO/jmD8rGLPyWLAb3KMRT6nd8Gt9bmUBi9+iX6tBdYfOY81Q==", + "version": "8.64.0", + "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.64.0.tgz", + "integrity": "sha512-Pztpsn1aCE1oWDvDEfUk31nngvvF7vUB5SwHFEaZIFpvw7WJtqUHHL4plBZDA9HfWJJjL13BdG0YrJInTUvoVA==", "dev": true, "license": "MIT", "dependencies": { - "@typescript-eslint/project-service": "8.63.0", - "@typescript-eslint/tsconfig-utils": "8.63.0", - "@typescript-eslint/types": "8.63.0", - "@typescript-eslint/visitor-keys": "8.63.0", + "@typescript-eslint/project-service": "8.64.0", + "@typescript-eslint/tsconfig-utils": "8.64.0", + "@typescript-eslint/types": "8.64.0", + "@typescript-eslint/visitor-keys": "8.64.0", "debug": "^4.4.3", "minimatch": "^10.2.2", "semver": "^7.7.3", @@ -2890,16 +2890,16 @@ } }, "node_modules/@typescript-eslint/utils": { - "version": "8.63.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-8.63.0.tgz", - "integrity": "sha512-fUKaeAvrTuQg/Tgt3nliAUSZHJM6DlCcfyEmxCvlX8kieWSStBX+5O5Fnidtc3i2JrH+9c/GL4RY2iasd/GPTA==", + "version": "8.64.0", + "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-8.64.0.tgz", + "integrity": "sha512-aJUGVB3+U0htrrCjoA8qukw8cm8fNCGAxK/tVoS70k8aeb7DETKeFozRiVFIwEeN9WJLsjaP3ph8I60tY2XZoQ==", "dev": true, "license": "MIT", "dependencies": { "@eslint-community/eslint-utils": "^4.9.1", - "@typescript-eslint/scope-manager": "8.63.0", - "@typescript-eslint/types": "8.63.0", - "@typescript-eslint/typescript-estree": "8.63.0" + "@typescript-eslint/scope-manager": "8.64.0", + "@typescript-eslint/types": "8.64.0", + "@typescript-eslint/typescript-estree": "8.64.0" }, "engines": { "node": "^18.18.0 || ^20.9.0 || >=21.1.0" @@ -2914,13 +2914,13 @@ } }, "node_modules/@typescript-eslint/visitor-keys": { - "version": "8.63.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.63.0.tgz", - "integrity": "sha512-UexrHGnGTpbuQHct2ExOc2ZcFbGUS9FOesCxxqdBGcpI1BxYu/LZ6U8Aq6/72XtF/qRBk9nhuGHFJIXXMhPMdw==", + "version": "8.64.0", + "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.64.0.tgz", + "integrity": "sha512-mrtuL8Nsn6gi2H4mo5KMTp823M+3Q19Ew/i+Zlikq20tIMm99C3Ez0dCmkWWnxut20esQvTg8aUSEhMcAOXhEw==", "dev": true, "license": "MIT", "dependencies": { - "@typescript-eslint/types": "8.63.0", + "@typescript-eslint/types": "8.64.0", "eslint-visitor-keys": "^5.0.0" }, "engines": { @@ -4766,9 +4766,9 @@ } }, "node_modules/eslint": { - "version": "9.39.4", - "resolved": "https://registry.npmjs.org/eslint/-/eslint-9.39.4.tgz", - "integrity": "sha512-XoMjdBOwe/esVgEvLmNsD3IRHkm7fbKIUGvrleloJXUZgDHig2IPWNniv+GwjyJXzuNqVjlr5+4yVUZjycJwfQ==", + "version": "9.39.5", + "resolved": "https://registry.npmjs.org/eslint/-/eslint-9.39.5.tgz", + "integrity": "sha512-DgZS62aPLXKlnxILS/AYCoRvHaZeXceIzlXPkkGGzJWSow1aEk0lbTlxUSlyjC8jcaKxAdOnTDz+o1JFSBsyjw==", "dev": true, "license": "MIT", "dependencies": { @@ -4777,8 +4777,8 @@ "@eslint/config-array": "^0.21.2", "@eslint/config-helpers": "^0.4.2", "@eslint/core": "^0.17.0", - "@eslint/eslintrc": "^3.3.5", - "@eslint/js": "9.39.4", + "@eslint/eslintrc": "^3.3.6", + "@eslint/js": "9.39.5", "@eslint/plugin-kit": "^0.4.1", "@humanfs/node": "^0.16.6", "@humanwhocodes/module-importer": "^1.0.1", @@ -4988,9 +4988,9 @@ } }, "node_modules/eslint-plugin-github": { - "version": "6.1.0", - "resolved": "https://registry.npmjs.org/eslint-plugin-github/-/eslint-plugin-github-6.1.0.tgz", - "integrity": "sha512-+mA0K1/I1JSE9AOiJ4ifMDGu7NplRZX0e3Uy0SjbwyXb2rsDfo5yfT0UCUO+TiOJ/99R1YxFRltizP/PZuB4PQ==", + "version": "6.1.1", + "resolved": "https://registry.npmjs.org/eslint-plugin-github/-/eslint-plugin-github-6.1.1.tgz", + "integrity": "sha512-xCqu1S/s/CCvoRLafaXNvwiVrxhroNOFLGyG9Dhi4i1PWZgPHlipjXysH6wccPFQyhSKE7gAjSLqdSdM204bZQ==", "dev": true, "license": "MIT", "dependencies": { @@ -5391,6 +5391,30 @@ "node": "^18.18.0 || ^20.9.0 || >=21.1.0" } }, + "node_modules/eslint/node_modules/@eslint/eslintrc": { + "version": "3.3.6", + "resolved": "https://registry.npmjs.org/@eslint/eslintrc/-/eslintrc-3.3.6.tgz", + "integrity": "sha512-l2Ul9PrHsPCKcEY/ac7VgFj9D80C7S68sOKc618SyHDPK36s1XcFebXY0iTzUVn4Yq+YbwvSnDmCz9yxjX+QrA==", + "dev": true, + "license": "MIT", + "dependencies": { + "ajv": "^6.14.0", + "debug": "^4.3.2", + "espree": "^10.0.1", + "globals": "^14.0.0", + "ignore": "^5.2.0", + "import-fresh": "^3.2.1", + "js-yaml": "^4.3.0", + "minimatch": "^3.1.5", + "strip-json-comments": "^3.1.1" + }, + "engines": { + "node": "^18.18.0 || ^20.9.0 || >=21.1.0" + }, + "funding": { + "url": "https://opencollective.com/eslint" + } + }, "node_modules/eslint/node_modules/ansi-styles": { "version": "4.2.1", "dev": true, @@ -5456,6 +5480,42 @@ "node": ">=10.13.0" } }, + "node_modules/eslint/node_modules/globals": { + "version": "14.0.0", + "resolved": "https://registry.npmjs.org/globals/-/globals-14.0.0.tgz", + "integrity": "sha512-oahGvuMGQlPw/ivIYBjVSrWAfWLBeku5tpPE2fOPLi+WHffIWbuh2tCjhyQhTBPMf5E9jDEH4FOmTYgYwbKwtQ==", + "dev": true, + "license": "MIT", + "engines": { + "node": ">=18" + }, + "funding": { + "url": "https://github.com/sponsors/sindresorhus" + } + }, + "node_modules/eslint/node_modules/js-yaml": { + "version": "4.3.0", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.0.tgz", + "integrity": "sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==", + "dev": true, + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/puzrin" + }, + { + "type": "github", + "url": "https://github.com/sponsors/nodeca" + } + ], + "license": "MIT", + "dependencies": { + "argparse": "^2.0.1" + }, + "bin": { + "js-yaml": "bin/js-yaml.js" + } + }, "node_modules/espree": { "version": "10.4.0", "resolved": "https://registry.npmjs.org/espree/-/espree-10.4.0.tgz", @@ -9108,9 +9168,9 @@ "license": "0BSD" }, "node_modules/tsx": { - "version": "4.23.0", - "resolved": "https://registry.npmjs.org/tsx/-/tsx-4.23.0.tgz", - "integrity": "sha512-eUdUIaCr963q2h5u3+QwvYp0+eqPvn+egeqZUm0hwERCqqx1E3kK5ehbGCvqSE5MQAULr67ww0cA3jKc3YkM1w==", + "version": "4.23.1", + "resolved": "https://registry.npmjs.org/tsx/-/tsx-4.23.1.tgz", + "integrity": "sha512-GQHnkIfxyx1wYCOS/wonik5MVRZU9hi1TEZmzGZSCJB1y9YgoZ8H6itNE/u4suE+yLmOzuE4E5S4TZ/ZX2wcWQ==", "dev": true, "license": "MIT", "dependencies": { @@ -9260,16 +9320,16 @@ } }, "node_modules/typescript-eslint": { - "version": "8.63.0", - "resolved": "https://registry.npmjs.org/typescript-eslint/-/typescript-eslint-8.63.0.tgz", - "integrity": "sha512-xgwXyzG4sK9ALkBxbyGkTMMOS+imnW65iPhxCQMK83KhxyoDNW7l+IDqEf9vMdoUidHpOoS967RCq4eMiTexwQ==", + "version": "8.64.0", + "resolved": "https://registry.npmjs.org/typescript-eslint/-/typescript-eslint-8.64.0.tgz", + "integrity": "sha512-0qg+pDNMnqYzqH9AnNK+39tejHvsShUOUUoRUgtnTGE7QuMZhiFDnozq8nHJVq+Wae6NMLKNWLg5WmkcC/ndyQ==", "dev": true, "license": "MIT", "dependencies": { - "@typescript-eslint/eslint-plugin": "8.63.0", - "@typescript-eslint/parser": "8.63.0", - "@typescript-eslint/typescript-estree": "8.63.0", - "@typescript-eslint/utils": "8.63.0" + "@typescript-eslint/eslint-plugin": "8.64.0", + "@typescript-eslint/parser": "8.64.0", + "@typescript-eslint/typescript-estree": "8.64.0", + "@typescript-eslint/utils": "8.64.0" }, "engines": { "node": "^18.18.0 || ^20.9.0 || >=21.1.0" @@ -9757,7 +9817,7 @@ }, "devDependencies": { "@types/node": "^20.19.43", - "tsx": "^4.23.0" + "tsx": "^4.23.1" } } } diff --git a/package.json b/package.json index 29b329de9f..cdd58cd167 100644 --- a/package.json +++ b/package.json @@ -22,7 +22,7 @@ "dependencies": { "@actions/artifact": "^5.0.3", "@actions/artifact-legacy": "npm:@actions/artifact@^1.1.2", - "@actions/cache": "^5.1.0", + "@actions/cache": "^5.2.0", "@actions/core": "^2.0.3", "@actions/exec": "^2.0.0", "@actions/github": "^8.0.1", @@ -62,9 +62,9 @@ "@types/sinon": "^22.0.0", "ava": "^6.4.1", "esbuild": "^0.28.1", - "eslint": "^9.39.4", + "eslint": "^9.39.5", "eslint-import-resolver-typescript": "^4.4.5", - "eslint-plugin-github": "^6.1.0", + "eslint-plugin-github": "^6.1.1", "eslint-plugin-import-x": "^4.17.1", "eslint-plugin-jsdoc": "^62.9.0", "eslint-plugin-no-async-foreach": "^0.1.1", @@ -73,7 +73,7 @@ "nock": "^14.0.16", "sinon": "^22.0.0", "typescript": "^6.0.3", - "typescript-eslint": "^8.63.0" + "typescript-eslint": "^8.64.0" }, "overrides": { "@actions/tool-cache": { diff --git a/pr-checks/package.json b/pr-checks/package.json index 63bfa3ddf5..07d599bb68 100644 --- a/pr-checks/package.json +++ b/pr-checks/package.json @@ -12,6 +12,6 @@ }, "devDependencies": { "@types/node": "^20.19.43", - "tsx": "^4.23.0" + "tsx": "^4.23.1" } } From f6ed33c7e4b29f7a113fa8f0a10fd94881b2de81 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Wed, 22 Jul 2026 17:57:19 +0000 Subject: [PATCH 24/95] Rebuild --- lib/entry-points.js | 82 ++++++++++++++++++++++++++++++++++++++++----- 1 file changed, 74 insertions(+), 8 deletions(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index c2428f924a..c1ed4c8f26 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -34030,7 +34030,7 @@ var require_constants7 = __commonJS({ "node_modules/@actions/cache/lib/internal/constants.js"(exports2) { "use strict"; Object.defineProperty(exports2, "__esModule", { value: true }); - exports2.CacheFileSizeLimit = exports2.ManifestFilename = exports2.TarFilename = exports2.SystemTarPathOnWindows = exports2.GnuTarPathOnWindows = exports2.SocketTimeout = exports2.DefaultRetryDelay = exports2.DefaultRetryAttempts = exports2.ArchiveToolType = exports2.CompressionMethod = exports2.CacheFilename = void 0; + exports2.CacheReadDeniedMessagePrefix = exports2.CacheFileSizeLimit = exports2.ManifestFilename = exports2.TarFilename = exports2.SystemTarPathOnWindows = exports2.GnuTarPathOnWindows = exports2.SocketTimeout = exports2.DefaultRetryDelay = exports2.DefaultRetryAttempts = exports2.ArchiveToolType = exports2.CompressionMethod = exports2.CacheFilename = void 0; var CacheFilename; (function(CacheFilename2) { CacheFilename2["Gzip"] = "cache.tgz"; @@ -34055,6 +34055,7 @@ var require_constants7 = __commonJS({ exports2.TarFilename = "cache.tar"; exports2.ManifestFilename = "manifest.txt"; exports2.CacheFileSizeLimit = 10 * Math.pow(1024, 3); + exports2.CacheReadDeniedMessagePrefix = "cache read denied:"; } }); @@ -75482,6 +75483,9 @@ var require_config = __commonJS({ Object.defineProperty(exports2, "__esModule", { value: true }); exports2.isGhes = isGhes; exports2.getCacheServiceVersion = getCacheServiceVersion; + exports2.getCacheMode = getCacheMode; + exports2.isCacheReadable = isCacheReadable; + exports2.isCacheWritable = isCacheWritable; exports2.getCacheServiceURL = getCacheServiceURL; function isGhes() { const ghUrl = new URL(process.env["GITHUB_SERVER_URL"] || "https://github.com"); @@ -75496,6 +75500,20 @@ var require_config = __commonJS({ return "v1"; return process.env["ACTIONS_CACHE_SERVICE_V2"] ? "v2" : "v1"; } + var KNOWN_CACHE_MODES = ["none", "read", "write", "write-only"]; + function getCacheMode() { + return (process.env["ACTIONS_CACHE_MODE"] || "").trim().toLowerCase(); + } + function isCacheReadable(mode) { + if (!KNOWN_CACHE_MODES.includes(mode)) + return true; + return mode === "read" || mode === "write"; + } + function isCacheWritable(mode) { + if (!KNOWN_CACHE_MODES.includes(mode)) + return true; + return mode === "write" || mode === "write-only"; + } function getCacheServiceURL() { const version = getCacheServiceVersion(); switch (version) { @@ -75515,7 +75533,7 @@ var require_package = __commonJS({ "node_modules/@actions/cache/package.json"(exports2, module2) { module2.exports = { name: "@actions/cache", - version: "5.1.0", + version: "5.2.0", preview: true, description: "Actions cache lib", keywords: [ @@ -75674,6 +75692,7 @@ var require_cacheHttpClient = __commonJS({ var options_1 = require_options(); var requestUtils_1 = require_requestUtils(); var config_1 = require_config(); + var constants_1 = require_constants7(); var user_agent_1 = require_user_agent(); function getCacheApiUrl(resource) { const baseUrl = (0, config_1.getCacheServiceURL)(); @@ -75702,6 +75721,7 @@ var require_cacheHttpClient = __commonJS({ } function getCacheEntry(keys, paths, options) { return __awaiter2(this, void 0, void 0, function* () { + var _a2; const httpClient = createHttpClient(); const version = utils.getCacheVersion(paths, options === null || options === void 0 ? void 0 : options.compressionMethod, options === null || options === void 0 ? void 0 : options.enableCrossOsArchive); const resource = `cache?keys=${encodeURIComponent(keys.join(","))}&version=${version}`; @@ -75715,6 +75735,10 @@ var require_cacheHttpClient = __commonJS({ return null; } if (!(0, requestUtils_1.isSuccessStatusCode)(response.statusCode)) { + const errorMessage = (_a2 = response.error) === null || _a2 === void 0 ? void 0 : _a2.message; + if (errorMessage === null || errorMessage === void 0 ? void 0 : errorMessage.includes(constants_1.CacheReadDeniedMessagePrefix)) { + throw new Error(errorMessage); + } throw new Error(`Cache service responded with ${response.statusCode}`); } const cacheResult = response.result; @@ -81337,7 +81361,7 @@ var require_cache4 = __commonJS({ }); }; Object.defineProperty(exports2, "__esModule", { value: true }); - exports2.FinalizeCacheError = exports2.CacheWriteDeniedError = exports2.CACHE_WRITE_DENIED_PREFIX = exports2.ReserveCacheError = exports2.ValidationError = void 0; + exports2.FinalizeCacheError = exports2.CacheReadDeniedError = exports2.CACHE_READ_DENIED_PREFIX = exports2.CacheWriteDeniedError = exports2.CACHE_WRITE_DENIED_PREFIX = exports2.ReserveCacheError = exports2.ValidationError = void 0; exports2.isFeatureAvailable = isFeatureAvailable; exports2.restoreCache = restoreCache5; exports2.saveCache = saveCache5; @@ -81349,6 +81373,7 @@ var require_cache4 = __commonJS({ var config_1 = require_config(); var tar_1 = require_tar(); var http_client_1 = require_lib(); + var constants_1 = require_constants7(); var ValidationError = class _ValidationError extends Error { constructor(message) { super(message); @@ -81374,6 +81399,15 @@ var require_cache4 = __commonJS({ } }; exports2.CacheWriteDeniedError = CacheWriteDeniedError; + exports2.CACHE_READ_DENIED_PREFIX = constants_1.CacheReadDeniedMessagePrefix; + var CacheReadDeniedError = class _CacheReadDeniedError extends Error { + constructor(message) { + super(message); + this.name = "CacheReadDeniedError"; + Object.setPrototypeOf(this, _CacheReadDeniedError.prototype); + } + }; + exports2.CacheReadDeniedError = CacheReadDeniedError; var FinalizeCacheError = class _FinalizeCacheError extends Error { constructor(message) { super(message); @@ -81411,6 +81445,12 @@ var require_cache4 = __commonJS({ const cacheServiceVersion = (0, config_1.getCacheServiceVersion)(); core31.debug(`Cache service version: ${cacheServiceVersion}`); checkPaths(paths); + const cacheMode = (0, config_1.getCacheMode)(); + if (!(0, config_1.isCacheReadable)(cacheMode)) { + core31.info(`Cache restore skipped: the effective cache-mode '${cacheMode}' does not permit reads.`); + core31.debug(`Skipped restore for paths [${paths.join(", ")}] with primary key '${primaryKey}'.`); + return void 0; + } switch (cacheServiceVersion) { case "v2": return yield restoreCacheV2(paths, primaryKey, restoreKeys, options, enableCrossOsArchive); @@ -81422,6 +81462,7 @@ var require_cache4 = __commonJS({ } function restoreCacheV1(paths_1, primaryKey_1, restoreKeys_1, options_1) { return __awaiter2(this, arguments, void 0, function* (paths, primaryKey, restoreKeys, options, enableCrossOsArchive = false) { + var _a2; restoreKeys = restoreKeys || []; const keys = [primaryKey, ...restoreKeys]; core31.debug("Resolved Keys:"); @@ -81435,10 +81476,19 @@ var require_cache4 = __commonJS({ const compressionMethod = yield utils.getCompressionMethod(); let archivePath = ""; try { - const cacheEntry = yield cacheHttpClient.getCacheEntry(keys, paths, { - compressionMethod, - enableCrossOsArchive - }); + let cacheEntry; + try { + cacheEntry = yield cacheHttpClient.getCacheEntry(keys, paths, { + compressionMethod, + enableCrossOsArchive + }); + } catch (error3) { + const errorMessage = (_a2 = error3 === null || error3 === void 0 ? void 0 : error3.message) !== null && _a2 !== void 0 ? _a2 : ""; + if (errorMessage.includes(exports2.CACHE_READ_DENIED_PREFIX)) { + throw new CacheReadDeniedError(errorMessage); + } + throw error3; + } if (!(cacheEntry === null || cacheEntry === void 0 ? void 0 : cacheEntry.archiveLocation)) { return void 0; } @@ -81480,6 +81530,7 @@ var require_cache4 = __commonJS({ } function restoreCacheV2(paths_1, primaryKey_1, restoreKeys_1, options_1) { return __awaiter2(this, arguments, void 0, function* (paths, primaryKey, restoreKeys, options, enableCrossOsArchive = false) { + var _a2; options = Object.assign(Object.assign({}, options), { useAzureSdk: true }); restoreKeys = restoreKeys || []; const keys = [primaryKey, ...restoreKeys]; @@ -81500,7 +81551,16 @@ var require_cache4 = __commonJS({ restoreKeys, version: utils.getCacheVersion(paths, compressionMethod, enableCrossOsArchive) }; - const response = yield twirpClient.GetCacheEntryDownloadURL(request3); + let response; + try { + response = yield twirpClient.GetCacheEntryDownloadURL(request3); + } catch (error3) { + const errorMessage = (_a2 = error3 === null || error3 === void 0 ? void 0 : error3.message) !== null && _a2 !== void 0 ? _a2 : ""; + if (errorMessage.includes(exports2.CACHE_READ_DENIED_PREFIX)) { + throw new CacheReadDeniedError(errorMessage); + } + throw error3; + } if (!response.ok) { core31.debug(`Cache not found for version ${request3.version} of keys: ${keys.join(", ")}`); return void 0; @@ -81556,6 +81616,12 @@ var require_cache4 = __commonJS({ core31.debug(`Cache service version: ${cacheServiceVersion}`); checkPaths(paths); checkKey(key); + const cacheMode = (0, config_1.getCacheMode)(); + if (!(0, config_1.isCacheWritable)(cacheMode)) { + core31.info(`Cache save skipped: the effective cache-mode '${cacheMode}' does not permit writes.`); + core31.debug(`Skipped save for paths [${paths.join(", ")}] with key '${key}'.`); + return -1; + } switch (cacheServiceVersion) { case "v2": return yield saveCacheV2(paths, key, options, enableCrossOsArchive); From 8a0be82efa1620906930810a0a77dbcbb1d0c217 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 22 Jul 2026 17:57:43 +0000 Subject: [PATCH 25/95] Bump the actions-minor group across 1 directory with 3 updates Bumps the actions-minor group with 3 updates in the /.github/workflows directory: [actions/checkout](https://github.com/actions/checkout), [actions/setup-java](https://github.com/actions/setup-java) and [ruby/setup-ruby](https://github.com/ruby/setup-ruby). Updates `actions/checkout` from 7.0.0 to 7.0.1 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0...3d3c42e5aac5ba805825da76410c181273ba90b1) Updates `actions/setup-java` from 5.5.0 to 5.6.0 - [Release notes](https://github.com/actions/setup-java/releases) - [Commits](https://github.com/actions/setup-java/compare/0f481fcb613427c0f801b606911222b5b6f3083a...03ad4de0992f5dab5e18fcb136590ce7c4a0ac95) Updates `ruby/setup-ruby` from 1.316.0 to 1.319.0 - [Release notes](https://github.com/ruby/setup-ruby/releases) - [Changelog](https://github.com/ruby/setup-ruby/blob/master/release.rb) - [Commits](https://github.com/ruby/setup-ruby/compare/d45b1a4e94b71acab930e56e79c6aa188764e7f9...003a5c4d8d6321bd302e38f6f0ec593f77f06600) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions-minor - dependency-name: actions/setup-java dependency-version: 5.6.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-minor - dependency-name: ruby/setup-ruby dependency-version: 1.319.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-minor ... Signed-off-by: dependabot[bot] --- .github/workflows/__all-platform-bundle.yml | 2 +- .github/workflows/__analysis-kinds.yml | 2 +- .github/workflows/__analyze-ref-input.yml | 2 +- .github/workflows/__autobuild-action.yml | 2 +- .../__autobuild-direct-tracing-with-working-dir.yml | 4 ++-- .github/workflows/__autobuild-working-dir.yml | 2 +- .github/workflows/__build-mode-autobuild.yml | 4 ++-- .github/workflows/__build-mode-manual.yml | 2 +- .github/workflows/__build-mode-none.yml | 2 +- .github/workflows/__build-mode-rollback.yml | 2 +- .github/workflows/__bundle-from-nightly.yml | 2 +- .github/workflows/__bundle-from-toolcache.yml | 2 +- .github/workflows/__bundle-toolcache.yml | 2 +- .github/workflows/__cleanup-db-cluster-dir.yml | 2 +- .github/workflows/__config-export.yml | 2 +- .github/workflows/__config-input.yml | 2 +- .github/workflows/__cpp-deptrace-disabled.yml | 2 +- .github/workflows/__cpp-deptrace-enabled-on-macos.yml | 2 +- .github/workflows/__cpp-deptrace-enabled.yml | 2 +- .github/workflows/__diagnostics-export.yml | 2 +- .github/workflows/__export-file-baseline-information.yml | 2 +- .github/workflows/__extractor-ram-threads.yml | 2 +- .github/workflows/__global-proxy.yml | 2 +- .github/workflows/__go-custom-queries.yml | 2 +- .../__go-indirect-tracing-workaround-diagnostic.yml | 2 +- .../__go-indirect-tracing-workaround-no-file-program.yml | 2 +- .github/workflows/__go-indirect-tracing-workaround.yml | 2 +- .github/workflows/__go-tracing-autobuilder.yml | 2 +- .github/workflows/__go-tracing-custom-build-steps.yml | 2 +- .github/workflows/__go-tracing-legacy-workflow.yml | 2 +- .github/workflows/__init-with-registries.yml | 2 +- .github/workflows/__javascript-source-root.yml | 2 +- .github/workflows/__job-run-uuid-sarif.yml | 2 +- .github/workflows/__language-aliases.yml | 2 +- .github/workflows/__local-bundle.yml | 2 +- .github/workflows/__multi-language-autodetect.yml | 2 +- .github/workflows/__overlay-init-fallback.yml | 2 +- .../workflows/__packaging-codescanning-config-inputs-js.yml | 2 +- .github/workflows/__packaging-config-inputs-js.yml | 2 +- .github/workflows/__packaging-config-js.yml | 2 +- .github/workflows/__packaging-inputs-js.yml | 2 +- .github/workflows/__remote-config.yml | 2 +- .github/workflows/__resolve-environment-action.yml | 2 +- .github/workflows/__rubocop-multi-language.yml | 4 ++-- .github/workflows/__ruby.yml | 2 +- .github/workflows/__rust.yml | 2 +- .github/workflows/__split-workflow.yml | 2 +- .github/workflows/__start-proxy.yml | 2 +- .github/workflows/__submit-sarif-failure.yml | 4 ++-- .github/workflows/__swift-autobuild.yml | 2 +- .github/workflows/__swift-custom-build.yml | 2 +- .github/workflows/__unset-environment.yml | 2 +- .github/workflows/__upload-ref-sha-input.yml | 2 +- .github/workflows/__upload-sarif.yml | 2 +- .github/workflows/__with-checkout-path.yml | 4 ++-- .github/workflows/check-expected-release-files.yml | 2 +- .github/workflows/codeql.yml | 6 +++--- .github/workflows/codescanning-config-cli.yml | 2 +- .github/workflows/debug-artifacts-failure-safe.yml | 2 +- .github/workflows/debug-artifacts-safe.yml | 2 +- .github/workflows/post-release-mergeback.yml | 2 +- .github/workflows/pr-checks.yml | 6 +++--- .github/workflows/prepare-release.yml | 2 +- .github/workflows/publish-immutable-action.yml | 2 +- .github/workflows/python312-windows.yml | 2 +- .github/workflows/query-filters.yml | 2 +- .github/workflows/rebuild.yml | 2 +- .github/workflows/rollback-release.yml | 2 +- .github/workflows/test-codeql-bundle-all.yml | 2 +- .github/workflows/update-bundle.yml | 2 +- .github/workflows/update-release-branch.yml | 4 ++-- .../update-supported-enterprise-server-versions.yml | 4 ++-- 72 files changed, 83 insertions(+), 83 deletions(-) diff --git a/.github/workflows/__all-platform-bundle.yml b/.github/workflows/__all-platform-bundle.yml index d4daf95d8b..aa07c91efc 100644 --- a/.github/workflows/__all-platform-bundle.yml +++ b/.github/workflows/__all-platform-bundle.yml @@ -69,7 +69,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install .NET uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 with: diff --git a/.github/workflows/__analysis-kinds.yml b/.github/workflows/__analysis-kinds.yml index 53c8834eea..5d0576e2f6 100644 --- a/.github/workflows/__analysis-kinds.yml +++ b/.github/workflows/__analysis-kinds.yml @@ -67,7 +67,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test id: prepare-test uses: ./.github/actions/prepare-test diff --git a/.github/workflows/__analyze-ref-input.yml b/.github/workflows/__analyze-ref-input.yml index da40def244..bc46c9f49f 100644 --- a/.github/workflows/__analyze-ref-input.yml +++ b/.github/workflows/__analyze-ref-input.yml @@ -65,7 +65,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install .NET uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 with: diff --git a/.github/workflows/__autobuild-action.yml b/.github/workflows/__autobuild-action.yml index 2d655b2eef..0e51343a97 100644 --- a/.github/workflows/__autobuild-action.yml +++ b/.github/workflows/__autobuild-action.yml @@ -59,7 +59,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install .NET uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 with: diff --git a/.github/workflows/__autobuild-direct-tracing-with-working-dir.yml b/.github/workflows/__autobuild-direct-tracing-with-working-dir.yml index 13918e5395..f3bc58c691 100644 --- a/.github/workflows/__autobuild-direct-tracing-with-working-dir.yml +++ b/.github/workflows/__autobuild-direct-tracing-with-working-dir.yml @@ -61,9 +61,9 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Java - uses: actions/setup-java@0f481fcb613427c0f801b606911222b5b6f3083a # v5.5.0 + uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0 with: java-version: ${{ inputs.java-version || '17' }} distribution: temurin diff --git a/.github/workflows/__autobuild-working-dir.yml b/.github/workflows/__autobuild-working-dir.yml index 71dd9d1df8..fac4ef9f54 100644 --- a/.github/workflows/__autobuild-working-dir.yml +++ b/.github/workflows/__autobuild-working-dir.yml @@ -45,7 +45,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test id: prepare-test uses: ./.github/actions/prepare-test diff --git a/.github/workflows/__build-mode-autobuild.yml b/.github/workflows/__build-mode-autobuild.yml index 74881301cf..280dbf569c 100644 --- a/.github/workflows/__build-mode-autobuild.yml +++ b/.github/workflows/__build-mode-autobuild.yml @@ -61,9 +61,9 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Java - uses: actions/setup-java@0f481fcb613427c0f801b606911222b5b6f3083a # v5.5.0 + uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0 with: java-version: ${{ inputs.java-version || '17' }} distribution: temurin diff --git a/.github/workflows/__build-mode-manual.yml b/.github/workflows/__build-mode-manual.yml index efc63b6405..3a250433f6 100644 --- a/.github/workflows/__build-mode-manual.yml +++ b/.github/workflows/__build-mode-manual.yml @@ -65,7 +65,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install .NET uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 with: diff --git a/.github/workflows/__build-mode-none.yml b/.github/workflows/__build-mode-none.yml index dc97aa3d99..da7aa76383 100644 --- a/.github/workflows/__build-mode-none.yml +++ b/.github/workflows/__build-mode-none.yml @@ -47,7 +47,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test id: prepare-test uses: ./.github/actions/prepare-test diff --git a/.github/workflows/__build-mode-rollback.yml b/.github/workflows/__build-mode-rollback.yml index 4383024f3b..fcc77ea36e 100644 --- a/.github/workflows/__build-mode-rollback.yml +++ b/.github/workflows/__build-mode-rollback.yml @@ -45,7 +45,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test id: prepare-test uses: ./.github/actions/prepare-test diff --git a/.github/workflows/__bundle-from-nightly.yml b/.github/workflows/__bundle-from-nightly.yml index 9ccb507866..6c414fb67e 100644 --- a/.github/workflows/__bundle-from-nightly.yml +++ b/.github/workflows/__bundle-from-nightly.yml @@ -45,7 +45,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test id: prepare-test uses: ./.github/actions/prepare-test diff --git a/.github/workflows/__bundle-from-toolcache.yml b/.github/workflows/__bundle-from-toolcache.yml index 036262395e..a1c1fade09 100644 --- a/.github/workflows/__bundle-from-toolcache.yml +++ b/.github/workflows/__bundle-from-toolcache.yml @@ -45,7 +45,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test id: prepare-test uses: ./.github/actions/prepare-test diff --git a/.github/workflows/__bundle-toolcache.yml b/.github/workflows/__bundle-toolcache.yml index 0bdfd45082..9cc983a843 100644 --- a/.github/workflows/__bundle-toolcache.yml +++ b/.github/workflows/__bundle-toolcache.yml @@ -49,7 +49,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test id: prepare-test uses: ./.github/actions/prepare-test diff --git a/.github/workflows/__cleanup-db-cluster-dir.yml b/.github/workflows/__cleanup-db-cluster-dir.yml index 921228910e..3153041401 100644 --- a/.github/workflows/__cleanup-db-cluster-dir.yml +++ b/.github/workflows/__cleanup-db-cluster-dir.yml @@ -45,7 +45,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test id: prepare-test uses: ./.github/actions/prepare-test diff --git a/.github/workflows/__config-export.yml b/.github/workflows/__config-export.yml index dedf559719..0c7a2cc151 100644 --- a/.github/workflows/__config-export.yml +++ b/.github/workflows/__config-export.yml @@ -47,7 +47,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test id: prepare-test uses: ./.github/actions/prepare-test diff --git a/.github/workflows/__config-input.yml b/.github/workflows/__config-input.yml index 7dbaed852e..4267e00584 100644 --- a/.github/workflows/__config-input.yml +++ b/.github/workflows/__config-input.yml @@ -45,7 +45,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Node.js uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: diff --git a/.github/workflows/__cpp-deptrace-disabled.yml b/.github/workflows/__cpp-deptrace-disabled.yml index 5eba27ed63..e2434f4256 100644 --- a/.github/workflows/__cpp-deptrace-disabled.yml +++ b/.github/workflows/__cpp-deptrace-disabled.yml @@ -49,7 +49,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test id: prepare-test uses: ./.github/actions/prepare-test diff --git a/.github/workflows/__cpp-deptrace-enabled-on-macos.yml b/.github/workflows/__cpp-deptrace-enabled-on-macos.yml index d26cd7dca7..344ed8d1ea 100644 --- a/.github/workflows/__cpp-deptrace-enabled-on-macos.yml +++ b/.github/workflows/__cpp-deptrace-enabled-on-macos.yml @@ -47,7 +47,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test id: prepare-test uses: ./.github/actions/prepare-test diff --git a/.github/workflows/__cpp-deptrace-enabled.yml b/.github/workflows/__cpp-deptrace-enabled.yml index d3b04db26d..ab1a70584b 100644 --- a/.github/workflows/__cpp-deptrace-enabled.yml +++ b/.github/workflows/__cpp-deptrace-enabled.yml @@ -49,7 +49,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test id: prepare-test uses: ./.github/actions/prepare-test diff --git a/.github/workflows/__diagnostics-export.yml b/.github/workflows/__diagnostics-export.yml index 7f788ef0a2..c55f3de9b8 100644 --- a/.github/workflows/__diagnostics-export.yml +++ b/.github/workflows/__diagnostics-export.yml @@ -47,7 +47,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test id: prepare-test uses: ./.github/actions/prepare-test diff --git a/.github/workflows/__export-file-baseline-information.yml b/.github/workflows/__export-file-baseline-information.yml index 8d4cfc8f8e..f2eba3691a 100644 --- a/.github/workflows/__export-file-baseline-information.yml +++ b/.github/workflows/__export-file-baseline-information.yml @@ -69,7 +69,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install .NET uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 with: diff --git a/.github/workflows/__extractor-ram-threads.yml b/.github/workflows/__extractor-ram-threads.yml index 28487388df..5bd5c8b940 100644 --- a/.github/workflows/__extractor-ram-threads.yml +++ b/.github/workflows/__extractor-ram-threads.yml @@ -45,7 +45,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test id: prepare-test uses: ./.github/actions/prepare-test diff --git a/.github/workflows/__global-proxy.yml b/.github/workflows/__global-proxy.yml index e3ba6ff101..6f32e4be78 100644 --- a/.github/workflows/__global-proxy.yml +++ b/.github/workflows/__global-proxy.yml @@ -47,7 +47,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test id: prepare-test uses: ./.github/actions/prepare-test diff --git a/.github/workflows/__go-custom-queries.yml b/.github/workflows/__go-custom-queries.yml index a522b602f4..be5c35f7f5 100644 --- a/.github/workflows/__go-custom-queries.yml +++ b/.github/workflows/__go-custom-queries.yml @@ -67,7 +67,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install .NET uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 with: diff --git a/.github/workflows/__go-indirect-tracing-workaround-diagnostic.yml b/.github/workflows/__go-indirect-tracing-workaround-diagnostic.yml index ced2df5982..a577111d23 100644 --- a/.github/workflows/__go-indirect-tracing-workaround-diagnostic.yml +++ b/.github/workflows/__go-indirect-tracing-workaround-diagnostic.yml @@ -55,7 +55,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Go uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 with: diff --git a/.github/workflows/__go-indirect-tracing-workaround-no-file-program.yml b/.github/workflows/__go-indirect-tracing-workaround-no-file-program.yml index 32ebaee34a..215ee36a7a 100644 --- a/.github/workflows/__go-indirect-tracing-workaround-no-file-program.yml +++ b/.github/workflows/__go-indirect-tracing-workaround-no-file-program.yml @@ -55,7 +55,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Go uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 with: diff --git a/.github/workflows/__go-indirect-tracing-workaround.yml b/.github/workflows/__go-indirect-tracing-workaround.yml index 8696063265..5a4d61e1b6 100644 --- a/.github/workflows/__go-indirect-tracing-workaround.yml +++ b/.github/workflows/__go-indirect-tracing-workaround.yml @@ -55,7 +55,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Go uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 with: diff --git a/.github/workflows/__go-tracing-autobuilder.yml b/.github/workflows/__go-tracing-autobuilder.yml index d8ef15b5a9..f006505fe4 100644 --- a/.github/workflows/__go-tracing-autobuilder.yml +++ b/.github/workflows/__go-tracing-autobuilder.yml @@ -75,7 +75,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Go uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 with: diff --git a/.github/workflows/__go-tracing-custom-build-steps.yml b/.github/workflows/__go-tracing-custom-build-steps.yml index 077382459f..573b3cb050 100644 --- a/.github/workflows/__go-tracing-custom-build-steps.yml +++ b/.github/workflows/__go-tracing-custom-build-steps.yml @@ -75,7 +75,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Go uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 with: diff --git a/.github/workflows/__go-tracing-legacy-workflow.yml b/.github/workflows/__go-tracing-legacy-workflow.yml index 2c4031b388..f36cc8beea 100644 --- a/.github/workflows/__go-tracing-legacy-workflow.yml +++ b/.github/workflows/__go-tracing-legacy-workflow.yml @@ -75,7 +75,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Go uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 with: diff --git a/.github/workflows/__init-with-registries.yml b/.github/workflows/__init-with-registries.yml index 623afdee97..9293dcc196 100644 --- a/.github/workflows/__init-with-registries.yml +++ b/.github/workflows/__init-with-registries.yml @@ -49,7 +49,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test id: prepare-test uses: ./.github/actions/prepare-test diff --git a/.github/workflows/__javascript-source-root.yml b/.github/workflows/__javascript-source-root.yml index 622156ce4d..1dcbd38a85 100644 --- a/.github/workflows/__javascript-source-root.yml +++ b/.github/workflows/__javascript-source-root.yml @@ -49,7 +49,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test id: prepare-test uses: ./.github/actions/prepare-test diff --git a/.github/workflows/__job-run-uuid-sarif.yml b/.github/workflows/__job-run-uuid-sarif.yml index 989b28fc53..cd47fb577e 100644 --- a/.github/workflows/__job-run-uuid-sarif.yml +++ b/.github/workflows/__job-run-uuid-sarif.yml @@ -45,7 +45,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test id: prepare-test uses: ./.github/actions/prepare-test diff --git a/.github/workflows/__language-aliases.yml b/.github/workflows/__language-aliases.yml index 3a1656eef7..731d975ce3 100644 --- a/.github/workflows/__language-aliases.yml +++ b/.github/workflows/__language-aliases.yml @@ -45,7 +45,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test id: prepare-test uses: ./.github/actions/prepare-test diff --git a/.github/workflows/__local-bundle.yml b/.github/workflows/__local-bundle.yml index 98d56aa7ef..f6f6837189 100644 --- a/.github/workflows/__local-bundle.yml +++ b/.github/workflows/__local-bundle.yml @@ -65,7 +65,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install .NET uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 with: diff --git a/.github/workflows/__multi-language-autodetect.yml b/.github/workflows/__multi-language-autodetect.yml index e211d0bcd8..3d5ae46993 100644 --- a/.github/workflows/__multi-language-autodetect.yml +++ b/.github/workflows/__multi-language-autodetect.yml @@ -99,7 +99,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install .NET uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 with: diff --git a/.github/workflows/__overlay-init-fallback.yml b/.github/workflows/__overlay-init-fallback.yml index 9a4ffa71f2..b6c99efcef 100644 --- a/.github/workflows/__overlay-init-fallback.yml +++ b/.github/workflows/__overlay-init-fallback.yml @@ -47,7 +47,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test id: prepare-test uses: ./.github/actions/prepare-test diff --git a/.github/workflows/__packaging-codescanning-config-inputs-js.yml b/.github/workflows/__packaging-codescanning-config-inputs-js.yml index 42c3ff95ef..c030616d8c 100644 --- a/.github/workflows/__packaging-codescanning-config-inputs-js.yml +++ b/.github/workflows/__packaging-codescanning-config-inputs-js.yml @@ -69,7 +69,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install .NET uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 with: diff --git a/.github/workflows/__packaging-config-inputs-js.yml b/.github/workflows/__packaging-config-inputs-js.yml index 717f4f0b95..f414ba1c89 100644 --- a/.github/workflows/__packaging-config-inputs-js.yml +++ b/.github/workflows/__packaging-config-inputs-js.yml @@ -69,7 +69,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install .NET uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 with: diff --git a/.github/workflows/__packaging-config-js.yml b/.github/workflows/__packaging-config-js.yml index 2b59922249..dcf9ecec62 100644 --- a/.github/workflows/__packaging-config-js.yml +++ b/.github/workflows/__packaging-config-js.yml @@ -69,7 +69,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install .NET uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 with: diff --git a/.github/workflows/__packaging-inputs-js.yml b/.github/workflows/__packaging-inputs-js.yml index 7c8da5b3db..d7de305196 100644 --- a/.github/workflows/__packaging-inputs-js.yml +++ b/.github/workflows/__packaging-inputs-js.yml @@ -69,7 +69,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install .NET uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 with: diff --git a/.github/workflows/__remote-config.yml b/.github/workflows/__remote-config.yml index 853a3909e6..082ac4953a 100644 --- a/.github/workflows/__remote-config.yml +++ b/.github/workflows/__remote-config.yml @@ -67,7 +67,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install .NET uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 with: diff --git a/.github/workflows/__resolve-environment-action.yml b/.github/workflows/__resolve-environment-action.yml index 29a042ae2b..11a31fdabc 100644 --- a/.github/workflows/__resolve-environment-action.yml +++ b/.github/workflows/__resolve-environment-action.yml @@ -49,7 +49,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test id: prepare-test uses: ./.github/actions/prepare-test diff --git a/.github/workflows/__rubocop-multi-language.yml b/.github/workflows/__rubocop-multi-language.yml index 7ee8f1fdc7..4809b680ab 100644 --- a/.github/workflows/__rubocop-multi-language.yml +++ b/.github/workflows/__rubocop-multi-language.yml @@ -45,7 +45,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test id: prepare-test uses: ./.github/actions/prepare-test @@ -54,7 +54,7 @@ jobs: use-all-platform-bundle: 'false' setup-kotlin: 'true' - name: Set up Ruby - uses: ruby/setup-ruby@d45b1a4e94b71acab930e56e79c6aa188764e7f9 # v1.316.0 + uses: ruby/setup-ruby@003a5c4d8d6321bd302e38f6f0ec593f77f06600 # v1.319.0 with: ruby-version: 2.6 - name: Install Code Scanning integration diff --git a/.github/workflows/__ruby.yml b/.github/workflows/__ruby.yml index 3558be85e4..98f8ec6a2a 100644 --- a/.github/workflows/__ruby.yml +++ b/.github/workflows/__ruby.yml @@ -55,7 +55,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test id: prepare-test uses: ./.github/actions/prepare-test diff --git a/.github/workflows/__rust.yml b/.github/workflows/__rust.yml index e74daa4e4a..b3638ca6df 100644 --- a/.github/workflows/__rust.yml +++ b/.github/workflows/__rust.yml @@ -53,7 +53,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test id: prepare-test uses: ./.github/actions/prepare-test diff --git a/.github/workflows/__split-workflow.yml b/.github/workflows/__split-workflow.yml index 9b49aeceb8..953c1a4eb3 100644 --- a/.github/workflows/__split-workflow.yml +++ b/.github/workflows/__split-workflow.yml @@ -75,7 +75,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install .NET uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 with: diff --git a/.github/workflows/__start-proxy.yml b/.github/workflows/__start-proxy.yml index 51751680c3..edc6aa1cc5 100644 --- a/.github/workflows/__start-proxy.yml +++ b/.github/workflows/__start-proxy.yml @@ -49,7 +49,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test id: prepare-test uses: ./.github/actions/prepare-test diff --git a/.github/workflows/__submit-sarif-failure.yml b/.github/workflows/__submit-sarif-failure.yml index 339d6a07cb..099e93001f 100644 --- a/.github/workflows/__submit-sarif-failure.yml +++ b/.github/workflows/__submit-sarif-failure.yml @@ -49,7 +49,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test id: prepare-test uses: ./.github/actions/prepare-test @@ -57,7 +57,7 @@ jobs: version: ${{ matrix.version }} use-all-platform-bundle: 'false' setup-kotlin: 'true' - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: ./init with: languages: javascript diff --git a/.github/workflows/__swift-autobuild.yml b/.github/workflows/__swift-autobuild.yml index e59a87e3aa..52c189f3a8 100644 --- a/.github/workflows/__swift-autobuild.yml +++ b/.github/workflows/__swift-autobuild.yml @@ -45,7 +45,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test id: prepare-test uses: ./.github/actions/prepare-test diff --git a/.github/workflows/__swift-custom-build.yml b/.github/workflows/__swift-custom-build.yml index 638e2c58fc..617a41c07e 100644 --- a/.github/workflows/__swift-custom-build.yml +++ b/.github/workflows/__swift-custom-build.yml @@ -69,7 +69,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install .NET uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 with: diff --git a/.github/workflows/__unset-environment.yml b/.github/workflows/__unset-environment.yml index 263139dc89..50480ab665 100644 --- a/.github/workflows/__unset-environment.yml +++ b/.github/workflows/__unset-environment.yml @@ -67,7 +67,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install .NET uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 with: diff --git a/.github/workflows/__upload-ref-sha-input.yml b/.github/workflows/__upload-ref-sha-input.yml index e7f942df1d..d51dda2c36 100644 --- a/.github/workflows/__upload-ref-sha-input.yml +++ b/.github/workflows/__upload-ref-sha-input.yml @@ -65,7 +65,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install .NET uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 with: diff --git a/.github/workflows/__upload-sarif.yml b/.github/workflows/__upload-sarif.yml index 36e5d9f053..02e49e11f5 100644 --- a/.github/workflows/__upload-sarif.yml +++ b/.github/workflows/__upload-sarif.yml @@ -72,7 +72,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install .NET uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 with: diff --git a/.github/workflows/__with-checkout-path.yml b/.github/workflows/__with-checkout-path.yml index c4a0c9218c..35a5f64334 100644 --- a/.github/workflows/__with-checkout-path.yml +++ b/.github/workflows/__with-checkout-path.yml @@ -66,7 +66,7 @@ jobs: steps: # This ensures we don't accidentally use the original checkout for any part of the test. - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install .NET uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 with: @@ -91,7 +91,7 @@ jobs: rm -rf ./* .github .git # Check out the actions repo again, but at a different location. # choose an arbitrary SHA so that we can later test that the commit_oid is not from main - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: 474bbf07f9247ffe1856c6a0f94aeeb10e7afee6 path: x/y/z/some-path diff --git a/.github/workflows/check-expected-release-files.yml b/.github/workflows/check-expected-release-files.yml index 670f146566..6cabd0454b 100644 --- a/.github/workflows/check-expected-release-files.yml +++ b/.github/workflows/check-expected-release-files.yml @@ -23,7 +23,7 @@ jobs: steps: - name: Checkout CodeQL Action - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Check Expected Release Files run: | bundle_version="$(cat "./src/defaults.json" | jq -r ".bundleVersion")" diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index c5efa1731a..9f1b9e770b 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -32,7 +32,7 @@ jobs: security-events: read steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up default CodeQL bundle id: setup-default uses: ./setup-codeql @@ -84,7 +84,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Initialize CodeQL uses: ./init id: init @@ -121,7 +121,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Initialize CodeQL uses: ./init with: diff --git a/.github/workflows/codescanning-config-cli.yml b/.github/workflows/codescanning-config-cli.yml index ee1ecea3d1..7bc6718e35 100644 --- a/.github/workflows/codescanning-config-cli.yml +++ b/.github/workflows/codescanning-config-cli.yml @@ -54,7 +54,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up Node.js uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 diff --git a/.github/workflows/debug-artifacts-failure-safe.yml b/.github/workflows/debug-artifacts-failure-safe.yml index 665d0799de..03d2c91b82 100644 --- a/.github/workflows/debug-artifacts-failure-safe.yml +++ b/.github/workflows/debug-artifacts-failure-safe.yml @@ -48,7 +48,7 @@ jobs: - name: Dump GitHub event run: cat "${GITHUB_EVENT_PATH}" - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test id: prepare-test uses: ./.github/actions/prepare-test diff --git a/.github/workflows/debug-artifacts-safe.yml b/.github/workflows/debug-artifacts-safe.yml index 997cfe623a..bb2c87bb41 100644 --- a/.github/workflows/debug-artifacts-safe.yml +++ b/.github/workflows/debug-artifacts-safe.yml @@ -44,7 +44,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test id: prepare-test uses: ./.github/actions/prepare-test diff --git a/.github/workflows/post-release-mergeback.yml b/.github/workflows/post-release-mergeback.yml index 0050c5da85..64a62c1320 100644 --- a/.github/workflows/post-release-mergeback.yml +++ b/.github/workflows/post-release-mergeback.yml @@ -44,7 +44,7 @@ jobs: GITHUB_CONTEXT: '${{ toJson(github) }}' run: echo "${GITHUB_CONTEXT}" - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 # ensure we have all tags and can push commits - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 diff --git a/.github/workflows/pr-checks.yml b/.github/workflows/pr-checks.yml index ae21707826..ac61475d62 100644 --- a/.github/workflows/pr-checks.yml +++ b/.github/workflows/pr-checks.yml @@ -39,7 +39,7 @@ jobs: if: runner.os == 'Windows' run: git config --global core.autocrlf false - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up Node.js uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 @@ -88,7 +88,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up Node.js uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 @@ -161,7 +161,7 @@ jobs: - name: 'Backport: Check out base ref' id: checkout-base if: ${{ startsWith(github.head_ref, 'backport-') }} - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ github.base_ref }} diff --git a/.github/workflows/prepare-release.yml b/.github/workflows/prepare-release.yml index 8bab54557a..4eb300704d 100644 --- a/.github/workflows/prepare-release.yml +++ b/.github/workflows/prepare-release.yml @@ -44,7 +44,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 # Need full history for calculation of diffs diff --git a/.github/workflows/publish-immutable-action.yml b/.github/workflows/publish-immutable-action.yml index ec9a6518aa..5e5623bb07 100644 --- a/.github/workflows/publish-immutable-action.yml +++ b/.github/workflows/publish-immutable-action.yml @@ -20,7 +20,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Publish immutable release id: publish diff --git a/.github/workflows/python312-windows.yml b/.github/workflows/python312-windows.yml index 5722289fad..a3fdd64d65 100644 --- a/.github/workflows/python312-windows.yml +++ b/.github/workflows/python312-windows.yml @@ -36,7 +36,7 @@ jobs: with: python-version: 3.12 - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test uses: ./.github/actions/prepare-test diff --git a/.github/workflows/query-filters.yml b/.github/workflows/query-filters.yml index 182b64b9c1..87b934eb6b 100644 --- a/.github/workflows/query-filters.yml +++ b/.github/workflows/query-filters.yml @@ -30,7 +30,7 @@ jobs: contents: read # This permission is needed to allow the GitHub Actions workflow to read the contents of the repository. steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Node.js uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 diff --git a/.github/workflows/rebuild.yml b/.github/workflows/rebuild.yml index f1d2a1a4f4..faa32c65d9 100644 --- a/.github/workflows/rebuild.yml +++ b/.github/workflows/rebuild.yml @@ -24,7 +24,7 @@ jobs: pull-requests: write # needed to comment on the PR steps: - name: Checkout - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 ref: ${{ env.HEAD_REF }} diff --git a/.github/workflows/rollback-release.yml b/.github/workflows/rollback-release.yml index b830a827dd..6e6b127905 100644 --- a/.github/workflows/rollback-release.yml +++ b/.github/workflows/rollback-release.yml @@ -52,7 +52,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 # Need full history for calculation of diffs diff --git a/.github/workflows/test-codeql-bundle-all.yml b/.github/workflows/test-codeql-bundle-all.yml index e7cd9aab15..a2fee5a8fe 100644 --- a/.github/workflows/test-codeql-bundle-all.yml +++ b/.github/workflows/test-codeql-bundle-all.yml @@ -38,7 +38,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test id: prepare-test uses: ./.github/actions/prepare-test diff --git a/.github/workflows/update-bundle.yml b/.github/workflows/update-bundle.yml index f5e79075e6..701cb0b865 100644 --- a/.github/workflows/update-bundle.yml +++ b/.github/workflows/update-bundle.yml @@ -33,7 +33,7 @@ jobs: GITHUB_CONTEXT: '${{ toJson(github) }}' run: echo "$GITHUB_CONTEXT" - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Update git config run: | diff --git a/.github/workflows/update-release-branch.yml b/.github/workflows/update-release-branch.yml index f690c3847e..9f38f0f0b4 100644 --- a/.github/workflows/update-release-branch.yml +++ b/.github/workflows/update-release-branch.yml @@ -38,7 +38,7 @@ jobs: contents: write # needed to push commits pull-requests: write # needed to create pull request steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 # Need full history for calculation of diffs - uses: ./.github/actions/release-initialise @@ -101,7 +101,7 @@ jobs: private-key: ${{ secrets.AUTOMATION_PRIVATE_KEY }} - name: Checkout - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 # Need full history for calculation of diffs token: ${{ steps.app-token.outputs.token }} diff --git a/.github/workflows/update-supported-enterprise-server-versions.yml b/.github/workflows/update-supported-enterprise-server-versions.yml index 30f926d7a6..4bcdb73796 100644 --- a/.github/workflows/update-supported-enterprise-server-versions.yml +++ b/.github/workflows/update-supported-enterprise-server-versions.yml @@ -28,7 +28,7 @@ jobs: python-version: "3.13" - name: Checkout CodeQL Action - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up Node.js uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 @@ -40,7 +40,7 @@ jobs: run: npm ci - name: Checkout Enterprise Releases - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: repository: github/enterprise-releases token: ${{ secrets.ENTERPRISE_RELEASE_TOKEN }} From 05f56be836fbaca42a028b1fc50e0c4b24b8d34c Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 22 Jul 2026 17:57:55 +0000 Subject: [PATCH 26/95] Bump actions/setup-python from 6.3.0 to 7.0.0 in /.github/workflows Bumps [actions/setup-python](https://github.com/actions/setup-python) from 6.3.0 to 7.0.0. - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](https://github.com/actions/setup-python/compare/ece7cb06caefa5fff74198d8649806c4678c61a1...5fda3b95a4ea91299a34e894583c3862153e4b97) --- updated-dependencies: - dependency-name: actions/setup-python dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] --- .github/workflows/__multi-language-autodetect.yml | 2 +- .github/workflows/post-release-mergeback.yml | 2 +- .github/workflows/python312-windows.yml | 2 +- .github/workflows/update-bundle.yml | 2 +- .../workflows/update-supported-enterprise-server-versions.yml | 2 +- 5 files changed, 5 insertions(+), 5 deletions(-) diff --git a/.github/workflows/__multi-language-autodetect.yml b/.github/workflows/__multi-language-autodetect.yml index e211d0bcd8..1cc25cce99 100644 --- a/.github/workflows/__multi-language-autodetect.yml +++ b/.github/workflows/__multi-language-autodetect.yml @@ -120,7 +120,7 @@ jobs: # We need Python 3.13 for older CLI versions because they are not compatible with Python 3.14 or newer. # See https://github.com/github/codeql-action/pull/3212 if: matrix.version != 'nightly-latest' && matrix.version != 'linked' - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: '3.13' diff --git a/.github/workflows/post-release-mergeback.yml b/.github/workflows/post-release-mergeback.yml index 0050c5da85..82de0100cb 100644 --- a/.github/workflows/post-release-mergeback.yml +++ b/.github/workflows/post-release-mergeback.yml @@ -51,7 +51,7 @@ jobs: with: node-version: 24 cache: 'npm' - - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: '3.12' diff --git a/.github/workflows/python312-windows.yml b/.github/workflows/python312-windows.yml index 5722289fad..4c931c5a24 100644 --- a/.github/workflows/python312-windows.yml +++ b/.github/workflows/python312-windows.yml @@ -32,7 +32,7 @@ jobs: runs-on: windows-latest steps: - - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: 3.12 diff --git a/.github/workflows/update-bundle.yml b/.github/workflows/update-bundle.yml index f5e79075e6..aa9fe86fe7 100644 --- a/.github/workflows/update-bundle.yml +++ b/.github/workflows/update-bundle.yml @@ -41,7 +41,7 @@ jobs: git config --global user.name "github-actions[bot]" - name: Set up Python - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: '3.12' diff --git a/.github/workflows/update-supported-enterprise-server-versions.yml b/.github/workflows/update-supported-enterprise-server-versions.yml index 30f926d7a6..bc6d6859d1 100644 --- a/.github/workflows/update-supported-enterprise-server-versions.yml +++ b/.github/workflows/update-supported-enterprise-server-versions.yml @@ -23,7 +23,7 @@ jobs: steps: - name: Setup Python - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: "3.13" From 6cce0e741f6ac7ab0c45717b3553c246d139760f Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 22 Jul 2026 17:58:15 +0000 Subject: [PATCH 27/95] Bump actions/setup-go from 6.5.0 to 7.0.0 in /.github/workflows Bumps [actions/setup-go](https://github.com/actions/setup-go) from 6.5.0 to 7.0.0. - [Release notes](https://github.com/actions/setup-go/releases) - [Commits](https://github.com/actions/setup-go/compare/924ae3a1cded613372ab5595356fb5720e22ba16...b7ad1dad31e06c5925ef5d2fc7ad053ef454303e) --- updated-dependencies: - dependency-name: actions/setup-go dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] --- .github/workflows/__all-platform-bundle.yml | 2 +- .github/workflows/__analyze-ref-input.yml | 2 +- .github/workflows/__build-mode-manual.yml | 2 +- .github/workflows/__export-file-baseline-information.yml | 2 +- .github/workflows/__go-custom-queries.yml | 2 +- .../workflows/__go-indirect-tracing-workaround-diagnostic.yml | 4 ++-- .../__go-indirect-tracing-workaround-no-file-program.yml | 2 +- .github/workflows/__go-indirect-tracing-workaround.yml | 2 +- .github/workflows/__go-tracing-autobuilder.yml | 2 +- .github/workflows/__go-tracing-custom-build-steps.yml | 2 +- .github/workflows/__go-tracing-legacy-workflow.yml | 2 +- .github/workflows/__local-bundle.yml | 2 +- .github/workflows/__multi-language-autodetect.yml | 2 +- .../workflows/__packaging-codescanning-config-inputs-js.yml | 2 +- .github/workflows/__packaging-config-inputs-js.yml | 2 +- .github/workflows/__packaging-config-js.yml | 2 +- .github/workflows/__packaging-inputs-js.yml | 2 +- .github/workflows/__remote-config.yml | 2 +- .github/workflows/__split-workflow.yml | 2 +- .github/workflows/__swift-custom-build.yml | 2 +- .github/workflows/__unset-environment.yml | 2 +- .github/workflows/__upload-ref-sha-input.yml | 2 +- .github/workflows/__upload-sarif.yml | 2 +- .github/workflows/__with-checkout-path.yml | 2 +- .github/workflows/debug-artifacts-failure-safe.yml | 2 +- .github/workflows/debug-artifacts-safe.yml | 2 +- 26 files changed, 27 insertions(+), 27 deletions(-) diff --git a/.github/workflows/__all-platform-bundle.yml b/.github/workflows/__all-platform-bundle.yml index d4daf95d8b..b085825302 100644 --- a/.github/workflows/__all-platform-bundle.yml +++ b/.github/workflows/__all-platform-bundle.yml @@ -75,7 +75,7 @@ jobs: with: dotnet-version: ${{ inputs.dotnet-version || '9.x' }} - name: Install Go - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: ${{ inputs.go-version || '>=1.21.0' }} cache: false diff --git a/.github/workflows/__analyze-ref-input.yml b/.github/workflows/__analyze-ref-input.yml index da40def244..fe8a565cd2 100644 --- a/.github/workflows/__analyze-ref-input.yml +++ b/.github/workflows/__analyze-ref-input.yml @@ -71,7 +71,7 @@ jobs: with: dotnet-version: ${{ inputs.dotnet-version || '9.x' }} - name: Install Go - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: ${{ inputs.go-version || '>=1.21.0' }} cache: false diff --git a/.github/workflows/__build-mode-manual.yml b/.github/workflows/__build-mode-manual.yml index efc63b6405..4ec1e6b826 100644 --- a/.github/workflows/__build-mode-manual.yml +++ b/.github/workflows/__build-mode-manual.yml @@ -71,7 +71,7 @@ jobs: with: dotnet-version: ${{ inputs.dotnet-version || '9.x' }} - name: Install Go - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: ${{ inputs.go-version || '>=1.21.0' }} cache: false diff --git a/.github/workflows/__export-file-baseline-information.yml b/.github/workflows/__export-file-baseline-information.yml index 8d4cfc8f8e..707523543b 100644 --- a/.github/workflows/__export-file-baseline-information.yml +++ b/.github/workflows/__export-file-baseline-information.yml @@ -75,7 +75,7 @@ jobs: with: dotnet-version: ${{ inputs.dotnet-version || '9.x' }} - name: Install Go - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: ${{ inputs.go-version || '>=1.21.0' }} cache: false diff --git a/.github/workflows/__go-custom-queries.yml b/.github/workflows/__go-custom-queries.yml index a522b602f4..e19cfab559 100644 --- a/.github/workflows/__go-custom-queries.yml +++ b/.github/workflows/__go-custom-queries.yml @@ -73,7 +73,7 @@ jobs: with: dotnet-version: ${{ inputs.dotnet-version || '9.x' }} - name: Install Go - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: ${{ inputs.go-version || '>=1.21.0' }} cache: false diff --git a/.github/workflows/__go-indirect-tracing-workaround-diagnostic.yml b/.github/workflows/__go-indirect-tracing-workaround-diagnostic.yml index ced2df5982..82fcf85e3e 100644 --- a/.github/workflows/__go-indirect-tracing-workaround-diagnostic.yml +++ b/.github/workflows/__go-indirect-tracing-workaround-diagnostic.yml @@ -57,7 +57,7 @@ jobs: - name: Check out repository uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Install Go - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: ${{ inputs.go-version || '>=1.21.0' }} cache: false @@ -73,7 +73,7 @@ jobs: languages: go tools: ${{ steps.prepare-test.outputs.tools-url }} # Deliberately change Go after the `init` step - - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: '1.20' - name: Build code diff --git a/.github/workflows/__go-indirect-tracing-workaround-no-file-program.yml b/.github/workflows/__go-indirect-tracing-workaround-no-file-program.yml index 32ebaee34a..5dd849263d 100644 --- a/.github/workflows/__go-indirect-tracing-workaround-no-file-program.yml +++ b/.github/workflows/__go-indirect-tracing-workaround-no-file-program.yml @@ -57,7 +57,7 @@ jobs: - name: Check out repository uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Install Go - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: ${{ inputs.go-version || '>=1.21.0' }} cache: false diff --git a/.github/workflows/__go-indirect-tracing-workaround.yml b/.github/workflows/__go-indirect-tracing-workaround.yml index 8696063265..6a0a165810 100644 --- a/.github/workflows/__go-indirect-tracing-workaround.yml +++ b/.github/workflows/__go-indirect-tracing-workaround.yml @@ -57,7 +57,7 @@ jobs: - name: Check out repository uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Install Go - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: ${{ inputs.go-version || '>=1.21.0' }} cache: false diff --git a/.github/workflows/__go-tracing-autobuilder.yml b/.github/workflows/__go-tracing-autobuilder.yml index d8ef15b5a9..26d5fded48 100644 --- a/.github/workflows/__go-tracing-autobuilder.yml +++ b/.github/workflows/__go-tracing-autobuilder.yml @@ -77,7 +77,7 @@ jobs: - name: Check out repository uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Install Go - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: ${{ inputs.go-version || '>=1.21.0' }} cache: false diff --git a/.github/workflows/__go-tracing-custom-build-steps.yml b/.github/workflows/__go-tracing-custom-build-steps.yml index 077382459f..69387bc7b4 100644 --- a/.github/workflows/__go-tracing-custom-build-steps.yml +++ b/.github/workflows/__go-tracing-custom-build-steps.yml @@ -77,7 +77,7 @@ jobs: - name: Check out repository uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Install Go - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: ${{ inputs.go-version || '>=1.21.0' }} cache: false diff --git a/.github/workflows/__go-tracing-legacy-workflow.yml b/.github/workflows/__go-tracing-legacy-workflow.yml index 2c4031b388..5d4c983d2d 100644 --- a/.github/workflows/__go-tracing-legacy-workflow.yml +++ b/.github/workflows/__go-tracing-legacy-workflow.yml @@ -77,7 +77,7 @@ jobs: - name: Check out repository uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Install Go - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: ${{ inputs.go-version || '>=1.21.0' }} cache: false diff --git a/.github/workflows/__local-bundle.yml b/.github/workflows/__local-bundle.yml index 98d56aa7ef..7de41f28c4 100644 --- a/.github/workflows/__local-bundle.yml +++ b/.github/workflows/__local-bundle.yml @@ -71,7 +71,7 @@ jobs: with: dotnet-version: ${{ inputs.dotnet-version || '9.x' }} - name: Install Go - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: ${{ inputs.go-version || '>=1.21.0' }} cache: false diff --git a/.github/workflows/__multi-language-autodetect.yml b/.github/workflows/__multi-language-autodetect.yml index e211d0bcd8..e0276cdb42 100644 --- a/.github/workflows/__multi-language-autodetect.yml +++ b/.github/workflows/__multi-language-autodetect.yml @@ -105,7 +105,7 @@ jobs: with: dotnet-version: ${{ inputs.dotnet-version || '9.x' }} - name: Install Go - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: ${{ inputs.go-version || '>=1.21.0' }} cache: false diff --git a/.github/workflows/__packaging-codescanning-config-inputs-js.yml b/.github/workflows/__packaging-codescanning-config-inputs-js.yml index 42c3ff95ef..6da05bd16c 100644 --- a/.github/workflows/__packaging-codescanning-config-inputs-js.yml +++ b/.github/workflows/__packaging-codescanning-config-inputs-js.yml @@ -75,7 +75,7 @@ jobs: with: dotnet-version: ${{ inputs.dotnet-version || '9.x' }} - name: Install Go - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: ${{ inputs.go-version || '>=1.21.0' }} cache: false diff --git a/.github/workflows/__packaging-config-inputs-js.yml b/.github/workflows/__packaging-config-inputs-js.yml index 717f4f0b95..24e6333f55 100644 --- a/.github/workflows/__packaging-config-inputs-js.yml +++ b/.github/workflows/__packaging-config-inputs-js.yml @@ -75,7 +75,7 @@ jobs: with: dotnet-version: ${{ inputs.dotnet-version || '9.x' }} - name: Install Go - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: ${{ inputs.go-version || '>=1.21.0' }} cache: false diff --git a/.github/workflows/__packaging-config-js.yml b/.github/workflows/__packaging-config-js.yml index 2b59922249..9db483cb26 100644 --- a/.github/workflows/__packaging-config-js.yml +++ b/.github/workflows/__packaging-config-js.yml @@ -75,7 +75,7 @@ jobs: with: dotnet-version: ${{ inputs.dotnet-version || '9.x' }} - name: Install Go - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: ${{ inputs.go-version || '>=1.21.0' }} cache: false diff --git a/.github/workflows/__packaging-inputs-js.yml b/.github/workflows/__packaging-inputs-js.yml index 7c8da5b3db..5a529dedb8 100644 --- a/.github/workflows/__packaging-inputs-js.yml +++ b/.github/workflows/__packaging-inputs-js.yml @@ -75,7 +75,7 @@ jobs: with: dotnet-version: ${{ inputs.dotnet-version || '9.x' }} - name: Install Go - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: ${{ inputs.go-version || '>=1.21.0' }} cache: false diff --git a/.github/workflows/__remote-config.yml b/.github/workflows/__remote-config.yml index 853a3909e6..c146e4fc04 100644 --- a/.github/workflows/__remote-config.yml +++ b/.github/workflows/__remote-config.yml @@ -73,7 +73,7 @@ jobs: with: dotnet-version: ${{ inputs.dotnet-version || '9.x' }} - name: Install Go - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: ${{ inputs.go-version || '>=1.21.0' }} cache: false diff --git a/.github/workflows/__split-workflow.yml b/.github/workflows/__split-workflow.yml index 9b49aeceb8..880daa969a 100644 --- a/.github/workflows/__split-workflow.yml +++ b/.github/workflows/__split-workflow.yml @@ -81,7 +81,7 @@ jobs: with: dotnet-version: ${{ inputs.dotnet-version || '9.x' }} - name: Install Go - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: ${{ inputs.go-version || '>=1.21.0' }} cache: false diff --git a/.github/workflows/__swift-custom-build.yml b/.github/workflows/__swift-custom-build.yml index 638e2c58fc..fe222f3be6 100644 --- a/.github/workflows/__swift-custom-build.yml +++ b/.github/workflows/__swift-custom-build.yml @@ -75,7 +75,7 @@ jobs: with: dotnet-version: ${{ inputs.dotnet-version || '9.x' }} - name: Install Go - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: ${{ inputs.go-version || '>=1.21.0' }} cache: false diff --git a/.github/workflows/__unset-environment.yml b/.github/workflows/__unset-environment.yml index 263139dc89..7752a3bd76 100644 --- a/.github/workflows/__unset-environment.yml +++ b/.github/workflows/__unset-environment.yml @@ -73,7 +73,7 @@ jobs: with: dotnet-version: ${{ inputs.dotnet-version || '9.x' }} - name: Install Go - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: ${{ inputs.go-version || '>=1.21.0' }} cache: false diff --git a/.github/workflows/__upload-ref-sha-input.yml b/.github/workflows/__upload-ref-sha-input.yml index e7f942df1d..7dfc0daabb 100644 --- a/.github/workflows/__upload-ref-sha-input.yml +++ b/.github/workflows/__upload-ref-sha-input.yml @@ -71,7 +71,7 @@ jobs: with: dotnet-version: ${{ inputs.dotnet-version || '9.x' }} - name: Install Go - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: ${{ inputs.go-version || '>=1.21.0' }} cache: false diff --git a/.github/workflows/__upload-sarif.yml b/.github/workflows/__upload-sarif.yml index 36e5d9f053..edca805e52 100644 --- a/.github/workflows/__upload-sarif.yml +++ b/.github/workflows/__upload-sarif.yml @@ -78,7 +78,7 @@ jobs: with: dotnet-version: ${{ inputs.dotnet-version || '9.x' }} - name: Install Go - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: ${{ inputs.go-version || '>=1.21.0' }} cache: false diff --git a/.github/workflows/__with-checkout-path.yml b/.github/workflows/__with-checkout-path.yml index c4a0c9218c..ed1d636c49 100644 --- a/.github/workflows/__with-checkout-path.yml +++ b/.github/workflows/__with-checkout-path.yml @@ -72,7 +72,7 @@ jobs: with: dotnet-version: ${{ inputs.dotnet-version || '9.x' }} - name: Install Go - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: ${{ inputs.go-version || '>=1.21.0' }} cache: false diff --git a/.github/workflows/debug-artifacts-failure-safe.yml b/.github/workflows/debug-artifacts-failure-safe.yml index 665d0799de..0a34e59736 100644 --- a/.github/workflows/debug-artifacts-failure-safe.yml +++ b/.github/workflows/debug-artifacts-failure-safe.yml @@ -54,7 +54,7 @@ jobs: uses: ./.github/actions/prepare-test with: version: ${{ matrix.version }} - - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: ^1.13.1 - name: Install .NET diff --git a/.github/workflows/debug-artifacts-safe.yml b/.github/workflows/debug-artifacts-safe.yml index 997cfe623a..d563fb4e0c 100644 --- a/.github/workflows/debug-artifacts-safe.yml +++ b/.github/workflows/debug-artifacts-safe.yml @@ -50,7 +50,7 @@ jobs: uses: ./.github/actions/prepare-test with: version: ${{ matrix.version }} - - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: ^1.13.1 - name: Install .NET From 5c0fb499d4aacd87c141533d4acdeae6c282e371 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 22 Jul 2026 17:58:30 +0000 Subject: [PATCH 28/95] Bump actions/setup-dotnet from 5.4.0 to 6.0.0 in /.github/workflows Bumps [actions/setup-dotnet](https://github.com/actions/setup-dotnet) from 5.4.0 to 6.0.0. - [Release notes](https://github.com/actions/setup-dotnet/releases) - [Commits](https://github.com/actions/setup-dotnet/compare/26b0ec14cb23fa6904739307f278c14f94c95bf1...a98b56852c35b8e3190ac28c8c2271da59106c68) --- updated-dependencies: - dependency-name: actions/setup-dotnet dependency-version: 6.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] --- .github/workflows/__all-platform-bundle.yml | 2 +- .github/workflows/__analyze-ref-input.yml | 2 +- .github/workflows/__autobuild-action.yml | 2 +- .github/workflows/__build-mode-manual.yml | 2 +- .github/workflows/__export-file-baseline-information.yml | 2 +- .github/workflows/__go-custom-queries.yml | 2 +- .github/workflows/__local-bundle.yml | 2 +- .github/workflows/__multi-language-autodetect.yml | 2 +- .github/workflows/__packaging-codescanning-config-inputs-js.yml | 2 +- .github/workflows/__packaging-config-inputs-js.yml | 2 +- .github/workflows/__packaging-config-js.yml | 2 +- .github/workflows/__packaging-inputs-js.yml | 2 +- .github/workflows/__remote-config.yml | 2 +- .github/workflows/__split-workflow.yml | 2 +- .github/workflows/__swift-custom-build.yml | 2 +- .github/workflows/__unset-environment.yml | 2 +- .github/workflows/__upload-ref-sha-input.yml | 2 +- .github/workflows/__upload-sarif.yml | 2 +- .github/workflows/__with-checkout-path.yml | 2 +- .github/workflows/debug-artifacts-failure-safe.yml | 2 +- .github/workflows/debug-artifacts-safe.yml | 2 +- .github/workflows/test-codeql-bundle-all.yml | 2 +- 22 files changed, 22 insertions(+), 22 deletions(-) diff --git a/.github/workflows/__all-platform-bundle.yml b/.github/workflows/__all-platform-bundle.yml index d4daf95d8b..d33b2100b2 100644 --- a/.github/workflows/__all-platform-bundle.yml +++ b/.github/workflows/__all-platform-bundle.yml @@ -71,7 +71,7 @@ jobs: - name: Check out repository uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Install .NET - uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: ${{ inputs.dotnet-version || '9.x' }} - name: Install Go diff --git a/.github/workflows/__analyze-ref-input.yml b/.github/workflows/__analyze-ref-input.yml index da40def244..ebf388c67a 100644 --- a/.github/workflows/__analyze-ref-input.yml +++ b/.github/workflows/__analyze-ref-input.yml @@ -67,7 +67,7 @@ jobs: - name: Check out repository uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Install .NET - uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: ${{ inputs.dotnet-version || '9.x' }} - name: Install Go diff --git a/.github/workflows/__autobuild-action.yml b/.github/workflows/__autobuild-action.yml index 2d655b2eef..8f778e74ca 100644 --- a/.github/workflows/__autobuild-action.yml +++ b/.github/workflows/__autobuild-action.yml @@ -61,7 +61,7 @@ jobs: - name: Check out repository uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Install .NET - uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: ${{ inputs.dotnet-version || '9.x' }} - name: Prepare test diff --git a/.github/workflows/__build-mode-manual.yml b/.github/workflows/__build-mode-manual.yml index efc63b6405..06619aa539 100644 --- a/.github/workflows/__build-mode-manual.yml +++ b/.github/workflows/__build-mode-manual.yml @@ -67,7 +67,7 @@ jobs: - name: Check out repository uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Install .NET - uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: ${{ inputs.dotnet-version || '9.x' }} - name: Install Go diff --git a/.github/workflows/__export-file-baseline-information.yml b/.github/workflows/__export-file-baseline-information.yml index 8d4cfc8f8e..88760654b6 100644 --- a/.github/workflows/__export-file-baseline-information.yml +++ b/.github/workflows/__export-file-baseline-information.yml @@ -71,7 +71,7 @@ jobs: - name: Check out repository uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Install .NET - uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: ${{ inputs.dotnet-version || '9.x' }} - name: Install Go diff --git a/.github/workflows/__go-custom-queries.yml b/.github/workflows/__go-custom-queries.yml index a522b602f4..f321da0ad0 100644 --- a/.github/workflows/__go-custom-queries.yml +++ b/.github/workflows/__go-custom-queries.yml @@ -69,7 +69,7 @@ jobs: - name: Check out repository uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Install .NET - uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: ${{ inputs.dotnet-version || '9.x' }} - name: Install Go diff --git a/.github/workflows/__local-bundle.yml b/.github/workflows/__local-bundle.yml index 98d56aa7ef..439ce4e9ee 100644 --- a/.github/workflows/__local-bundle.yml +++ b/.github/workflows/__local-bundle.yml @@ -67,7 +67,7 @@ jobs: - name: Check out repository uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Install .NET - uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: ${{ inputs.dotnet-version || '9.x' }} - name: Install Go diff --git a/.github/workflows/__multi-language-autodetect.yml b/.github/workflows/__multi-language-autodetect.yml index e211d0bcd8..0d2b5be943 100644 --- a/.github/workflows/__multi-language-autodetect.yml +++ b/.github/workflows/__multi-language-autodetect.yml @@ -101,7 +101,7 @@ jobs: - name: Check out repository uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Install .NET - uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: ${{ inputs.dotnet-version || '9.x' }} - name: Install Go diff --git a/.github/workflows/__packaging-codescanning-config-inputs-js.yml b/.github/workflows/__packaging-codescanning-config-inputs-js.yml index 42c3ff95ef..f39346ff9e 100644 --- a/.github/workflows/__packaging-codescanning-config-inputs-js.yml +++ b/.github/workflows/__packaging-codescanning-config-inputs-js.yml @@ -71,7 +71,7 @@ jobs: - name: Check out repository uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Install .NET - uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: ${{ inputs.dotnet-version || '9.x' }} - name: Install Go diff --git a/.github/workflows/__packaging-config-inputs-js.yml b/.github/workflows/__packaging-config-inputs-js.yml index 717f4f0b95..b8567e6a09 100644 --- a/.github/workflows/__packaging-config-inputs-js.yml +++ b/.github/workflows/__packaging-config-inputs-js.yml @@ -71,7 +71,7 @@ jobs: - name: Check out repository uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Install .NET - uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: ${{ inputs.dotnet-version || '9.x' }} - name: Install Go diff --git a/.github/workflows/__packaging-config-js.yml b/.github/workflows/__packaging-config-js.yml index 2b59922249..af25ba1587 100644 --- a/.github/workflows/__packaging-config-js.yml +++ b/.github/workflows/__packaging-config-js.yml @@ -71,7 +71,7 @@ jobs: - name: Check out repository uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Install .NET - uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: ${{ inputs.dotnet-version || '9.x' }} - name: Install Go diff --git a/.github/workflows/__packaging-inputs-js.yml b/.github/workflows/__packaging-inputs-js.yml index 7c8da5b3db..ab6ad3411a 100644 --- a/.github/workflows/__packaging-inputs-js.yml +++ b/.github/workflows/__packaging-inputs-js.yml @@ -71,7 +71,7 @@ jobs: - name: Check out repository uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Install .NET - uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: ${{ inputs.dotnet-version || '9.x' }} - name: Install Go diff --git a/.github/workflows/__remote-config.yml b/.github/workflows/__remote-config.yml index 853a3909e6..4d08fff584 100644 --- a/.github/workflows/__remote-config.yml +++ b/.github/workflows/__remote-config.yml @@ -69,7 +69,7 @@ jobs: - name: Check out repository uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Install .NET - uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: ${{ inputs.dotnet-version || '9.x' }} - name: Install Go diff --git a/.github/workflows/__split-workflow.yml b/.github/workflows/__split-workflow.yml index 9b49aeceb8..0684a3d341 100644 --- a/.github/workflows/__split-workflow.yml +++ b/.github/workflows/__split-workflow.yml @@ -77,7 +77,7 @@ jobs: - name: Check out repository uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Install .NET - uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: ${{ inputs.dotnet-version || '9.x' }} - name: Install Go diff --git a/.github/workflows/__swift-custom-build.yml b/.github/workflows/__swift-custom-build.yml index 638e2c58fc..67567b6635 100644 --- a/.github/workflows/__swift-custom-build.yml +++ b/.github/workflows/__swift-custom-build.yml @@ -71,7 +71,7 @@ jobs: - name: Check out repository uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Install .NET - uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: ${{ inputs.dotnet-version || '9.x' }} - name: Install Go diff --git a/.github/workflows/__unset-environment.yml b/.github/workflows/__unset-environment.yml index 263139dc89..7430720f12 100644 --- a/.github/workflows/__unset-environment.yml +++ b/.github/workflows/__unset-environment.yml @@ -69,7 +69,7 @@ jobs: - name: Check out repository uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Install .NET - uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: ${{ inputs.dotnet-version || '9.x' }} - name: Install Go diff --git a/.github/workflows/__upload-ref-sha-input.yml b/.github/workflows/__upload-ref-sha-input.yml index e7f942df1d..f2364e204e 100644 --- a/.github/workflows/__upload-ref-sha-input.yml +++ b/.github/workflows/__upload-ref-sha-input.yml @@ -67,7 +67,7 @@ jobs: - name: Check out repository uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Install .NET - uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: ${{ inputs.dotnet-version || '9.x' }} - name: Install Go diff --git a/.github/workflows/__upload-sarif.yml b/.github/workflows/__upload-sarif.yml index 36e5d9f053..d0c9815fd2 100644 --- a/.github/workflows/__upload-sarif.yml +++ b/.github/workflows/__upload-sarif.yml @@ -74,7 +74,7 @@ jobs: - name: Check out repository uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Install .NET - uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: ${{ inputs.dotnet-version || '9.x' }} - name: Install Go diff --git a/.github/workflows/__with-checkout-path.yml b/.github/workflows/__with-checkout-path.yml index c4a0c9218c..0ebfaa9e17 100644 --- a/.github/workflows/__with-checkout-path.yml +++ b/.github/workflows/__with-checkout-path.yml @@ -68,7 +68,7 @@ jobs: - name: Check out repository uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Install .NET - uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: ${{ inputs.dotnet-version || '9.x' }} - name: Install Go diff --git a/.github/workflows/debug-artifacts-failure-safe.yml b/.github/workflows/debug-artifacts-failure-safe.yml index 665d0799de..e50d9c8a9e 100644 --- a/.github/workflows/debug-artifacts-failure-safe.yml +++ b/.github/workflows/debug-artifacts-failure-safe.yml @@ -58,7 +58,7 @@ jobs: with: go-version: ^1.13.1 - name: Install .NET - uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: '9.x' - name: Assert best-effort artifact scan completed diff --git a/.github/workflows/debug-artifacts-safe.yml b/.github/workflows/debug-artifacts-safe.yml index 997cfe623a..2afec4ff78 100644 --- a/.github/workflows/debug-artifacts-safe.yml +++ b/.github/workflows/debug-artifacts-safe.yml @@ -54,7 +54,7 @@ jobs: with: go-version: ^1.13.1 - name: Install .NET - uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: '9.x' - name: Assert best-effort artifact scan completed diff --git a/.github/workflows/test-codeql-bundle-all.yml b/.github/workflows/test-codeql-bundle-all.yml index e7cd9aab15..0dd6c5f6c4 100644 --- a/.github/workflows/test-codeql-bundle-all.yml +++ b/.github/workflows/test-codeql-bundle-all.yml @@ -46,7 +46,7 @@ jobs: version: ${{ matrix.version }} use-all-platform-bundle: true - name: Install .NET - uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: '9.x' - id: init From 11b8f752cfc2b4983a124c7c0d1ac46ee3dffdc6 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Wed, 22 Jul 2026 17:59:36 +0000 Subject: [PATCH 29/95] Rebuild --- pr-checks/checks/rubocop-multi-language.yml | 2 +- pr-checks/checks/submit-sarif-failure.yml | 2 +- pr-checks/checks/with-checkout-path.yml | 2 +- pr-checks/sync.ts | 8 ++++---- 4 files changed, 7 insertions(+), 7 deletions(-) diff --git a/pr-checks/checks/rubocop-multi-language.yml b/pr-checks/checks/rubocop-multi-language.yml index 4128c446d9..7879653f38 100644 --- a/pr-checks/checks/rubocop-multi-language.yml +++ b/pr-checks/checks/rubocop-multi-language.yml @@ -5,7 +5,7 @@ versions: - default steps: - name: Set up Ruby - uses: ruby/setup-ruby@d45b1a4e94b71acab930e56e79c6aa188764e7f9 # v1.316.0 + uses: ruby/setup-ruby@003a5c4d8d6321bd302e38f6f0ec593f77f06600 # v1.319.0 with: ruby-version: 2.6 - name: Install Code Scanning integration diff --git a/pr-checks/checks/submit-sarif-failure.yml b/pr-checks/checks/submit-sarif-failure.yml index 9212a5dc79..c33e1322f7 100644 --- a/pr-checks/checks/submit-sarif-failure.yml +++ b/pr-checks/checks/submit-sarif-failure.yml @@ -21,7 +21,7 @@ permissions: security-events: write # needed to upload the SARIF file steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: ./init with: languages: javascript diff --git a/pr-checks/checks/with-checkout-path.yml b/pr-checks/checks/with-checkout-path.yml index 7a5866b783..a6cde895b6 100644 --- a/pr-checks/checks/with-checkout-path.yml +++ b/pr-checks/checks/with-checkout-path.yml @@ -14,7 +14,7 @@ steps: rm -rf ./* .github .git # Check out the actions repo again, but at a different location. # choose an arbitrary SHA so that we can later test that the commit_oid is not from main - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: 474bbf07f9247ffe1856c6a0f94aeeb10e7afee6 path: x/y/z/some-path diff --git a/pr-checks/sync.ts b/pr-checks/sync.ts index 4329fc01e0..7f5638cf94 100755 --- a/pr-checks/sync.ts +++ b/pr-checks/sync.ts @@ -253,8 +253,8 @@ const languageSetups: LanguageSetups = { name: "Install Java", uses: pinnedUses( "actions/setup-java", - "0f481fcb613427c0f801b606911222b5b6f3083a", - "v5.5.0", + "03ad4de0992f5dab5e18fcb136590ce7c4a0ac95", + "v5.6.0", ), with: { "java-version": `\${{ inputs.java-version || '${defaultLanguageVersions.java}' }}`, @@ -529,8 +529,8 @@ function generateJob( name: "Check out repository", uses: pinnedUses( "actions/checkout", - "9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0", - "v7.0.0", + "3d3c42e5aac5ba805825da76410c181273ba90b1", + "v7.0.1", ), }, ...setupInfo.steps, From d146d63292d5edd61074ffcfb11c191072eaae0b Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Wed, 22 Jul 2026 17:59:52 +0000 Subject: [PATCH 30/95] Rebuild --- pr-checks/checks/multi-language-autodetect.yml | 2 +- pr-checks/sync.ts | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/pr-checks/checks/multi-language-autodetect.yml b/pr-checks/checks/multi-language-autodetect.yml index 801f4521a4..b57e90ab4c 100644 --- a/pr-checks/checks/multi-language-autodetect.yml +++ b/pr-checks/checks/multi-language-autodetect.yml @@ -23,7 +23,7 @@ steps: # We need Python 3.13 for older CLI versions because they are not compatible with Python 3.14 or newer. # See https://github.com/github/codeql-action/pull/3212 if: matrix.version != 'nightly-latest' && matrix.version != 'linked' - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: "3.13" diff --git a/pr-checks/sync.ts b/pr-checks/sync.ts index 4329fc01e0..ae7dc8c6a4 100755 --- a/pr-checks/sync.ts +++ b/pr-checks/sync.ts @@ -271,8 +271,8 @@ const languageSetups: LanguageSetups = { name: "Install Python", uses: pinnedUses( "actions/setup-python", - "ece7cb06caefa5fff74198d8649806c4678c61a1", - "v6.3.0", + "5fda3b95a4ea91299a34e894583c3862153e4b97", + "v7.0.0", ), with: { "python-version": `\${{ inputs.python-version || '${defaultLanguageVersions.python}' }}`, From 1eb720cacc18437568023e14d8b2f5997371c844 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Wed, 22 Jul 2026 18:00:14 +0000 Subject: [PATCH 31/95] Rebuild --- .../checks/go-indirect-tracing-workaround-diagnostic.yml | 2 +- pr-checks/sync.ts | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/pr-checks/checks/go-indirect-tracing-workaround-diagnostic.yml b/pr-checks/checks/go-indirect-tracing-workaround-diagnostic.yml index 895dba2b6c..f0b4097d7b 100644 --- a/pr-checks/checks/go-indirect-tracing-workaround-diagnostic.yml +++ b/pr-checks/checks/go-indirect-tracing-workaround-diagnostic.yml @@ -12,7 +12,7 @@ steps: languages: go tools: ${{ steps.prepare-test.outputs.tools-url }} # Deliberately change Go after the `init` step - - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: "1.20" - name: Build code diff --git a/pr-checks/sync.ts b/pr-checks/sync.ts index 4329fc01e0..770a30282a 100755 --- a/pr-checks/sync.ts +++ b/pr-checks/sync.ts @@ -233,8 +233,8 @@ const languageSetups: LanguageSetups = { name: "Install Go", uses: pinnedUses( "actions/setup-go", - "924ae3a1cded613372ab5595356fb5720e22ba16", - "v6.5.0", + "b7ad1dad31e06c5925ef5d2fc7ad053ef454303e", + "v7.0.0", ), with: { "go-version": `\${{ inputs.go-version || '${defaultLanguageVersions.go}' }}`, From 4671ecc1f6889d33b51149df491479ed9573ccb4 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Wed, 22 Jul 2026 18:00:23 +0000 Subject: [PATCH 32/95] Rebuild --- pr-checks/sync.ts | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pr-checks/sync.ts b/pr-checks/sync.ts index 4329fc01e0..fb62f1639e 100755 --- a/pr-checks/sync.ts +++ b/pr-checks/sync.ts @@ -288,8 +288,8 @@ const languageSetups: LanguageSetups = { name: "Install .NET", uses: pinnedUses( "actions/setup-dotnet", - "26b0ec14cb23fa6904739307f278c14f94c95bf1", - "v5.4.0", + "a98b56852c35b8e3190ac28c8c2271da59106c68", + "v6.0.0", ), with: { "dotnet-version": `\${{ inputs.dotnet-version || '${defaultLanguageVersions.csharp}' }}`, From f170b3a3213fcc24e3372b0c4b58450398eebbfa Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Fri, 24 Jul 2026 14:27:08 +0100 Subject: [PATCH 33/95] Remove `name` field from `ComputedInput` --- lib/entry-points.js | 4 +--- src/config/inputs.test.ts | 2 -- src/config/inputs.ts | 6 +----- 3 files changed, 2 insertions(+), 10 deletions(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index 0df1d5b967..814db7c2af 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -160356,7 +160356,6 @@ async function getToolsInput(action, repositoryProperties) { `Using ${name} input from repository property (enforced): ${propertyValue}` ); return { - name, // Drop the '!' from the value. value: propertyValue.substring(1), source: "repository-property" /* RepositoryProperty */ @@ -160364,14 +160363,13 @@ async function getToolsInput(action, repositoryProperties) { } if (input !== void 0) { action.logger.info(`Using ${name} input from workflow: ${input}`); - return { name, value: input, source: "workflow" /* Workflow */ }; + return { value: input, source: "workflow" /* Workflow */ }; } if (allowRepositoryProperty && propertyValue !== void 0) { action.logger.info( `Using ${name} input from repository property: ${propertyValue}` ); return { - name, value: propertyValue, source: "repository-property" /* RepositoryProperty */ }; diff --git a/src/config/inputs.test.ts b/src/config/inputs.test.ts index a484c76d73..a91dc258ea 100644 --- a/src/config/inputs.test.ts +++ b/src/config/inputs.test.ts @@ -13,13 +13,11 @@ test("getToolsInput - undefined if there's no input", async (t) => { }); const expectedWorkflowResult: ComputedInput = { - name: InputName.Tools, source: InputSource.Workflow, value: "workflow-input-value", }; const expectedRepositoryPropertyResult: ComputedInput = { - name: InputName.Tools, source: InputSource.RepositoryProperty, value: "repo-property-input-value", }; diff --git a/src/config/inputs.ts b/src/config/inputs.ts index 06cfcfdb6c..32a8dfd6f6 100644 --- a/src/config/inputs.ts +++ b/src/config/inputs.ts @@ -21,8 +21,6 @@ export enum InputSource { * the input value that was computed or selected from multiple sources. */ export type ComputedInput = { - /** The name of the property. */ - name: InputName; /** The value of the property. */ value: string; /** The source of the property. */ @@ -54,7 +52,6 @@ export async function getToolsInput( `Using ${name} input from repository property (enforced): ${propertyValue}`, ); return { - name, // Drop the '!' from the value. value: propertyValue.substring(1), source: InputSource.RepositoryProperty, @@ -64,7 +61,7 @@ export async function getToolsInput( // Otherwise, the input from the workflow takes precedence. if (input !== undefined) { action.logger.info(`Using ${name} input from workflow: ${input}`); - return { name, value: input, source: InputSource.Workflow }; + return { value: input, source: InputSource.Workflow }; } // Use the repository property if there's no workflow input. @@ -73,7 +70,6 @@ export async function getToolsInput( `Using ${name} input from repository property: ${propertyValue}`, ); return { - name, value: propertyValue, source: InputSource.RepositoryProperty, }; From 1564bfa3257034750e3a3ca326e2a630f1aa0d63 Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Fri, 24 Jul 2026 14:39:27 +0100 Subject: [PATCH 34/95] Add changelog entry --- CHANGELOG.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 1303638f47..170e03cc37 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,7 +4,7 @@ See the [releases page](https://github.com/github/codeql-action/releases) for th ## [UNRELEASED] -No user facing changes. +- This version of the CodeQL Action adds support for the `tools` input for the `codeql-action/init` step to be specified using a `github-codeql-tools` [repository property](https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization). This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to `toolcache` to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for `tools` in the workflow definition always takes precedence unless the value of the repository property starts with `!`. [#4037](https://github.com/github/codeql-action/pull/4037) ## 4.37.3 - 22 Jul 2026 From 2d14f71964fc76b4d4951317784ee6b4c9440830 Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Fri, 24 Jul 2026 12:35:05 +0100 Subject: [PATCH 35/95] Add `NO_CHANGES_STR` constant --- pr-checks/changelog.ts | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/pr-checks/changelog.ts b/pr-checks/changelog.ts index 49011b0361..1351cd8c2f 100644 --- a/pr-checks/changelog.ts +++ b/pr-checks/changelog.ts @@ -2,14 +2,15 @@ import * as fs from "node:fs"; import { CHANGELOG_FILE, DryRunOption } from "./config"; +/** The default contents for a section in the changelog. */ +export const NO_CHANGES_STR = "No user facing changes.\n\n"; + /** Placeholder changelog content for a new release. */ export const EMPTY_CHANGELOG = `# CodeQL Action Changelog ## [UNRELEASED] -No user facing changes. - -`; +${NO_CHANGES_STR}`; /** Returns `date` formatted as `DD Mon YYYY`. */ export function getReleaseDateString(today: Date = new Date()): string { From 85d157095f7ec93f7aa17909634728937fe6921d Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Fri, 24 Jul 2026 12:48:01 +0100 Subject: [PATCH 36/95] Add `prepare-changelog.ts` with tests --- pr-checks/prepare-changelog.test.ts | 46 ++++++++++++++ pr-checks/prepare-changelog.ts | 96 +++++++++++++++++++++++++++++ 2 files changed, 142 insertions(+) create mode 100644 pr-checks/prepare-changelog.test.ts create mode 100755 pr-checks/prepare-changelog.ts diff --git a/pr-checks/prepare-changelog.test.ts b/pr-checks/prepare-changelog.test.ts new file mode 100644 index 0000000000..53804d7fd9 --- /dev/null +++ b/pr-checks/prepare-changelog.test.ts @@ -0,0 +1,46 @@ +/** + * Tests for `prepare-changelog.ts`. + */ + +import * as assert from "node:assert/strict"; +import * as fs from "node:fs"; +import * as os from "node:os"; +import * as path from "node:path"; +import { afterEach, beforeEach, describe, it } from "node:test"; + +import { EMPTY_CHANGELOG, NO_CHANGES_STR } from "./changelog"; +import { extractChangelogSnippet } from "./prepare-changelog"; + +let testDir: string; + +beforeEach(() => { + // Set up a temporary directory for testing + testDir = fs.mkdtempSync(path.join(os.tmpdir(), "prepare-changelog-test-")); +}); + +afterEach(() => { + /** Clean up temporary directories. */ + fs.rmSync(testDir, { recursive: true, force: true }); +}); + +const testBody = `- Test change`; +const testChangelog = `${EMPTY_CHANGELOG.replace(NO_CHANGES_STR, testBody)} + +## Another section + +- Other change`; + +describe("extractChangelogSnippet", async () => { + await it("returns the default body if the input doesn't exist", async () => { + const result = extractChangelogSnippet(path.join(testDir, "not-here.md")); + assert.deepEqual(result, NO_CHANGES_STR); + }); + + await it("returns the first section if the input exists", async () => { + const changelogPath = path.join(testDir, "test-readme.md"); + fs.writeFileSync(changelogPath, testChangelog); + + const result = extractChangelogSnippet(changelogPath); + assert.deepEqual(result, testBody); + }); +}); diff --git a/pr-checks/prepare-changelog.ts b/pr-checks/prepare-changelog.ts new file mode 100755 index 0000000000..8add7dcf9f --- /dev/null +++ b/pr-checks/prepare-changelog.ts @@ -0,0 +1,96 @@ +#!/usr/bin/env npx tsx + +/** + * Extracts the body of the first changelog section and outputs it to either + * stdout or a file. + */ + +import * as fs from "node:fs"; +import { parseArgs } from "node:util"; + +import { getErrorMessage } from "../src/util"; + +import { NO_CHANGES_STR } from "./changelog"; +import { CHANGELOG_FILE } from "./config"; + +/** + * Prepare the changelog for the new release + * This function will extract the part of the changelog that + * we want to include in the new release. + * + * @param changelogPath The path to the changelog file. + */ +export function extractChangelogSnippet(changelogPath: string) { + try { + const lines = fs.readFileSync(changelogPath, "utf-8").split("\n"); + const output: string[] = []; + let foundFirstSection = false; + + // Extract the body of the first section in the changelog file. + for (const line of lines) { + if (line.startsWith("## ")) { + if (foundFirstSection) { + // This is the second section header we have found, which means that we have + // captured all lines in the first section in `output`. We can stop here. + break; + } + + // We have discovered the first section header. + foundFirstSection = true; + } else if (foundFirstSection) { + // Add lines between the first section header (if any) and the next to the output. + output.push(line); + } + } + + return output.join("\n").trim(); + } catch (err) { + if (err instanceof Error && "code" in err && err.code === "ENOENT") { + console.error(`Changelog file at '${changelogPath}' does not exist.`); + return NO_CHANGES_STR; + } else { + throw Error( + `Failed to open changelog file at '${changelogPath}': ${getErrorMessage(err)}`, + ); + } + } +} + +function main() { + try { + const { values } = parseArgs({ + options: { + changelog: { + type: "string", + short: "f", + default: CHANGELOG_FILE, + }, + output: { + type: "string", + short: "o", + }, + }, + strict: true, + }); + + const body = extractChangelogSnippet(values.changelog); + + // If no `output` argument was provided, output to stdout. Otherwise, + // write a file to the specified path. + if (values.output === undefined) { + console.info(body); + } else { + fs.writeFileSync(values.output, body); + } + + return 0; + } catch (err) { + console.error(`Failed to prepare changelog: ${getErrorMessage(err)}`); + return -1; + } +} + +// Only call `main` if this script was run directly. +if (require.main === module) { + process.exit(main()); +} From b69467ce8bd149c52676a584a728ab412d2645ea Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Fri, 24 Jul 2026 12:53:04 +0100 Subject: [PATCH 37/95] Update workflows to use `prepare-changelog.ts` --- .github/workflows/post-release-mergeback.yml | 2 +- .github/workflows/rollback-release.yml | 4 +++- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/.github/workflows/post-release-mergeback.yml b/.github/workflows/post-release-mergeback.yml index 170b309de1..22215eea1a 100644 --- a/.github/workflows/post-release-mergeback.yml +++ b/.github/workflows/post-release-mergeback.yml @@ -127,7 +127,7 @@ jobs: env: PARTIAL_CHANGELOG: "${{ runner.temp }}/partial_changelog.md" run: | - python .github/workflows/script/prepare_changelog.py CHANGELOG.md > $PARTIAL_CHANGELOG + npx tsx pr-checks/prepare-changelog.ts --output="$PARTIAL_CHANGELOG" echo "::group::Partial CHANGELOG" cat $PARTIAL_CHANGELOG diff --git a/.github/workflows/rollback-release.yml b/.github/workflows/rollback-release.yml index 6e6b127905..16680565d2 100644 --- a/.github/workflows/rollback-release.yml +++ b/.github/workflows/rollback-release.yml @@ -128,7 +128,9 @@ jobs: NEW_CHANGELOG: "${{ runner.temp }}/new_changelog.md" PARTIAL_CHANGELOG: "${{ runner.temp }}/partial_changelog.md" run: | - python .github/workflows/script/prepare_changelog.py $NEW_CHANGELOG > $PARTIAL_CHANGELOG + npx tsx pr-checks/prepare-changelog.ts \ + --changelog="$NEW_CHANGELOG" \ + --output="$PARTIAL_CHANGELOG" echo "::group::Partial CHANGELOG" cat $PARTIAL_CHANGELOG From 5901394530153b6f8919d08615334908398cc2b2 Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Fri, 24 Jul 2026 12:54:11 +0100 Subject: [PATCH 38/95] Remove `prepare_changelog.py` --- .github/workflows/script/prepare_changelog.py | 35 ------------------- 1 file changed, 35 deletions(-) delete mode 100755 .github/workflows/script/prepare_changelog.py diff --git a/.github/workflows/script/prepare_changelog.py b/.github/workflows/script/prepare_changelog.py deleted file mode 100755 index dafb84b39c..0000000000 --- a/.github/workflows/script/prepare_changelog.py +++ /dev/null @@ -1,35 +0,0 @@ -#!/usr/bin/env python3 -import os -import sys - -EMPTY_CHANGELOG = 'No changes.\n\n' - -# Prepare the changelog for the new release -# This function will extract the part of the changelog that -# we want to include in the new release. -def extract_changelog_snippet(changelog_file): - output = '' - if (not os.path.exists(changelog_file)): - output = EMPTY_CHANGELOG - - else: - with open(changelog_file, 'r') as f: - lines = f.readlines() - - # Include only the contents of the first section - found_first_section = False - for line in lines: - if line.startswith('## '): - if found_first_section: - break - found_first_section = True - elif found_first_section: - output += line - - return output.strip() - - -if len(sys.argv) < 2: - raise Exception('Expecting argument: changelog_file') -changelog_file = sys.argv[1] -print(extract_changelog_snippet(changelog_file)) From 57eb44123f42baf689ff4e4eb31eba3627666bc1 Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Fri, 24 Jul 2026 13:32:04 +0100 Subject: [PATCH 39/95] Add constant for unreleased placeholder --- pr-checks/changelog.ts | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/pr-checks/changelog.ts b/pr-checks/changelog.ts index 1351cd8c2f..3fe03a399f 100644 --- a/pr-checks/changelog.ts +++ b/pr-checks/changelog.ts @@ -2,13 +2,16 @@ import * as fs from "node:fs"; import { CHANGELOG_FILE, DryRunOption } from "./config"; +/** The placeholder in the header for unreleased changes. */ +export const UNRELEASED_PLACEHOLDER = "[UNRELEASED]"; + /** The default contents for a section in the changelog. */ export const NO_CHANGES_STR = "No user facing changes.\n\n"; /** Placeholder changelog content for a new release. */ export const EMPTY_CHANGELOG = `# CodeQL Action Changelog -## [UNRELEASED] +## ${UNRELEASED_PLACEHOLDER} ${NO_CHANGES_STR}`; @@ -54,7 +57,7 @@ export function setVersionAndDate( date: Date = new Date(), ): string { const versionAndDate = `${version} - ${getReleaseDateString(date)}`; - return content.replace("[UNRELEASED]", versionAndDate); + return content.replace(UNRELEASED_PLACEHOLDER, versionAndDate); } /** From 093dce6cc2d6fcbbe0e87a60af7aba4687f57f72 Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Fri, 24 Jul 2026 13:41:35 +0100 Subject: [PATCH 40/95] Add `extractChangelogSnippet` test for the case where there is no first section --- pr-checks/prepare-changelog.test.ts | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/pr-checks/prepare-changelog.test.ts b/pr-checks/prepare-changelog.test.ts index 53804d7fd9..13a302c8f6 100644 --- a/pr-checks/prepare-changelog.test.ts +++ b/pr-checks/prepare-changelog.test.ts @@ -43,4 +43,12 @@ describe("extractChangelogSnippet", async () => { const result = extractChangelogSnippet(changelogPath); assert.deepEqual(result, testBody); }); + + await it("returns an empty string if there is no first section", async () => { + const changelogPath = path.join(testDir, "test-readme.md"); + fs.writeFileSync(changelogPath, "# CodeQL Action Changelog\n"); + + const result = extractChangelogSnippet(changelogPath); + assert.deepEqual(result, ""); + }); }); From 916098aa8d13708f92e6c439083f7832ba3b89c7 Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Fri, 24 Jul 2026 14:59:57 +0100 Subject: [PATCH 41/95] Add `parseChangelog` and `renderChangelog` --- pr-checks/changelog.test.ts | 12 ++++++ pr-checks/changelog.ts | 85 +++++++++++++++++++++++++++++++++++++ 2 files changed, 97 insertions(+) diff --git a/pr-checks/changelog.test.ts b/pr-checks/changelog.test.ts index 3eddc14591..817852e3e1 100755 --- a/pr-checks/changelog.test.ts +++ b/pr-checks/changelog.test.ts @@ -5,14 +5,18 @@ */ import * as assert from "node:assert/strict"; +import * as fs from "node:fs"; import { describe, it } from "node:test"; import { EMPTY_CHANGELOG, getReleaseDateString, + parseChangelog, processChangelogForBackports, + renderChangelog, setVersionAndDate, } from "./changelog"; +import { CHANGELOG_FILE } from "./config"; const testDate = new Date(2026, 7, 14); @@ -37,6 +41,14 @@ describe("setVersionAndDate", async () => { }); }); +describe("parseChangelog + renderChangelog", async () => { + await it("renderChangelog(parseChangelog(c)) == c", async () => { + const actualChangelog = fs.readFileSync(CHANGELOG_FILE, "utf-8"); + const roundtrip = renderChangelog(parseChangelog(actualChangelog)); + assert.deepEqual(roundtrip.split("\n"), actualChangelog.split("\n")); + }); +}); + const testChangelog = `# CodeQL Action Changelog ## 4.12.3 - 14 Aug 2026 diff --git a/pr-checks/changelog.ts b/pr-checks/changelog.ts index 3fe03a399f..db3a99b153 100644 --- a/pr-checks/changelog.ts +++ b/pr-checks/changelog.ts @@ -15,6 +15,22 @@ export const EMPTY_CHANGELOG = `# CodeQL Action Changelog ${NO_CHANGES_STR}`; +/** + * Represents sections in a changelog. + */ +export interface ChangelogSection { + headerLine: string; + bodyLines: string[]; +} + +/** + * Represents a changelog. + */ +export interface Changelog { + preamble: string[]; + sections: ChangelogSection[]; +} + /** Returns `date` formatted as `DD Mon YYYY`. */ export function getReleaseDateString(today: Date = new Date()): string { return today.toLocaleDateString("en-GB", { @@ -60,6 +76,75 @@ export function setVersionAndDate( return content.replace(UNRELEASED_PLACEHOLDER, versionAndDate); } +/** + * Parses `content` into a structured representation of a changelog. + * + * @param content The contents of the changelog file. + */ +export function parseChangelog(content: string): Changelog { + const lines = content.split("\n"); + let i = 0; + + const preamble: string[] = []; + const sections: ChangelogSection[] = []; + let currentSection: ChangelogSection | undefined = undefined; + + // Process all lines of the input file. + while (i < lines.length) { + const line = lines[i]; + + // Sections of the changelog start with `## `. + if (line.startsWith("## ")) { + // We have discovered a new section. If `currentSection` is already defined, + // then this marks the end of that section. Push it to the array of sections + // in the changelog. + if (currentSection !== undefined) { + sections.push(currentSection); + } + + // Initialise the new section. + currentSection = { headerLine: line, bodyLines: [] }; + } else if (currentSection !== undefined) { + // Add lines between the section header and the next to the current section. + currentSection.bodyLines.push(line); + } else { + // This is neither a section header nor are we in a section already, + // so this line is part of the preamble. + preamble.push(line); + } + + i++; + } + + // Push the current section to the array of completed sections, if there is + // still one unfinished. + if (currentSection !== undefined) { + sections.push(currentSection); + } + + return { preamble, sections }; +} + +/** + * Combines an array of lines into a single string by adding line breaks. + */ +export function unlines(lines: string[]): string { + return `${lines.join("\n")}`; +} + +/** + * Renders a given changelog to a string. + */ +export function renderChangelog(changelog: Changelog): string { + let result = unlines(changelog.preamble); + + for (const section of changelog.sections) { + result += `\n${section.headerLine}\n${unlines(section.bodyLines)}`; + } + + return result; +} + /** * Processes changelog entries for a backport, converting version references * from the source major version to the target major version and filtering From adba0868a4038cf2cc306da86d5c53024f0109b4 Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Fri, 24 Jul 2026 15:00:44 +0100 Subject: [PATCH 42/95] Update `processChangelogForBackports` to use `parseChangelog` --- pr-checks/changelog.ts | 80 ++++++++++++++++++------------------------ 1 file changed, 34 insertions(+), 46 deletions(-) diff --git a/pr-checks/changelog.ts b/pr-checks/changelog.ts index db3a99b153..4cf1e75494 100644 --- a/pr-checks/changelog.ts +++ b/pr-checks/changelog.ts @@ -155,70 +155,58 @@ export function processChangelogForBackports( targetBranchMajorVersion: string, content: string, ): string { - const lines = content.split("\n"); - // Changelog entries can use the following format to indicate // that they only apply to newer versions const someVersionsOnlyRegex = /\[v(\d+)\+ only\]/; - let output = ""; - let i = 0; + // Parse the changelog. + const changelog = parseChangelog(content); - // Copy lines until we find the first section heading. - let foundFirstSection = false; - while (!foundFirstSection && i < lines.length) { - let line = lines[i]; - if (line.startsWith("## ")) { - line = line.replace( - `## ${sourceBranchMajorVersion}`, - `## ${targetBranchMajorVersion}`, - ); - foundFirstSection = true; - } - output += `${line}\n`; - i++; - } - - if (!foundFirstSection) { + if (changelog.sections.length === 0) { throw new Error("Could not find any change sections in CHANGELOG.md"); } - // Process remaining lines. - // `foundContent` tracks whether we hit two headings in a row - let foundContent = false; - output += "\n"; - - while (i < lines.length) { - let line = lines[i]; - i++; - - // Filter out changelog entries that only apply to newer versions. - const match = someVersionsOnlyRegex.exec(line); - if (match) { + // Filter out changelog entries that only apply to newer versions and + // update the section headings with the backport major version for + // sections we keep. + for (const section of changelog.sections) { + // Update the section headings with the backport major version. + section.headerLine = section.headerLine.replace( + `## ${sourceBranchMajorVersion}`, + `## ${targetBranchMajorVersion}`, + ); + + const filteredEntries: string[] = []; + let foundContent = false; + + for (const line of section.bodyLines) { + // Skip the entry if `someVersionsOnlyRegex` matches and the major version + // of the target branch is smaller than the required version. + const match = someVersionsOnlyRegex.exec(line); if ( + match && Number.parseInt(targetBranchMajorVersion) < Number.parseInt(match[1]) ) { continue; } - } - if (line.startsWith("## ")) { - line = line.replace( - `## ${sourceBranchMajorVersion}`, - `## ${targetBranchMajorVersion}`, - ); - if (!foundContent) { - output += "No user facing changes.\n"; - } - foundContent = false; - output += `\n${line}\n\n`; - } else { + // Keep the line. + filteredEntries.push(line); + + // Set `foundContent` to `true` if the line is not empty. if (line.trim() !== "") { foundContent = true; - output += `${line}\n`; } } + + // Update the section with the retained entries. + section.bodyLines = filteredEntries; + + // Add an entry if we didn't keep any. + if (!foundContent) { + section.bodyLines.push(NO_CHANGES_STR.trim()); + } } - return output; + return renderChangelog(changelog); } From c5d621238d047125431ab165a2c991d3097c735d Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Fri, 24 Jul 2026 15:01:07 +0100 Subject: [PATCH 43/95] Update `extractChangelogSnippet` to use `parseChangelog` --- pr-checks/prepare-changelog.ts | 27 +++++++-------------------- 1 file changed, 7 insertions(+), 20 deletions(-) diff --git a/pr-checks/prepare-changelog.ts b/pr-checks/prepare-changelog.ts index 8add7dcf9f..9ee89767bb 100755 --- a/pr-checks/prepare-changelog.ts +++ b/pr-checks/prepare-changelog.ts @@ -10,7 +10,7 @@ import { parseArgs } from "node:util"; import { getErrorMessage } from "../src/util"; -import { NO_CHANGES_STR } from "./changelog"; +import { NO_CHANGES_STR, parseChangelog } from "./changelog"; import { CHANGELOG_FILE } from "./config"; /** @@ -22,28 +22,15 @@ import { CHANGELOG_FILE } from "./config"; */ export function extractChangelogSnippet(changelogPath: string) { try { - const lines = fs.readFileSync(changelogPath, "utf-8").split("\n"); - const output: string[] = []; - let foundFirstSection = false; + const content = fs.readFileSync(changelogPath, "utf-8"); + const changelog = parseChangelog(content); - // Extract the body of the first section in the changelog file. - for (const line of lines) { - if (line.startsWith("## ")) { - if (foundFirstSection) { - // This is the second section header we have found, which means that we have - // captured all lines in the first section in `output`. We can stop here. - break; - } - - // We have discovered the first section header. - foundFirstSection = true; - } else if (foundFirstSection) { - // Add lines between the first section header (if any) and the next to the output. - output.push(line); - } + // Return an empty string if we couldn't find the first section. + if (changelog.sections.length === 0) { + return ""; } - return output.join("\n").trim(); + return changelog.sections[0].bodyLines.join("\n").trim(); } catch (err) { if (err instanceof Error && "code" in err && err.code === "ENOENT") { console.error(`Changelog file at '${changelogPath}' does not exist.`); From 66a6f42f0a3913dd88868e788503602498b26925 Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Fri, 24 Jul 2026 15:23:11 +0100 Subject: [PATCH 44/95] Add `bundle-changelog.ts` with tests --- pr-checks/bundle-changelog.test.ts | 142 +++++++++++++++++++++++++++++ pr-checks/bundle-changelog.ts | 128 ++++++++++++++++++++++++++ pr-checks/config.ts | 4 + 3 files changed, 274 insertions(+) create mode 100644 pr-checks/bundle-changelog.test.ts create mode 100755 pr-checks/bundle-changelog.ts diff --git a/pr-checks/bundle-changelog.test.ts b/pr-checks/bundle-changelog.test.ts new file mode 100644 index 0000000000..6cc4d096ba --- /dev/null +++ b/pr-checks/bundle-changelog.test.ts @@ -0,0 +1,142 @@ +/** + * Tests for `bundle-changelog.ts`. + */ + +import * as assert from "node:assert/strict"; +import * as fs from "node:fs"; +import * as os from "node:os"; +import * as path from "node:path"; +import { afterEach, beforeEach, describe, it } from "node:test"; + +import { + CLI_VERSION_ENV_VAR, + getCLIVersion, + getPRNumber, + getPRUrl, + PR_URL_ENV_VAR, + updateChangelog, +} from "./bundle-changelog"; +import { + EMPTY_CHANGELOG, + NO_CHANGES_STR, + UNRELEASED_PLACEHOLDER, +} from "./changelog"; + +let testDir: string; + +beforeEach(() => { + // Set up a temporary directory for testing + testDir = fs.mkdtempSync(path.join(os.tmpdir(), "bundle-changelog-test-")); +}); + +afterEach(() => { + /** Clean up temporary directories. */ + fs.rmSync(testDir, { recursive: true, force: true }); +}); + +describe("getCLIVersion", async () => { + await it("throws if the environment variable is not set", async () => { + delete process.env[CLI_VERSION_ENV_VAR]; + assert.throws(() => getCLIVersion()); + }); + + await it("throws if the environment variable is empty", async () => { + process.env[CLI_VERSION_ENV_VAR] = " "; + assert.throws(() => getCLIVersion()); + }); + + await it("returns value of the environment variable if set", async () => { + const testValue = "1.2.3"; + process.env[CLI_VERSION_ENV_VAR] = testValue; + assert.deepEqual(getCLIVersion(), testValue); + }); +}); + +const testPrUrl = "https://github.com/github/codeql-action/pulls/42"; + +describe("getPRUrl", async () => { + await it("throws if the environment variable is not set", async () => { + delete process.env[PR_URL_ENV_VAR]; + assert.throws(() => getPRUrl()); + }); + + await it("throws if the environment variable is empty", async () => { + process.env[PR_URL_ENV_VAR] = " "; + assert.throws(() => getPRUrl()); + }); + + await it("returns value of the environment variable if set", async () => { + process.env[PR_URL_ENV_VAR] = testPrUrl; + assert.deepEqual(getPRUrl(), testPrUrl); + }); +}); + +describe("getPRNumber", async () => { + await it("throws if the last part of the input is not a number", async () => { + assert.throws(() => getPRNumber(`${testPrUrl}/foo`)); + }); + + await it("throws if the last part of the input is not a positive number", async () => { + assert.throws(() => getPRNumber(`${testPrUrl}/-100`)); + }); + + await it("returns the PR number from an URL", async () => { + assert.equal(getPRNumber(testPrUrl), 42); + }); +}); + +const testChangelog = `${EMPTY_CHANGELOG.trimEnd()} + +## 4.23.7 + +- Other change + +## 4.23.6 + +${NO_CHANGES_STR}`; + +const expectedChangelog = `# CodeQL Action Changelog + +## ${UNRELEASED_PLACEHOLDER} + +- Update default CodeQL bundle version to + +## 4.23.7 + +- Other change + +## 4.23.6 + +${NO_CHANGES_STR}`; + +describe("updateChangelog", async () => { + await it("removes `NO_CHANGES_STR` if present in [UNRELEASED] section", async () => { + const result = updateChangelog(EMPTY_CHANGELOG, ""); + assert.ok(!result.includes(NO_CHANGES_STR.trim())); + }); + + await it("doesn't remove `NO_CHANGES_STR` if present in versioned section", async () => { + const result = updateChangelog( + EMPTY_CHANGELOG.replace(UNRELEASED_PLACEHOLDER, "1.2.3"), + "", + ); + assert.ok(result.includes(NO_CHANGES_STR.trim())); + }); + + await it("throws if there are no sections", async () => { + assert.throws(() => { + updateChangelog( + "# CodeQL Action Changelog", + "- Update default CodeQL bundle version to", + ); + }); + }); + + await it("adds note at the end of the first section", async () => { + const result = updateChangelog( + testChangelog, + "- Update default CodeQL bundle version to", + ); + assert.deepEqual(result, expectedChangelog); + }); +}); diff --git a/pr-checks/bundle-changelog.ts b/pr-checks/bundle-changelog.ts new file mode 100755 index 0000000000..243cbd86b6 --- /dev/null +++ b/pr-checks/bundle-changelog.ts @@ -0,0 +1,128 @@ +#!/usr/bin/env npx tsx + +/** + * Updates the changelog with a change note for an updated CodeQL CLI bundle. + */ + +import * as fs from "node:fs"; + +import { getErrorMessage } from "../src/util"; + +import { + parseChangelog, + renderChangelog, + UNRELEASED_PLACEHOLDER, +} from "./changelog"; +import { CHANGELOG_FILE, CLI_BUNDLE_RELEASE_URL_PREFIX } from "./config"; + +export const CLI_VERSION_ENV_VAR = "CLI_VERSION"; +export const PR_URL_ENV_VAR = "PR_URL"; + +/** Gets the CLI version from the environment. */ +export function getCLIVersion() { + const cliVersion = process.env[CLI_VERSION_ENV_VAR]; + + if (cliVersion === undefined || cliVersion.trim() === "") { + throw new Error(`No CLI version was set in '${CLI_VERSION_ENV_VAR}'.`); + } + + return cliVersion; +} + +/** Gets the PR URL from the environment. */ +export function getPRUrl() { + const prUrl = process.env[PR_URL_ENV_VAR]; + + if (prUrl === undefined || prUrl.trim() === "") { + throw new Error(`No PR URL was set in '${PR_URL_ENV_VAR}'.`); + } + + return prUrl; +} + +/** + * Gets the PR number from something like a PR URL. + */ +export function getPRNumber(prUrl: string) { + const prUrlParts = prUrl.split("/"); + const prNumberStr = prUrlParts[prUrlParts.length - 1]; + + const prNumber = Number.parseInt(prNumberStr, 10); + + if (!Number.isInteger(prNumber) || prNumber <= 0) { + throw new Error( + `Invalid PR URL '${prUrl}': last part is not a positive number`, + ); + } + + return prNumber; +} + +/** + * Updates `changelog` by adding `changelogNote` to the first section. + * + * @param contents The existing changelog contents. + * @param changelogNote The note to add to the first section. + */ +export function updateChangelog(contents: string, changelogNote: string) { + // If the "[UNRELEASED]" section starts with "no user facing changes", remove that line. + contents = contents.replace( + `## ${UNRELEASED_PLACEHOLDER}\n\nNo user facing changes.`, + `## ${UNRELEASED_PLACEHOLDER}\n`, + ); + + const changelog = parseChangelog(contents); + + if (changelog.sections.length === 0) { + throw new Error("The changelog contains no existing sections."); + } + + // Add the changelog note to the bottom of the first section. + const firstSection = changelog.sections[0]; + const lastLine = firstSection.bodyLines.pop(); + + if (lastLine !== undefined && lastLine.trim() !== "") { + // We expect the last line to be empty. If it isn't for some reason, + // add it back. + firstSection.bodyLines.push(lastLine); + } + + firstSection.bodyLines.push(changelogNote); + + // If the last line is empty as expected, then add it back in after the new note. + if (lastLine?.trim() === "") { + firstSection.bodyLines.push(lastLine); + } + + return renderChangelog(changelog); +} + +function main() { + try { + const cliVersion = getCLIVersion(); + const prUrl = getPRUrl(); + + // The GitHub Release for the new bundle version. + const bundleReleaseUrl = `${CLI_BUNDLE_RELEASE_URL_PREFIX}${cliVersion}`; + + // Get the PR number from the PR URL. + const prNumber = getPRNumber(prUrl); + const changelogNote = `- Update default CodeQL bundle version to [${cliVersion}](${bundleReleaseUrl}). [#${prNumber}](${prUrl})`; + + let changelog = fs.readFileSync(CHANGELOG_FILE, "utf-8"); + + changelog = updateChangelog(changelog, changelogNote); + + fs.writeFileSync(CHANGELOG_FILE, changelog); + + return 0; + } catch (err) { + console.error(`Failed to bundle changelog: ${getErrorMessage(err)}`); + return -1; + } +} + +// Only call `main` if this script was run directly. +if (require.main === module) { + process.exit(main()); +} diff --git a/pr-checks/config.ts b/pr-checks/config.ts index 94d34a931d..356fe665f9 100644 --- a/pr-checks/config.ts +++ b/pr-checks/config.ts @@ -37,6 +37,10 @@ export const API_COMPATIBILITY_FILE = path.join( "api-compatibility.json", ); +/** The prefix of CodeQL CLI bundle release URLs. */ +export const CLI_BUNDLE_RELEASE_URL_PREFIX = + "https://github.com/github/codeql-action/releases/tag/codeql-bundle-v"; + /** A common interface for operations that support dry runs. */ export interface DryRunOption { /** A value indicating whether to perform operations with side effects. */ From 027ac05d3b9f135622bc03943be850da84e8ad3b Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Fri, 24 Jul 2026 15:24:33 +0100 Subject: [PATCH 45/95] Use `bundle-changelog.ts` and remove Python version --- .github/workflows/script/bundle_changelog.py | 23 -------------------- .github/workflows/update-bundle.yml | 2 +- 2 files changed, 1 insertion(+), 24 deletions(-) delete mode 100755 .github/workflows/script/bundle_changelog.py diff --git a/.github/workflows/script/bundle_changelog.py b/.github/workflows/script/bundle_changelog.py deleted file mode 100755 index d8ced87d8d..0000000000 --- a/.github/workflows/script/bundle_changelog.py +++ /dev/null @@ -1,23 +0,0 @@ -#!/usr/bin/env python3 -import os -import re - -cli_version = os.environ['CLI_VERSION'] - -# The GitHub Release for the new bundle version. -bundle_release_url = f"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v{cli_version}" -# Get the PR number from the PR URL. -pr_number = os.environ['PR_URL'].split('/')[-1] -changelog_note = f"- Update default CodeQL bundle version to [{cli_version}]({bundle_release_url}). [#{pr_number}]({os.environ['PR_URL']})" - -# If the "[UNRELEASED]" section starts with "no user facing changes", remove that line. -with open('CHANGELOG.md', 'r') as f: - changelog = f.read() - -changelog = changelog.replace('## [UNRELEASED]\n\nNo user facing changes.', '## [UNRELEASED]\n') - -# Add the changelog note to the bottom of the "[UNRELEASED]" section. -changelog = re.sub(r'\n## (\d+\.\d+\.\d+)', f'{changelog_note}\n\n## \\1', changelog, count=1) - -with open('CHANGELOG.md', 'w') as f: - f.write(changelog) diff --git a/.github/workflows/update-bundle.yml b/.github/workflows/update-bundle.yml index 8dcf058591..72eacf1397 100644 --- a/.github/workflows/update-bundle.yml +++ b/.github/workflows/update-bundle.yml @@ -120,7 +120,7 @@ jobs: - name: Create changelog note run: | - python .github/workflows/script/bundle_changelog.py + npx tsx pr-checks/bundle-changelog.ts - name: Push changelog note run: | From d71461774b5cf2296505e568335a3415b840aa5a Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Fri, 24 Jul 2026 15:48:35 +0100 Subject: [PATCH 46/95] Add `rollback-changelog.ts` with tests --- pr-checks/rollback-changelog.test.ts | 45 +++++++++++++ pr-checks/rollback-changelog.ts | 94 ++++++++++++++++++++++++++++ 2 files changed, 139 insertions(+) create mode 100644 pr-checks/rollback-changelog.test.ts create mode 100755 pr-checks/rollback-changelog.ts diff --git a/pr-checks/rollback-changelog.test.ts b/pr-checks/rollback-changelog.test.ts new file mode 100644 index 0000000000..5264755a69 --- /dev/null +++ b/pr-checks/rollback-changelog.test.ts @@ -0,0 +1,45 @@ +/** + * Tests for `rollback-changelog.ts`. + */ + +import * as assert from "node:assert/strict"; +import * as fs from "node:fs"; +import { describe, it } from "node:test"; + +import { getReleaseDateString, parseChangelog } from "./changelog"; +import { CHANGELOG_FILE } from "./config"; +import { updateChangelog } from "./rollback-changelog"; + +describe("updateChangelog", async () => { + await it("replaces the first section with one for the rollback release", async () => { + const actualChangelog = parseChangelog( + fs.readFileSync(CHANGELOG_FILE, "utf-8"), + ); + const existingFirstSection = actualChangelog.sections[0]; + + const today = new Date(); + updateChangelog(actualChangelog, { + "new-version": "Test.1.3", + "rollback-version": "Test.1.2", + "target-version": "Test.1.1", + today, + }); + + // Check that the old, first section is gone. + for (const section of actualChangelog.sections) { + assert.notDeepEqual(section, existingFirstSection); + } + + // Check that the new, first section matches our expectations. + const newFirstSection = actualChangelog.sections[0]; + assert.deepEqual( + newFirstSection.headerLine, + `## Test.1.3 - ${getReleaseDateString(today)}`, + ); + assert.equal(newFirstSection.bodyLines.length, 3); + assert.deepEqual( + newFirstSection.bodyLines[1], + `This release rolls back Test.1.2 due to issues with that release. It is identical to Test.1.1.`, + ); + }); +}); diff --git a/pr-checks/rollback-changelog.ts b/pr-checks/rollback-changelog.ts new file mode 100755 index 0000000000..23b10c9357 --- /dev/null +++ b/pr-checks/rollback-changelog.ts @@ -0,0 +1,94 @@ +#!/usr/bin/env npx tsx + +/** + * Replaces the current, first section of the changelog with a new one for the rollback release. + */ + +import * as fs from "node:fs"; +import { parseArgs } from "node:util"; + +import { getErrorMessage } from "../src/util"; + +import { + Changelog, + ChangelogSection, + getReleaseDateString, + parseChangelog, + renderChangelog, +} from "./changelog"; +import { CHANGELOG_FILE } from "./config"; + +export interface RollbackChangelogInputs { + "target-version": string; + "rollback-version": string; + "new-version": string; + today?: Date; +} + +/** + * Replaces the current, first section of the changelog with a new one for the rollback release. + */ +export function updateChangelog( + changelog: Changelog, + versions: RollbackChangelogInputs, +) { + // Drop the existing first section. + changelog.sections.shift(); + + // Construct the section for the rollback version. + const newSection: ChangelogSection = { + headerLine: `## ${versions["new-version"]} - ${getReleaseDateString(versions.today)}`, + bodyLines: [ + "", + `This release rolls back ${versions["rollback-version"]} due to issues with that release. It is identical to ${versions["target-version"]}.`, + "", + ], + }; + + // Add the new section at the top of the changelog. + changelog.sections.unshift(newSection); +} + +function main() { + try { + const { values } = parseArgs({ + options: { + "target-version": { + type: "string", + short: "t", + }, + "rollback-version": { + type: "string", + short: "r", + }, + "new-version": { + type: "string", + short: "n", + }, + }, + strict: true, + }); + + for (const key of Object.keys(values)) { + if (key === undefined || key.trim() === "") { + throw new Error(`Argument '--${key}' is required.`); + } + } + + const changelog = parseChangelog(fs.readFileSync(CHANGELOG_FILE, "utf-8")); + updateChangelog(changelog, values as RollbackChangelogInputs); + console.info(renderChangelog(changelog)); + + return 0; + } catch (err) { + console.error( + `Failed to prepare rollback changelog: ${getErrorMessage(err)}`, + ); + return -1; + } +} + +// Only call `main` if this script was run directly. +if (require.main === module) { + process.exit(main()); +} From 961b583f9ac26ed437c0f5abb5609fe16d8e29fa Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Fri, 24 Jul 2026 15:52:50 +0100 Subject: [PATCH 47/95] Use `rollback-changelog.ts` and remove Python version --- .github/workflows/rollback-release.yml | 2 +- .../workflows/script/rollback_changelog.py | 62 ------------------- 2 files changed, 1 insertion(+), 63 deletions(-) delete mode 100644 .github/workflows/script/rollback_changelog.py diff --git a/.github/workflows/rollback-release.yml b/.github/workflows/rollback-release.yml index 16680565d2..c37f8a79ae 100644 --- a/.github/workflows/rollback-release.yml +++ b/.github/workflows/rollback-release.yml @@ -93,7 +93,7 @@ jobs: LATEST_TAG: ${{ needs.prepare.outputs.latest_tag }} VERSION: "${{ needs.prepare.outputs.version }}" run: | - python .github/workflows/script/rollback_changelog.py \ + npx tsx pr-checks/rollback-changelog.ts \ --target-version "${ROLLBACK_TAG:1}" \ --rollback-version "${LATEST_TAG:1}" \ --new-version "$VERSION" > $NEW_CHANGELOG diff --git a/.github/workflows/script/rollback_changelog.py b/.github/workflows/script/rollback_changelog.py deleted file mode 100644 index 5e06f83455..0000000000 --- a/.github/workflows/script/rollback_changelog.py +++ /dev/null @@ -1,62 +0,0 @@ -import datetime -import os -import argparse - -EMPTY_CHANGELOG = """# CodeQL Action Changelog - -""" - -def get_today_string(): - today = datetime.datetime.today() - return '{:%d %b %Y}'.format(today) - -# Include everything up to and after the first heading, -# but not the first heading and body. -def drop_unreleased_section(lines: list[str]): - before_first_section = '' - after_first_section = '' - found_first_section = False - skipped_first_section = False - - for i, line in enumerate(lines): - if line.startswith('## ') and not found_first_section: - found_first_section = True - elif line.startswith('## ') and found_first_section: - skipped_first_section = True - - if not found_first_section: - before_first_section += line - if skipped_first_section: - after_first_section += line - - return (before_first_section, after_first_section) - -def update_changelog(target_version, rollback_version, new_version): - before_first_section = EMPTY_CHANGELOG - after_first_section = '' - - if (os.path.exists('CHANGELOG.md')): - with open('CHANGELOG.md', 'r') as f: - (before_first_section, after_first_section) = drop_unreleased_section(f.readlines()) - - newHeader = f'## {new_version} - {get_today_string()}\n' - - print(before_first_section, end="") - print(newHeader) - print(f"This release rolls back {rollback_version} due to issues with that release. It is identical to {target_version}.\n") - print(after_first_section) - -# We expect three version strings as input: -# -# - target_version: the version that we are re-releasing as `new_version` -# - rollback_version: the version that we are rolling back, typically the one that followed `target_version` -# - new_version: the new version that we are releasing `target_version` as, typically the one that follows `rollback_version` -# -# Example: python3 .github/workflows/script/rollback_changelog.py --target-version "1.2.3" --rollback-version "1.2.4" --new-version "1.2.5" -parser = argparse.ArgumentParser(description="Update CHANGELOG.md for a rollback release.") -parser.add_argument("--target-version", "-t", required=True, help="Version to re-release as new_version.") -parser.add_argument("--rollback-version", "-r", required=True, help="Version being rolled back.") -parser.add_argument("--new-version", "-n", required=True, help="New version to publish for target_version.") -args = parser.parse_args() - -update_changelog(args.target_version, args.rollback_version, args.new_version) From ab44eb939db84ba2eebaa9ead83e1e833bde6df6 Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Fri, 24 Jul 2026 15:58:27 +0100 Subject: [PATCH 48/95] Remove `python` from CodeQL workflow There is no more (non-test) Python code left to analyse, so CodeQL analysis would fail now --- .github/workflows/codeql.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 9f1b9e770b..f27de17fd8 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -113,7 +113,6 @@ jobs: matrix: include: - language: actions - - language: python permissions: contents: read From cbad145443761aa6d61cbac486cf37b1bf610a15 Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Fri, 24 Jul 2026 16:01:33 +0100 Subject: [PATCH 49/95] Remove Python-specific steps from workflows that no longer need them --- .github/actions/release-initialise/action.yml | 11 ----------- .github/workflows/post-release-mergeback.yml | 3 --- .github/workflows/update-bundle.yml | 5 ----- .../update-supported-enterprise-server-versions.yml | 5 ----- 4 files changed, 24 deletions(-) diff --git a/.github/actions/release-initialise/action.yml b/.github/actions/release-initialise/action.yml index be16f03950..239dfa9428 100644 --- a/.github/actions/release-initialise/action.yml +++ b/.github/actions/release-initialise/action.yml @@ -25,17 +25,6 @@ runs: shell: bash run: npm ci - - name: Set up Python - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 - with: - python-version: '3.12' - - - name: Install dependencies - run: | - python -m pip install --upgrade pip - pip install PyGithub==2.3.0 requests - shell: bash - - name: Update git config run: | git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com" diff --git a/.github/workflows/post-release-mergeback.yml b/.github/workflows/post-release-mergeback.yml index 22215eea1a..ceb220b3a0 100644 --- a/.github/workflows/post-release-mergeback.yml +++ b/.github/workflows/post-release-mergeback.yml @@ -51,9 +51,6 @@ jobs: with: node-version: 24 cache: 'npm' - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 - with: - python-version: '3.12' - name: Update git config run: | diff --git a/.github/workflows/update-bundle.yml b/.github/workflows/update-bundle.yml index 72eacf1397..d3ee924e59 100644 --- a/.github/workflows/update-bundle.yml +++ b/.github/workflows/update-bundle.yml @@ -40,11 +40,6 @@ jobs: git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com" git config --global user.name "github-actions[bot]" - - name: Set up Python - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 - with: - python-version: '3.12' - - name: Set up Node.js uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: diff --git a/.github/workflows/update-supported-enterprise-server-versions.yml b/.github/workflows/update-supported-enterprise-server-versions.yml index fc7873711d..01cd6ab8fb 100644 --- a/.github/workflows/update-supported-enterprise-server-versions.yml +++ b/.github/workflows/update-supported-enterprise-server-versions.yml @@ -22,11 +22,6 @@ jobs: pull-requests: write # needed to create pull request steps: - - name: Setup Python - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 - with: - python-version: "3.13" - - name: Checkout CodeQL Action uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 From 0953dc00da12a0b089198632e7283ce52dc21c35 Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Fri, 24 Jul 2026 16:08:18 +0100 Subject: [PATCH 50/95] Add `getErrorMessage` to `pr-checks`-local `util.ts` to avoid pulling in `src/util.ts` dependencies --- pr-checks/bundle-changelog.ts | 3 +-- pr-checks/prepare-changelog.ts | 3 +-- pr-checks/rollback-changelog.ts | 3 +-- pr-checks/util.ts | 9 +++++++++ 4 files changed, 12 insertions(+), 6 deletions(-) create mode 100644 pr-checks/util.ts diff --git a/pr-checks/bundle-changelog.ts b/pr-checks/bundle-changelog.ts index 243cbd86b6..557a8556c1 100755 --- a/pr-checks/bundle-changelog.ts +++ b/pr-checks/bundle-changelog.ts @@ -6,14 +6,13 @@ import * as fs from "node:fs"; -import { getErrorMessage } from "../src/util"; - import { parseChangelog, renderChangelog, UNRELEASED_PLACEHOLDER, } from "./changelog"; import { CHANGELOG_FILE, CLI_BUNDLE_RELEASE_URL_PREFIX } from "./config"; +import { getErrorMessage } from "./util"; export const CLI_VERSION_ENV_VAR = "CLI_VERSION"; export const PR_URL_ENV_VAR = "PR_URL"; diff --git a/pr-checks/prepare-changelog.ts b/pr-checks/prepare-changelog.ts index 9ee89767bb..0c89699fc8 100755 --- a/pr-checks/prepare-changelog.ts +++ b/pr-checks/prepare-changelog.ts @@ -8,10 +8,9 @@ import * as fs from "node:fs"; import { parseArgs } from "node:util"; -import { getErrorMessage } from "../src/util"; - import { NO_CHANGES_STR, parseChangelog } from "./changelog"; import { CHANGELOG_FILE } from "./config"; +import { getErrorMessage } from "./util"; /** * Prepare the changelog for the new release diff --git a/pr-checks/rollback-changelog.ts b/pr-checks/rollback-changelog.ts index 23b10c9357..e0b3634daa 100755 --- a/pr-checks/rollback-changelog.ts +++ b/pr-checks/rollback-changelog.ts @@ -7,8 +7,6 @@ import * as fs from "node:fs"; import { parseArgs } from "node:util"; -import { getErrorMessage } from "../src/util"; - import { Changelog, ChangelogSection, @@ -17,6 +15,7 @@ import { renderChangelog, } from "./changelog"; import { CHANGELOG_FILE } from "./config"; +import { getErrorMessage } from "./util"; export interface RollbackChangelogInputs { "target-version": string; diff --git a/pr-checks/util.ts b/pr-checks/util.ts new file mode 100644 index 0000000000..353b2a9654 --- /dev/null +++ b/pr-checks/util.ts @@ -0,0 +1,9 @@ +/** + * Returns an appropriate message for the error. + * + * If the error is an `Error` instance, this returns the error message without + * an `Error: ` prefix. + */ +export function getErrorMessage(error: unknown): string { + return error instanceof Error ? error.message : String(error); +} From f00f809405a0571f02079a483378ba1102bd3d1e Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Fri, 24 Jul 2026 16:17:04 +0100 Subject: [PATCH 51/95] Fix checking keys rather than values --- pr-checks/rollback-changelog.ts | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pr-checks/rollback-changelog.ts b/pr-checks/rollback-changelog.ts index e0b3634daa..6f2edb4b94 100755 --- a/pr-checks/rollback-changelog.ts +++ b/pr-checks/rollback-changelog.ts @@ -68,8 +68,8 @@ function main() { strict: true, }); - for (const key of Object.keys(values)) { - if (key === undefined || key.trim() === "") { + for (const [key, val] of Object.entries(values)) { + if (val === undefined || val.trim() === "") { throw new Error(`Argument '--${key}' is required.`); } } From 74b15aa2c6c649153cb2e5f7a9d3bd2f0c8f82d1 Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Fri, 24 Jul 2026 16:19:45 +0100 Subject: [PATCH 52/95] Install JS deps if needed in `post-release-mergeback` workflow --- .github/workflows/post-release-mergeback.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/post-release-mergeback.yml b/.github/workflows/post-release-mergeback.yml index ceb220b3a0..c493c2a382 100644 --- a/.github/workflows/post-release-mergeback.yml +++ b/.github/workflows/post-release-mergeback.yml @@ -52,6 +52,9 @@ jobs: node-version: 24 cache: 'npm' + - name: Install JavaScript dependencies + run: npm ci + - name: Update git config run: | git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com" From 3013ac07bdb913cf5b7a1a8a63fe51422ce5a91e Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Fri, 24 Jul 2026 16:28:21 +0100 Subject: [PATCH 53/95] Promote `AllowToolcacheInput` feature --- lib/entry-points.js | 22 ++++------------------ src/feature-flags.ts | 6 ------ src/setup-codeql.test.ts | 14 +++----------- src/setup-codeql.ts | 18 ++++-------------- 4 files changed, 11 insertions(+), 49 deletions(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index 33d389269f..cc8d81960f 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -146793,11 +146793,6 @@ var featureConfig = { envVar: "CODEQL_ACTION_ALLOW_MULTIPLE_ANALYSIS_KINDS", minimumVersion: void 0 }, - ["allow_toolcache_input" /* AllowToolcacheInput */]: { - defaultValue: false, - envVar: "CODEQL_ACTION_ALLOW_TOOLCACHE_INPUT", - minimumVersion: void 0 - }, ["cleanup_trap_caches" /* CleanupTrapCaches */]: { defaultValue: false, envVar: "CODEQL_ACTION_CLEANUP_TRAP_CACHES", @@ -150951,10 +150946,7 @@ async function getCodeQLSource(toolsInput, defaultCliVersion, rawLanguages, useO } } else if (toolsInput !== void 0 && toolsInput === CODEQL_TOOLCACHE_INPUT) { let latestToolcacheVersion; - const allowToolcacheValueFF = await features.getValue( - "allow_toolcache_input" /* AllowToolcacheInput */ - ); - const allowToolcacheValue = allowToolcacheValueFF && (isDynamicWorkflow() || isInTestMode()); + const allowToolcacheValue = isDynamicWorkflow() || isInTestMode(); if (allowToolcacheValue) { logger.info( `Attempting to use the latest CodeQL CLI version in the toolcache, as requested by 'tools: ${toolsInput}'.` @@ -150970,15 +150962,9 @@ async function getCodeQLSource(toolsInput, defaultCliVersion, rawLanguages, useO `Found no CodeQL CLI in the toolcache, ignoring 'tools: ${toolsInput}'...` ); } else { - if (allowToolcacheValueFF) { - logger.warning( - `Ignoring 'tools: ${toolsInput}' because the workflow was not triggered dynamically.` - ); - } else { - logger.info( - `Ignoring 'tools: ${toolsInput}' because the feature is not enabled.` - ); - } + logger.warning( + `Ignoring 'tools: ${toolsInput}' because the workflow was not triggered dynamically.` + ); } const version = await resolveDefaultCliVersion( defaultCliVersion, diff --git a/src/feature-flags.ts b/src/feature-flags.ts index 0c92ac69af..bb05c0b4e2 100644 --- a/src/feature-flags.ts +++ b/src/feature-flags.ts @@ -74,7 +74,6 @@ export enum Feature { AllowMergeConfigFiles = "allow_merge_config_files", /** Controls whether we allow multiple values for the `analysis-kinds` input. */ AllowMultipleAnalysisKinds = "allow_multiple_analysis_kinds", - AllowToolcacheInput = "allow_toolcache_input", CleanupTrapCaches = "cleanup_trap_caches", /** Whether to allow the `config-file` input to be specified via a repository property. */ ConfigFileRepositoryProperty = "config_file_repository_property", @@ -185,11 +184,6 @@ export const featureConfig = { envVar: "CODEQL_ACTION_ALLOW_MULTIPLE_ANALYSIS_KINDS", minimumVersion: undefined, }, - [Feature.AllowToolcacheInput]: { - defaultValue: false, - envVar: "CODEQL_ACTION_ALLOW_TOOLCACHE_INPUT", - minimumVersion: undefined, - }, [Feature.CleanupTrapCaches]: { defaultValue: false, envVar: "CODEQL_ACTION_CLEANUP_TRAP_CACHES", diff --git a/src/setup-codeql.test.ts b/src/setup-codeql.test.ts index 33dfc079ba..219e39984c 100644 --- a/src/setup-codeql.test.ts +++ b/src/setup-codeql.test.ts @@ -451,7 +451,7 @@ test.serial( async (t) => { const loggedMessages: LoggedMessage[] = []; const logger = getRecordingLogger(loggedMessages); - const features = createFeatures([Feature.AllowToolcacheInput]); + const features = createFeatures([]); const latestToolcacheVersion = "3.2.1"; const latestVersionPath = "/path/to/latest"; @@ -580,7 +580,7 @@ const toolcacheInputFallbackMacro = makeMacro({ toolcacheInputFallbackMacro.serial( "the toolcache doesn't have a CodeQL CLI when tools == toolcache", - [Feature.AllowToolcacheInput], + [], { GITHUB_EVENT_NAME: "dynamic" }, [], [ @@ -591,7 +591,7 @@ toolcacheInputFallbackMacro.serial( toolcacheInputFallbackMacro.serial( "the workflow trigger is not `dynamic`", - [Feature.AllowToolcacheInput], + [], { GITHUB_EVENT_NAME: "pull_request" }, [], [ @@ -599,14 +599,6 @@ toolcacheInputFallbackMacro.serial( ], ); -toolcacheInputFallbackMacro.serial( - "the feature flag is not enabled", - [], - { GITHUB_EVENT_NAME: "dynamic" }, - [], - [`Ignoring 'tools: toolcache' because the feature is not enabled.`], -); - test.serial( 'tryGetTagNameFromUrl extracts the right tag name for a repo name containing "codeql-bundle"', (t) => { diff --git a/src/setup-codeql.ts b/src/setup-codeql.ts index 105c544499..8d374585aa 100644 --- a/src/setup-codeql.ts +++ b/src/setup-codeql.ts @@ -533,11 +533,7 @@ export async function getCodeQLSource( // We only allow `toolsInput === "toolcache"` for `dynamic` events. In general, using `toolsInput === "toolcache"` // can lead to alert wobble and so it shouldn't be used for an analysis where results are intended to be uploaded. // We also allow this in test mode. - const allowToolcacheValueFF = await features.getValue( - Feature.AllowToolcacheInput, - ); - const allowToolcacheValue = - allowToolcacheValueFF && (isDynamicWorkflow() || util.isInTestMode()); + const allowToolcacheValue = isDynamicWorkflow() || util.isInTestMode(); if (allowToolcacheValue) { // If `toolsInput === "toolcache"`, try to find the latest version of the CLI that's available in the toolcache // and use that. We perform this check here since we can set `cliVersion` directly and don't want to default to @@ -558,15 +554,9 @@ export async function getCodeQLSource( `Found no CodeQL CLI in the toolcache, ignoring 'tools: ${toolsInput}'...`, ); } else { - if (allowToolcacheValueFF) { - logger.warning( - `Ignoring 'tools: ${toolsInput}' because the workflow was not triggered dynamically.`, - ); - } else { - logger.info( - `Ignoring 'tools: ${toolsInput}' because the feature is not enabled.`, - ); - } + logger.warning( + `Ignoring 'tools: ${toolsInput}' because the workflow was not triggered dynamically.`, + ); } const version = await resolveDefaultCliVersion( From 2a8731cc0636c612147a349ccc88166bd482a9e1 Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Mon, 27 Jul 2026 13:10:34 +0100 Subject: [PATCH 54/95] Move `config-file` computation after determining the `analysisKinds` --- lib/entry-points.js | 10 +++++----- src/init-action.ts | 13 +++++++------ 2 files changed, 12 insertions(+), 11 deletions(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index 528f258a87..c522b43c4a 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -160750,11 +160750,6 @@ async function run3(actionState) { logger.info(`Job run UUID is ${jobRunUuid}.`); core21.exportVariable("JOB_RUN_UUID" /* JOB_RUN_UUID */, jobRunUuid); core21.exportVariable("CODEQL_ACTION_INIT_HAS_RUN" /* INIT_ACTION_HAS_RUN */, "true"); - const actionStateWithFeatures = { ...actionState, features }; - configFile = await getConfigFileInput( - actionStateWithFeatures, - repositoryProperties - ); sourceRoot = path24.resolve( getRequiredEnvParam("GITHUB_WORKSPACE"), getOptionalInput("source-root") || "" @@ -160767,6 +160762,11 @@ async function run3(actionState) { `Failed to parse analysis kinds for 'starting' status report: ${getErrorMessage(err)}` ); } + const actionStateWithFeatures = { ...actionState, features }; + configFile = await getConfigFileInput( + actionStateWithFeatures, + repositoryProperties + ); await sendStartingStatusReport(startedAt, { analysisKinds }, logger); if (process.env["CODEQL_ACTION_SETUP_CODEQL_HAS_RUN" /* SETUP_CODEQL_ACTION_HAS_RUN */] === "true") { throw new ConfigurationError( diff --git a/src/init-action.ts b/src/init-action.ts index c7837c6eed..ec7983b76c 100644 --- a/src/init-action.ts +++ b/src/init-action.ts @@ -262,12 +262,6 @@ async function run( core.exportVariable(EnvVar.INIT_ACTION_HAS_RUN, "true"); - const actionStateWithFeatures = { ...actionState, features }; - configFile = await getConfigFileInput( - actionStateWithFeatures, - repositoryProperties, - ); - // path.resolve() respects the intended semantics of source-root. If // source-root is relative, it is relative to the GITHUB_WORKSPACE. If // source-root is absolute, it is used as given. @@ -290,6 +284,13 @@ async function run( ); } + // Compute the value of the `config-file` input. + const actionStateWithFeatures = { ...actionState, features }; + configFile = await getConfigFileInput( + actionStateWithFeatures, + repositoryProperties, + ); + // Send a status report indicating that an analysis is starting. await sendStartingStatusReport(startedAt, { analysisKinds }, logger); From 8289a49271cbb335d374e7e2e7a50c1576be0afe Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Mon, 27 Jul 2026 13:23:39 +0100 Subject: [PATCH 55/95] Ignore repository property for unsupported analysis kinds --- lib/entry-points.js | 8 +++++--- src/config/file.test.ts | 39 ++++++++++++++++++++++++++++++++++----- src/config/file.ts | 16 +++++++++++++++- src/init-action.ts | 1 + 4 files changed, 55 insertions(+), 9 deletions(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index c522b43c4a..5904ad07ae 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -148495,14 +148495,15 @@ async function getConfigFileInput({ logger, actions, features -}, repositoryProperties) { +}, repositoryProperties, analysisKinds) { const input = actions.getOptionalInput("config-file"); if (input !== void 0) { logger.info(`Using configuration file input from workflow: ${input}`); return input; } const propertyValue = repositoryProperties["github-codeql-config-file" /* CONFIG_FILE */]; - if (propertyValue !== void 0 && propertyValue.trim().length > 0) { + const analysisKindSupported = analysisKinds === void 0 || analysisKinds.includes("code-scanning" /* CodeScanning */) && analysisKinds.length === 1; + if (analysisKindSupported && propertyValue !== void 0 && propertyValue.trim().length > 0) { const useRepositoryProperty = await features.getValue( "config_file_repository_property" /* ConfigFileRepositoryProperty */ ); @@ -160765,7 +160766,8 @@ async function run3(actionState) { const actionStateWithFeatures = { ...actionState, features }; configFile = await getConfigFileInput( actionStateWithFeatures, - repositoryProperties + repositoryProperties, + analysisKinds ); await sendStartingStatusReport(startedAt, { analysisKinds }, logger); if (process.env["CODEQL_ACTION_SETUP_CODEQL_HAS_RUN" /* SETUP_CODEQL_ACTION_HAS_RUN */] === "true") { diff --git a/src/config/file.test.ts b/src/config/file.test.ts index 22e2f795f8..17ac21d565 100644 --- a/src/config/file.test.ts +++ b/src/config/file.test.ts @@ -2,6 +2,7 @@ import * as github from "@actions/github"; import test from "ava"; import sinon from "sinon"; +import { AnalysisKind } from "../analyses"; import * as api from "../api-client"; import { RegistryProxyVars } from "../environment"; import { Feature } from "../feature-flags"; @@ -18,7 +19,7 @@ setupTests(test); test("getConfigFileInput returns undefined by default", async (t) => { await callee(getConfigFileInput) - .withArgs({}) + .withArgs({}, undefined) .withFeatures([Feature.ConfigFileRepositoryProperty]) .passes(t.is, undefined); }); @@ -40,7 +41,7 @@ test("getConfigFileInput returns input value", async (t) => { .withArgs("config-file") .returns(testInput); }) - .withArgs(repositoryProperties) + .withArgs(repositoryProperties, undefined) .logs(t, "Using configuration file input from workflow") .passes(t.is, testInput); }); @@ -49,16 +50,44 @@ test("getConfigFileInput returns repository property value", async (t) => { // Since there is no direct input, we should use the repository property. await callee(getConfigFileInput) .withFeatures([Feature.ConfigFileRepositoryProperty]) - .withArgs(repositoryProperties) + .withArgs(repositoryProperties, undefined) .logs(t, "Using configuration file input from repository property") .passes(t.is, repositoryProperties[RepositoryPropertyName.CONFIG_FILE]); }); +test("getConfigFileInput returns repository property value for Code Scanning", async (t) => { + // Since there is no direct input, we should use the repository property. + await callee(getConfigFileInput) + .withFeatures([Feature.ConfigFileRepositoryProperty]) + .withArgs(repositoryProperties, [AnalysisKind.CodeScanning]) + .logs(t, "Using configuration file input from repository property") + .passes(t.is, repositoryProperties[RepositoryPropertyName.CONFIG_FILE]); +}); + +test("getConfigFileInput ignores repository property for other analysis kinds", async (t) => { + const unsupportedCases = [ + [AnalysisKind.CodeQuality], + [AnalysisKind.RiskAssessment], + [AnalysisKind.CodeScanning, AnalysisKind.CodeQuality], + ]; + + const target = callee(getConfigFileInput).withFeatures([ + Feature.ConfigFileRepositoryProperty, + ]); + + for (const unsupportedCase of unsupportedCases) { + // Since the analysis kind is unsupported, we should ignore the repository property. + await target + .withArgs(repositoryProperties, unsupportedCase) + .passes(t.is, undefined); + } +}); + test("getConfigFileInput ignores empty repository property value", async (t) => { // Since the repository property value is an empty/whitespace string, we should ignore it. await callee(getConfigFileInput) .withFeatures([Feature.ConfigFileRepositoryProperty]) - .withArgs({ [RepositoryPropertyName.CONFIG_FILE]: " " }) + .withArgs({ [RepositoryPropertyName.CONFIG_FILE]: " " }, undefined) .passes(t.is, undefined); }); @@ -66,7 +95,7 @@ test("getConfigFileInput ignores repository property value when FF is off", asyn // Since the FF is off, we should ignore the repository property value. await callee(getConfigFileInput) .withFeatures([]) - .withArgs(repositoryProperties) + .withArgs(repositoryProperties, undefined) .notLogs(t, "Using configuration file input from repository property") .logs( t, diff --git a/src/config/file.ts b/src/config/file.ts index 8cb7bc3a11..9858328e11 100644 --- a/src/config/file.ts +++ b/src/config/file.ts @@ -1,4 +1,5 @@ import { ActionState } from "../action-common"; +import { AnalysisKind } from "../analyses"; import * as api from "../api-client"; import * as errorMessages from "../error-messages"; import { Feature } from "../feature-flags"; @@ -34,6 +35,7 @@ export async function getConfigFileInput( features, }: ActionState<["Logger", "Actions", "FeatureFlags"]>, repositoryProperties: Partial, + analysisKinds: AnalysisKind[] | undefined, ): Promise { const input = actions.getOptionalInput("config-file"); @@ -45,7 +47,19 @@ export async function getConfigFileInput( const propertyValue = repositoryProperties[RepositoryPropertyName.CONFIG_FILE]; - if (propertyValue !== undefined && propertyValue.trim().length > 0) { + // Only allow the repository property to be used for standard Code Scanning analyses, + // since we don't currently support some customisation options for Code Quality. + // We don't expect customisations for Risk Assessments either. + const analysisKindSupported = + analysisKinds === undefined || + (analysisKinds.includes(AnalysisKind.CodeScanning) && + analysisKinds.length === 1); + + if ( + analysisKindSupported && + propertyValue !== undefined && + propertyValue.trim().length > 0 + ) { // Only use the repository property value if the FF is enabled. const useRepositoryProperty = await features.getValue( Feature.ConfigFileRepositoryProperty, diff --git a/src/init-action.ts b/src/init-action.ts index ec7983b76c..4b52ba6ec6 100644 --- a/src/init-action.ts +++ b/src/init-action.ts @@ -289,6 +289,7 @@ async function run( configFile = await getConfigFileInput( actionStateWithFeatures, repositoryProperties, + analysisKinds, ); // Send a status report indicating that an analysis is starting. From 98c05a17d327d7c4055fca83114434ab56baacf6 Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Tue, 28 Jul 2026 11:51:13 +0100 Subject: [PATCH 56/95] Fix argument validation in `rollback-changelog.ts` Co-authored-by: Mads Navntoft --- pr-checks/rollback-changelog.ts | 27 +++++++++------------------ 1 file changed, 9 insertions(+), 18 deletions(-) diff --git a/pr-checks/rollback-changelog.ts b/pr-checks/rollback-changelog.ts index 6f2edb4b94..15a37b1b7c 100755 --- a/pr-checks/rollback-changelog.ts +++ b/pr-checks/rollback-changelog.ts @@ -50,25 +50,16 @@ export function updateChangelog( function main() { try { - const { values } = parseArgs({ - options: { - "target-version": { - type: "string", - short: "t", - }, - "rollback-version": { - type: "string", - short: "r", - }, - "new-version": { - type: "string", - short: "n", - }, - }, - strict: true, - }); + const options = { + "target-version": { type: "string", short: "t" }, + "rollback-version": { type: "string", short: "r" }, + "new-version": { type: "string", short: "n" }, + } as const; - for (const [key, val] of Object.entries(values)) { + const { values } = parseArgs({ options, strict: true }); + + for (const key of Object.keys(options)) { + const val = values[key as keyof typeof values]; if (val === undefined || val.trim() === "") { throw new Error(`Argument '--${key}' is required.`); } From 2d4c474c2ca5ea2965b9e53fabb7b67b0100016c Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Tue, 28 Jul 2026 12:02:41 +0100 Subject: [PATCH 57/95] Log `!analysisKindSupported` case --- lib/entry-points.js | 8 ++++++-- src/config/file.test.ts | 4 ++++ src/config/file.ts | 12 ++++++------ 3 files changed, 16 insertions(+), 8 deletions(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index 5904ad07ae..46c44a8183 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -148503,15 +148503,19 @@ async function getConfigFileInput({ } const propertyValue = repositoryProperties["github-codeql-config-file" /* CONFIG_FILE */]; const analysisKindSupported = analysisKinds === void 0 || analysisKinds.includes("code-scanning" /* CodeScanning */) && analysisKinds.length === 1; - if (analysisKindSupported && propertyValue !== void 0 && propertyValue.trim().length > 0) { + if (propertyValue !== void 0 && propertyValue.trim().length > 0) { const useRepositoryProperty = await features.getValue( "config_file_repository_property" /* ConfigFileRepositoryProperty */ ); - if (useRepositoryProperty) { + if (analysisKindSupported && useRepositoryProperty) { logger.info( `Using configuration file input from repository property: ${propertyValue}` ); return propertyValue; + } else if (!analysisKindSupported) { + logger.info( + "Ignoring configuration file input from repository property, because it is unsupported for the current analysis kind." + ); } else { logger.info( "Ignoring configuration file input from repository property, because the corresponding feature flag is disabled." diff --git a/src/config/file.test.ts b/src/config/file.test.ts index 17ac21d565..0833ad3d06 100644 --- a/src/config/file.test.ts +++ b/src/config/file.test.ts @@ -79,6 +79,10 @@ test("getConfigFileInput ignores repository property for other analysis kinds", // Since the analysis kind is unsupported, we should ignore the repository property. await target .withArgs(repositoryProperties, unsupportedCase) + .logs( + t, + "Ignoring configuration file input from repository property, because it is unsupported for the current analysis kind.", + ) .passes(t.is, undefined); } }); diff --git a/src/config/file.ts b/src/config/file.ts index 9858328e11..be0e415a38 100644 --- a/src/config/file.ts +++ b/src/config/file.ts @@ -55,21 +55,21 @@ export async function getConfigFileInput( (analysisKinds.includes(AnalysisKind.CodeScanning) && analysisKinds.length === 1); - if ( - analysisKindSupported && - propertyValue !== undefined && - propertyValue.trim().length > 0 - ) { + if (propertyValue !== undefined && propertyValue.trim().length > 0) { // Only use the repository property value if the FF is enabled. const useRepositoryProperty = await features.getValue( Feature.ConfigFileRepositoryProperty, ); - if (useRepositoryProperty) { + if (analysisKindSupported && useRepositoryProperty) { logger.info( `Using configuration file input from repository property: ${propertyValue}`, ); return propertyValue; + } else if (!analysisKindSupported) { + logger.info( + "Ignoring configuration file input from repository property, because it is unsupported for the current analysis kind.", + ); } else { logger.info( "Ignoring configuration file input from repository property, because the corresponding feature flag is disabled.", From 1f9caf0118e0ac28ca8795236cb9d8db9c5c4658 Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Tue, 28 Jul 2026 18:37:01 +0100 Subject: [PATCH 58/95] Refactor `jobRunUuid` init into a function Use in `init` and `setup-codeql` actions --- lib/entry-points.js | 102 +++++++++++++++++++------------------ src/init-action.ts | 6 +-- src/setup-codeql-action.ts | 7 ++- src/status-report.ts | 13 +++++ 4 files changed, 70 insertions(+), 58 deletions(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index 46c44a8183..287d8a127e 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -145728,6 +145728,50 @@ function formatDuration(durationMs) { var os3 = __toESM(require("os")); var core7 = __toESM(require_core()); +// node_modules/uuid/dist-node/stringify.js +var byteToHex = []; +for (let i = 0; i < 256; ++i) { + byteToHex.push((i + 256).toString(16).slice(1)); +} +function unsafeStringify(arr, offset = 0) { + return (byteToHex[arr[offset + 0]] + byteToHex[arr[offset + 1]] + byteToHex[arr[offset + 2]] + byteToHex[arr[offset + 3]] + "-" + byteToHex[arr[offset + 4]] + byteToHex[arr[offset + 5]] + "-" + byteToHex[arr[offset + 6]] + byteToHex[arr[offset + 7]] + "-" + byteToHex[arr[offset + 8]] + byteToHex[arr[offset + 9]] + "-" + byteToHex[arr[offset + 10]] + byteToHex[arr[offset + 11]] + byteToHex[arr[offset + 12]] + byteToHex[arr[offset + 13]] + byteToHex[arr[offset + 14]] + byteToHex[arr[offset + 15]]).toLowerCase(); +} + +// node_modules/uuid/dist-node/rng.js +var rnds8 = new Uint8Array(16); +function rng() { + return crypto.getRandomValues(rnds8); +} + +// node_modules/uuid/dist-node/v4.js +function v4(options, buf, offset) { + if (!buf && !options && crypto.randomUUID) { + return crypto.randomUUID(); + } + return _v4(options, buf, offset); +} +function _v4(options, buf, offset) { + options = options || {}; + const rnds = options.random ?? options.rng?.() ?? rng(); + if (rnds.length < 16) { + throw new Error("Random bytes length must be >= 16"); + } + rnds[6] = rnds[6] & 15 | 64; + rnds[8] = rnds[8] & 63 | 128; + if (buf) { + offset = offset || 0; + if (offset < 0 || offset + 16 > buf.length) { + throw new RangeError(`UUID byte range ${offset}:${offset + 15} is out of buffer bounds`); + } + for (let i = 0; i < 16; ++i) { + buf[offset + i] = rnds[i]; + } + return buf; + } + return unsafeStringify(rnds); +} +var v4_default = v4; + // src/api-client.ts var core5 = __toESM(require_core()); var githubUtils = __toESM(require_utils4()); @@ -146346,6 +146390,12 @@ function getDisplayActionName(actionName) { } return actionName; } +function getJobUUID(logger) { + const jobRunUuid = v4_default(); + logger.info(`Job run UUID is ${jobRunUuid}.`); + core7.exportVariable("JOB_RUN_UUID" /* JOB_RUN_UUID */, jobRunUuid); + return jobRunUuid; +} function isFirstPartyAnalysis(actionName) { if (actionName !== "upload-sarif" /* UploadSarif */) { return true; @@ -150068,50 +150118,6 @@ var toolcache3 = __toESM(require_tool_cache()); var import_fast_deep_equal = __toESM(require_fast_deep_equal()); var semver9 = __toESM(require_semver2()); -// node_modules/uuid/dist-node/stringify.js -var byteToHex = []; -for (let i = 0; i < 256; ++i) { - byteToHex.push((i + 256).toString(16).slice(1)); -} -function unsafeStringify(arr, offset = 0) { - return (byteToHex[arr[offset + 0]] + byteToHex[arr[offset + 1]] + byteToHex[arr[offset + 2]] + byteToHex[arr[offset + 3]] + "-" + byteToHex[arr[offset + 4]] + byteToHex[arr[offset + 5]] + "-" + byteToHex[arr[offset + 6]] + byteToHex[arr[offset + 7]] + "-" + byteToHex[arr[offset + 8]] + byteToHex[arr[offset + 9]] + "-" + byteToHex[arr[offset + 10]] + byteToHex[arr[offset + 11]] + byteToHex[arr[offset + 12]] + byteToHex[arr[offset + 13]] + byteToHex[arr[offset + 14]] + byteToHex[arr[offset + 15]]).toLowerCase(); -} - -// node_modules/uuid/dist-node/rng.js -var rnds8 = new Uint8Array(16); -function rng() { - return crypto.getRandomValues(rnds8); -} - -// node_modules/uuid/dist-node/v4.js -function v4(options, buf, offset) { - if (!buf && !options && crypto.randomUUID) { - return crypto.randomUUID(); - } - return _v4(options, buf, offset); -} -function _v4(options, buf, offset) { - options = options || {}; - const rnds = options.random ?? options.rng?.() ?? rng(); - if (rnds.length < 16) { - throw new Error("Random bytes length must be >= 16"); - } - rnds[6] = rnds[6] & 15 | 64; - rnds[8] = rnds[8] & 63 | 128; - if (buf) { - offset = offset || 0; - if (offset < 0 || offset + 16 > buf.length) { - throw new RangeError(`UUID byte range ${offset}:${offset + 15} is out of buffer bounds`); - } - for (let i = 0; i < 16; ++i) { - buf[offset + i] = rnds[i]; - } - return buf; - } - return unsafeStringify(rnds); -} -var v4_default = v4; - // src/overlay/caching.ts var fs10 = __toESM(require("fs")); var actionsCache3 = __toESM(require_cache4()); @@ -160751,9 +160757,7 @@ async function run3(actionState) { logger ); const repositoryProperties = repositoryPropertiesResult.orElse({}); - const jobRunUuid = v4_default(); - logger.info(`Job run UUID is ${jobRunUuid}.`); - core21.exportVariable("JOB_RUN_UUID" /* JOB_RUN_UUID */, jobRunUuid); + getJobUUID(logger); core21.exportVariable("CODEQL_ACTION_INIT_HAS_RUN" /* INIT_ACTION_HAS_RUN */, "true"); sourceRoot = path24.resolve( getRequiredEnvParam("GITHUB_WORKSPACE"), @@ -161751,9 +161755,7 @@ async function run6(actionState) { ); const repositoryProperties = repositoryPropertiesResult.orElse({}); const actionStateWithFeatures = { ...actionState, features }; - const jobRunUuid = v4_default(); - logger.info(`Job run UUID is ${jobRunUuid}.`); - core24.exportVariable("JOB_RUN_UUID" /* JOB_RUN_UUID */, jobRunUuid); + getJobUUID(logger); const statusReportBase = await createStatusReportBase( "setup-codeql" /* SetupCodeQL */, "starting", diff --git a/src/init-action.ts b/src/init-action.ts index 4b52ba6ec6..a2ae0918be 100644 --- a/src/init-action.ts +++ b/src/init-action.ts @@ -4,7 +4,6 @@ import * as path from "path"; import * as core from "@actions/core"; import * as io from "@actions/io"; import * as semver from "semver"; -import { v4 as uuidV4 } from "uuid"; import { Action, ActionState, runInActions } from "./action-common"; import { @@ -69,6 +68,7 @@ import { createInitWithConfigStatusReport, createStatusReportBase, getActionsStatus, + getJobUUID, sendStatusReport, } from "./status-report"; import { ToolsDownloadStatusReport } from "./tools-download"; @@ -256,9 +256,7 @@ async function run( const repositoryProperties = repositoryPropertiesResult.orElse({}); // Create a unique identifier for this run. - const jobRunUuid = uuidV4(); - logger.info(`Job run UUID is ${jobRunUuid}.`); - core.exportVariable(EnvVar.JOB_RUN_UUID, jobRunUuid); + getJobUUID(logger); core.exportVariable(EnvVar.INIT_ACTION_HAS_RUN, "true"); diff --git a/src/setup-codeql-action.ts b/src/setup-codeql-action.ts index b2a9e90f36..810931f672 100644 --- a/src/setup-codeql-action.ts +++ b/src/setup-codeql-action.ts @@ -1,5 +1,4 @@ import * as core from "@actions/core"; -import { v4 as uuidV4 } from "uuid"; import { Action, ActionState, runInActions } from "./action-common"; import { @@ -26,6 +25,7 @@ import { InitToolsDownloadFields, createStatusReportBase, getActionsStatus, + getJobUUID, sendStatusReport, } from "./status-report"; import { ToolsDownloadStatusReport } from "./tools-download"; @@ -140,9 +140,8 @@ async function run( const actionStateWithFeatures = { ...actionState, features }; - const jobRunUuid = uuidV4(); - logger.info(`Job run UUID is ${jobRunUuid}.`); - core.exportVariable(EnvVar.JOB_RUN_UUID, jobRunUuid); + // Create a unique identifier for this run. + getJobUUID(logger); const statusReportBase = await createStatusReportBase( ActionName.SetupCodeQL, diff --git a/src/status-report.ts b/src/status-report.ts index d9d2a7ba4c..13cfe8ac39 100644 --- a/src/status-report.ts +++ b/src/status-report.ts @@ -1,6 +1,7 @@ import * as os from "os"; import * as core from "@actions/core"; +import { v4 as uuidV4 } from "uuid"; import { getWorkflowEventName, @@ -59,6 +60,18 @@ export function getDisplayActionName(actionName: ActionName): string { return actionName; } +/** + * Creates a UUIDv4 for the analysis and returns it. + * The generated UUID is also exported as an environment variable. + */ +export function getJobUUID(logger: Logger) { + const jobRunUuid = uuidV4(); + logger.info(`Job run UUID is ${jobRunUuid}.`); + + core.exportVariable(EnvVar.JOB_RUN_UUID, jobRunUuid); + return jobRunUuid; +} + /** * @returns a boolean indicating whether the analysis is considered to be first party. * From c7ae51bb2daea524f6967b00fec6cceaa7b607b5 Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Tue, 28 Jul 2026 18:41:41 +0100 Subject: [PATCH 59/95] Make `ActionState` available and add test --- src/init-action.ts | 2 +- src/setup-codeql-action.ts | 4 ++-- src/status-report.test.ts | 9 +++++++++ src/status-report.ts | 5 +++-- 4 files changed, 15 insertions(+), 5 deletions(-) diff --git a/src/init-action.ts b/src/init-action.ts index a2ae0918be..f1c3916318 100644 --- a/src/init-action.ts +++ b/src/init-action.ts @@ -256,7 +256,7 @@ async function run( const repositoryProperties = repositoryPropertiesResult.orElse({}); // Create a unique identifier for this run. - getJobUUID(logger); + getJobUUID(actionState); core.exportVariable(EnvVar.INIT_ACTION_HAS_RUN, "true"); diff --git a/src/setup-codeql-action.ts b/src/setup-codeql-action.ts index 810931f672..d2f8c6104b 100644 --- a/src/setup-codeql-action.ts +++ b/src/setup-codeql-action.ts @@ -95,7 +95,7 @@ async function sendCompletedStatusReport( /** The main behaviour of this action. */ async function run( - actionState: ActionState<["Base", "Logger", "Actions"]>, + actionState: ActionState<["Base", "Logger", "Env", "Actions"]>, ): Promise { // To capture errors appropriately, keep as much code within the try-catch as // possible, and only use safe functions outside. @@ -141,7 +141,7 @@ async function run( const actionStateWithFeatures = { ...actionState, features }; // Create a unique identifier for this run. - getJobUUID(logger); + getJobUUID(actionState); const statusReportBase = await createStatusReportBase( ActionName.SetupCodeQL, diff --git a/src/status-report.test.ts b/src/status-report.test.ts index 9086dd34ef..0d8fe8108e 100644 --- a/src/status-report.test.ts +++ b/src/status-report.test.ts @@ -1,5 +1,6 @@ import test from "ava"; import * as sinon from "sinon"; +import * as uuid from "uuid"; import * as actionsUtil from "./actions-util"; import { Config } from "./config-utils"; @@ -12,6 +13,7 @@ import { createInitWithConfigStatusReport, createStatusReportBase, getActionsStatus, + getJobUUID, InitStatusReport, InitWithConfigStatusReport, } from "./status-report"; @@ -20,11 +22,18 @@ import { setupActionsVars, createTestConfig, makeMacro, + callee, } from "./testing-utils"; import { BuildMode, ConfigurationError, withTmpDir, wrapError } from "./util"; setupTests(test); +test("getJobUUID - generates valid UUIDs", async (t) => { + await callee(getJobUUID) + .withArgs() + .passes((val) => t.true(uuid.validate(val))); +}); + function setupEnvironmentAndStub(tmpDir: string) { setupActionsVars(tmpDir, tmpDir, { GITHUB_EVENT_NAME: "dynamic", diff --git a/src/status-report.ts b/src/status-report.ts index 13cfe8ac39..08cb05ff93 100644 --- a/src/status-report.ts +++ b/src/status-report.ts @@ -3,6 +3,7 @@ import * as os from "os"; import * as core from "@actions/core"; import { v4 as uuidV4 } from "uuid"; +import type { ActionState } from "./action-common"; import { getWorkflowEventName, getOptionalInput, @@ -64,9 +65,9 @@ export function getDisplayActionName(actionName: ActionName): string { * Creates a UUIDv4 for the analysis and returns it. * The generated UUID is also exported as an environment variable. */ -export function getJobUUID(logger: Logger) { +export function getJobUUID(action: ActionState<["Logger", "ReadOnlyEnv"]>) { const jobRunUuid = uuidV4(); - logger.info(`Job run UUID is ${jobRunUuid}.`); + action.logger.info(`Job run UUID is ${jobRunUuid}.`); core.exportVariable(EnvVar.JOB_RUN_UUID, jobRunUuid); return jobRunUuid; From 049af32c592249a000289bd518b3592923901db3 Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Tue, 28 Jul 2026 18:47:23 +0100 Subject: [PATCH 60/95] Allow `getJobUUID` to retrieve the UUID from the environment --- lib/entry-points.js | 38 ++++++++++++++++++++++++++------------ src/status-report.test.ts | 12 ++++++++++++ src/status-report.ts | 18 ++++++++++++++---- 3 files changed, 52 insertions(+), 16 deletions(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index 287d8a127e..ade2488356 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -30477,7 +30477,7 @@ var require_validator = __commonJS({ Validator3.prototype.getSchema = function getSchema(urn) { return this.schemas[urn]; }; - Validator3.prototype.validate = function validate(instance, schema, options, ctx) { + Validator3.prototype.validate = function validate2(instance, schema, options, ctx) { if (typeof schema !== "boolean" && typeof schema !== "object" || schema === null) { throw new SchemaError("Expected `schema` to be an object or boolean"); } @@ -144595,24 +144595,24 @@ function isNumber(value) { function isStringOrUndefined(value) { return value === void 0 || isString(value); } -function defaultCheck(validate) { - return (arg) => ({ unknownKeys: [], invalidKeys: [], valid: validate(arg) }); +function defaultCheck(validate2) { + return (arg) => ({ unknownKeys: [], invalidKeys: [], valid: validate2(arg) }); } -function makeValidator(validate, required = true) { +function makeValidator(validate2, required = true) { return { - validate, - check: defaultCheck(validate), + validate: validate2, + check: defaultCheck(validate2), required }; } var string = makeValidator(isString); var number = makeValidator(isNumber); function array(validator) { - const validate = (val) => { + const validate2 = (val) => { return isArray(val) && val.every((e) => validator.validate(e)); }; return { - validate, + validate: validate2, check: (val, opts, path29) => { const result = successfulCheckSchema(); if (!isArray(val)) { @@ -145728,6 +145728,15 @@ function formatDuration(durationMs) { var os3 = __toESM(require("os")); var core7 = __toESM(require_core()); +// node_modules/uuid/dist-node/regex.js +var regex_default = /^(?:[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$/i; + +// node_modules/uuid/dist-node/validate.js +function validate(uuid) { + return typeof uuid === "string" && regex_default.test(uuid); +} +var validate_default = validate; + // node_modules/uuid/dist-node/stringify.js var byteToHex = []; for (let i = 0; i < 256; ++i) { @@ -146390,9 +146399,14 @@ function getDisplayActionName(actionName) { } return actionName; } -function getJobUUID(logger) { +function getJobUUID(action) { + const existingJobRunUuid = action.env.getOptional("JOB_RUN_UUID" /* JOB_RUN_UUID */); + if (existingJobRunUuid !== void 0 && validate_default(existingJobRunUuid)) { + action.logger.info(`Existing job run UUID is ${existingJobRunUuid}.`); + return existingJobRunUuid; + } const jobRunUuid = v4_default(); - logger.info(`Job run UUID is ${jobRunUuid}.`); + action.logger.info(`Job run UUID is ${jobRunUuid}.`); core7.exportVariable("JOB_RUN_UUID" /* JOB_RUN_UUID */, jobRunUuid); return jobRunUuid; } @@ -160757,7 +160771,7 @@ async function run3(actionState) { logger ); const repositoryProperties = repositoryPropertiesResult.orElse({}); - getJobUUID(logger); + getJobUUID(actionState); core21.exportVariable("CODEQL_ACTION_INIT_HAS_RUN" /* INIT_ACTION_HAS_RUN */, "true"); sourceRoot = path24.resolve( getRequiredEnvParam("GITHUB_WORKSPACE"), @@ -161755,7 +161769,7 @@ async function run6(actionState) { ); const repositoryProperties = repositoryPropertiesResult.orElse({}); const actionStateWithFeatures = { ...actionState, features }; - getJobUUID(logger); + getJobUUID(actionState); const statusReportBase = await createStatusReportBase( "setup-codeql" /* SetupCodeQL */, "starting", diff --git a/src/status-report.test.ts b/src/status-report.test.ts index 0d8fe8108e..6f2c0164b1 100644 --- a/src/status-report.test.ts +++ b/src/status-report.test.ts @@ -31,9 +31,21 @@ setupTests(test); test("getJobUUID - generates valid UUIDs", async (t) => { await callee(getJobUUID) .withArgs() + .logs(t, "Job run UUID is ") .passes((val) => t.true(uuid.validate(val))); }); +test("getJobUUID - retrieves existing job UUIDs", async (t) => { + const existingJobUuid = uuid.v4(); + await callee(getJobUUID) + .withArgs() + .withEnv((env) => { + env.set(EnvVar.JOB_RUN_UUID, existingJobUuid); + }) + .logs(t, `Existing job run UUID is ${existingJobUuid}.`) + .passes(t.deepEqual, existingJobUuid); +}); + function setupEnvironmentAndStub(tmpDir: string) { setupActionsVars(tmpDir, tmpDir, { GITHUB_EVENT_NAME: "dynamic", diff --git a/src/status-report.ts b/src/status-report.ts index 08cb05ff93..ae1e0172ce 100644 --- a/src/status-report.ts +++ b/src/status-report.ts @@ -1,7 +1,7 @@ import * as os from "os"; import * as core from "@actions/core"; -import { v4 as uuidV4 } from "uuid"; +import * as uuid from "uuid"; import type { ActionState } from "./action-common"; import { @@ -62,11 +62,21 @@ export function getDisplayActionName(actionName: ActionName): string { } /** - * Creates a UUIDv4 for the analysis and returns it. - * The generated UUID is also exported as an environment variable. + * Either creates a UUIDv4 for the analysis or retrieves an existing one from the + * environment and returns it. + * If a new UUID is generated, it is also exported as an environment variable. */ export function getJobUUID(action: ActionState<["Logger", "ReadOnlyEnv"]>) { - const jobRunUuid = uuidV4(); + // Check if we already have a UUID for the analysis and return it if so. + const existingJobRunUuid = action.env.getOptional(EnvVar.JOB_RUN_UUID); + + if (existingJobRunUuid !== undefined && uuid.validate(existingJobRunUuid)) { + action.logger.info(`Existing job run UUID is ${existingJobRunUuid}.`); + return existingJobRunUuid; + } + + // Otherwise generate a new UUID. + const jobRunUuid = uuid.v4(); action.logger.info(`Job run UUID is ${jobRunUuid}.`); core.exportVariable(EnvVar.JOB_RUN_UUID, jobRunUuid); From 766928d055114dfca04d7ad722bbc9fe4b928c3e Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Tue, 28 Jul 2026 18:50:56 +0100 Subject: [PATCH 61/95] Call `getJobUUID` in `start-proxy` The `start-proxy` step precedes `init` in Default Setup --- lib/entry-points.js | 5 +++++ src/start-proxy-action.ts | 16 +++++++++++++++- 2 files changed, 20 insertions(+), 1 deletion(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index ade2488356..6eee65e05d 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -162645,6 +162645,11 @@ async function run7(startedAt) { let features; let language; try { + const action = { + logger, + env: new Env(process.env) + }; + getJobUUID(action); persistInputs(); const tempDir = getTemporaryDirectory(); const proxyLogFilePath = path28.resolve(tempDir, "proxy.log"); diff --git a/src/start-proxy-action.ts b/src/start-proxy-action.ts index 3e376ec64f..9da2069df9 100644 --- a/src/start-proxy-action.ts +++ b/src/start-proxy-action.ts @@ -3,8 +3,10 @@ import * as path from "path"; import * as core from "@actions/core"; +import { ActionState } from "./action-common"; import * as actionsUtil from "./actions-util"; import { getGitHubVersion } from "./api-client"; +import { Env } from "./environment"; import { FeatureEnablement, initFeatures } from "./feature-flags"; import { BuiltInLanguage, parseBuiltInLanguage } from "./languages"; import { getActionsLogger, Logger } from "./logging"; @@ -23,7 +25,11 @@ import { import { generateCertificateAuthority } from "./start-proxy/ca"; import { checkProxyEnvironment } from "./start-proxy/environment"; import { checkConnections } from "./start-proxy/reachability"; -import { ActionName, sendUnhandledErrorStatusReport } from "./status-report"; +import { + ActionName, + getJobUUID, + sendUnhandledErrorStatusReport, +} from "./status-report"; import * as util from "./util"; async function run(startedAt: Date) { @@ -35,6 +41,14 @@ async function run(startedAt: Date) { let language: BuiltInLanguage | undefined; try { + const action: ActionState<["Logger", "Env"]> = { + logger, + env: new Env(process.env), + }; + + // Create a unique identifier for this run. + getJobUUID(action); + // Make inputs accessible in the `post` step. actionsUtil.persistInputs(); From e9831f72a27e863fb32ccac5d65261114809b6fd Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Fri, 24 Jul 2026 17:40:26 +0100 Subject: [PATCH 62/95] Add `getRequiredInput` to `ActionsEnv` --- lib/entry-points.js | 2 +- src/actions-util.ts | 3 ++- src/testing-utils.ts | 3 +++ 3 files changed, 6 insertions(+), 2 deletions(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index 6eee65e05d..35a0b20922 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -145383,7 +145383,7 @@ var Failure = class { // src/actions-util.ts function getActionsEnv() { - return { getOptionalInput }; + return { getRequiredInput, getOptionalInput }; } var getRequiredInput = function(name) { const value = core3.getInput(name); diff --git a/src/actions-util.ts b/src/actions-util.ts index 5fd1ebc4fe..6731f8ef4e 100644 --- a/src/actions-util.ts +++ b/src/actions-util.ts @@ -27,6 +27,7 @@ declare const __CODEQL_ACTION_VERSION__: string; * global functions in tests. */ export interface ActionsEnv { + getRequiredInput: (name: string) => string; getOptionalInput: (name: string) => string | undefined; } @@ -34,7 +35,7 @@ export interface ActionsEnv { * Gets the real `ActionsEnv` used by production code. */ export function getActionsEnv(): ActionsEnv { - return { getOptionalInput }; + return { getRequiredInput, getOptionalInput }; } /** diff --git a/src/testing-utils.ts b/src/testing-utils.ts index 03354653ac..e4fb9adf6f 100644 --- a/src/testing-utils.ts +++ b/src/testing-utils.ts @@ -187,6 +187,9 @@ export function getTestEnv(testEnv: NodeJS.ProcessEnv = {}): Env { */ export function getTestActionsEnv(): ActionsEnv { return { + getRequiredInput: (name) => { + throw new Error(`Input required and not supplied: ${name}`); + }, getOptionalInput: () => undefined, }; } From 60834a0cd9645a12daf4e2e76f667afb0f4cbed2 Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Fri, 24 Jul 2026 22:02:49 +0100 Subject: [PATCH 63/95] Add `exportVariable` to `ActionsEnv` --- lib/entry-points.js | 14 +++++++++----- src/actions-util.ts | 7 ++++++- src/testing-utils.ts | 1 + 3 files changed, 16 insertions(+), 6 deletions(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index 35a0b20922..7ad13ddc55 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -21559,7 +21559,7 @@ var require_core = __commonJS({ }; Object.defineProperty(exports2, "__esModule", { value: true }); exports2.platform = exports2.toPlatformPath = exports2.toWin32Path = exports2.toPosixPath = exports2.markdownSummary = exports2.summary = exports2.ExitCode = void 0; - exports2.exportVariable = exportVariable15; + exports2.exportVariable = exportVariable16; exports2.setSecret = setSecret2; exports2.addPath = addPath2; exports2.getInput = getInput2; @@ -21591,7 +21591,7 @@ var require_core = __commonJS({ ExitCode2[ExitCode2["Success"] = 0] = "Success"; ExitCode2[ExitCode2["Failure"] = 1] = "Failure"; })(ExitCode || (exports2.ExitCode = ExitCode = {})); - function exportVariable15(name, val) { + function exportVariable16(name, val) { const convertedVal = (0, utils_1.toCommandValue)(val); process.env[name] = convertedVal; const filePath = process.env["GITHUB_ENV"] || ""; @@ -121026,7 +121026,7 @@ var require_core3 = __commonJS({ ExitCode2[ExitCode2["Success"] = 0] = "Success"; ExitCode2[ExitCode2["Failure"] = 1] = "Failure"; })(ExitCode || (exports2.ExitCode = ExitCode = {})); - function exportVariable15(name, val) { + function exportVariable16(name, val) { const convertedVal = (0, utils_1.toCommandValue)(val); process.env[name] = convertedVal; const filePath = process.env["GITHUB_ENV"] || ""; @@ -121035,7 +121035,7 @@ var require_core3 = __commonJS({ } (0, command_1.issueCommand)("set-env", { name }, convertedVal); } - exports2.exportVariable = exportVariable15; + exports2.exportVariable = exportVariable16; function setSecret2(secret) { (0, command_1.issueCommand)("add-mask", {}, secret); } @@ -145383,7 +145383,11 @@ var Failure = class { // src/actions-util.ts function getActionsEnv() { - return { getRequiredInput, getOptionalInput }; + return { + getRequiredInput, + getOptionalInput, + exportVariable: core3.exportVariable + }; } var getRequiredInput = function(name) { const value = core3.getInput(name); diff --git a/src/actions-util.ts b/src/actions-util.ts index 6731f8ef4e..dd5124620d 100644 --- a/src/actions-util.ts +++ b/src/actions-util.ts @@ -29,13 +29,18 @@ declare const __CODEQL_ACTION_VERSION__: string; export interface ActionsEnv { getRequiredInput: (name: string) => string; getOptionalInput: (name: string) => string | undefined; + exportVariable: (name: string, value: string) => void; } /** * Gets the real `ActionsEnv` used by production code. */ export function getActionsEnv(): ActionsEnv { - return { getRequiredInput, getOptionalInput }; + return { + getRequiredInput, + getOptionalInput, + exportVariable: core.exportVariable, + }; } /** diff --git a/src/testing-utils.ts b/src/testing-utils.ts index e4fb9adf6f..4402458d82 100644 --- a/src/testing-utils.ts +++ b/src/testing-utils.ts @@ -191,6 +191,7 @@ export function getTestActionsEnv(): ActionsEnv { throw new Error(`Input required and not supplied: ${name}`); }, getOptionalInput: () => undefined, + exportVariable: () => {}, }; } From e28cbacfa115612a23d42a9425bfa0aa072443df Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Tue, 28 Jul 2026 19:13:35 +0100 Subject: [PATCH 64/95] Test that `getJobUUID` calls `exportVariable` --- lib/entry-points.js | 5 +++-- src/start-proxy-action.ts | 3 ++- src/status-report.test.ts | 14 +++++++++++++- src/status-report.ts | 6 ++++-- 4 files changed, 22 insertions(+), 6 deletions(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index 7ad13ddc55..0bc32b8bfa 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -146411,7 +146411,7 @@ function getJobUUID(action) { } const jobRunUuid = v4_default(); action.logger.info(`Job run UUID is ${jobRunUuid}.`); - core7.exportVariable("JOB_RUN_UUID" /* JOB_RUN_UUID */, jobRunUuid); + action.actions.exportVariable("JOB_RUN_UUID" /* JOB_RUN_UUID */, jobRunUuid); return jobRunUuid; } function isFirstPartyAnalysis(actionName) { @@ -162651,7 +162651,8 @@ async function run7(startedAt) { try { const action = { logger, - env: new Env(process.env) + env: new Env(process.env), + actions: getActionsEnv() }; getJobUUID(action); persistInputs(); diff --git a/src/start-proxy-action.ts b/src/start-proxy-action.ts index 9da2069df9..ee587c04df 100644 --- a/src/start-proxy-action.ts +++ b/src/start-proxy-action.ts @@ -41,9 +41,10 @@ async function run(startedAt: Date) { let language: BuiltInLanguage | undefined; try { - const action: ActionState<["Logger", "Env"]> = { + const action: ActionState<["Logger", "Env", "Actions"]> = { logger, env: new Env(process.env), + actions: actionsUtil.getActionsEnv(), }; // Create a unique identifier for this run. diff --git a/src/status-report.test.ts b/src/status-report.test.ts index 6f2c0164b1..efe272faeb 100644 --- a/src/status-report.test.ts +++ b/src/status-report.test.ts @@ -29,10 +29,22 @@ import { BuildMode, ConfigurationError, withTmpDir, wrapError } from "./util"; setupTests(test); test("getJobUUID - generates valid UUIDs", async (t) => { + const exportVariableStub: sinon.SinonStub<[string, string], void> = + sinon.stub(); + await callee(getJobUUID) .withArgs() + .withActions((env) => { + env.exportVariable = exportVariableStub; + }) .logs(t, "Job run UUID is ") - .passes((val) => t.true(uuid.validate(val))); + .passes((val) => { + t.true(uuid.validate(val)); + + const calls = exportVariableStub.getCalls(); + t.is(calls.length, 1); + t.deepEqual(calls[0].args, [EnvVar.JOB_RUN_UUID, val]); + }); }); test("getJobUUID - retrieves existing job UUIDs", async (t) => { diff --git a/src/status-report.ts b/src/status-report.ts index ae1e0172ce..69cac8a05d 100644 --- a/src/status-report.ts +++ b/src/status-report.ts @@ -66,7 +66,9 @@ export function getDisplayActionName(actionName: ActionName): string { * environment and returns it. * If a new UUID is generated, it is also exported as an environment variable. */ -export function getJobUUID(action: ActionState<["Logger", "ReadOnlyEnv"]>) { +export function getJobUUID( + action: ActionState<["Logger", "ReadOnlyEnv", "Actions"]>, +) { // Check if we already have a UUID for the analysis and return it if so. const existingJobRunUuid = action.env.getOptional(EnvVar.JOB_RUN_UUID); @@ -79,7 +81,7 @@ export function getJobUUID(action: ActionState<["Logger", "ReadOnlyEnv"]>) { const jobRunUuid = uuid.v4(); action.logger.info(`Job run UUID is ${jobRunUuid}.`); - core.exportVariable(EnvVar.JOB_RUN_UUID, jobRunUuid); + action.actions.exportVariable(EnvVar.JOB_RUN_UUID, jobRunUuid); return jobRunUuid; } From 94a12eb6f6fa716ef39d1cd9c61231f08577b870 Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Tue, 28 Jul 2026 19:14:57 +0100 Subject: [PATCH 65/95] Add a test for invalid values --- src/status-report.test.ts | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/src/status-report.test.ts b/src/status-report.test.ts index efe272faeb..9d0c62efb1 100644 --- a/src/status-report.test.ts +++ b/src/status-report.test.ts @@ -58,6 +58,18 @@ test("getJobUUID - retrieves existing job UUIDs", async (t) => { .passes(t.deepEqual, existingJobUuid); }); +test("getJobUUID - doesn't retrieve invalid UUIDs", async (t) => { + const existingJobUuid = "not-a-uuid"; + await callee(getJobUUID) + .withArgs() + .withEnv((env) => { + env.set(EnvVar.JOB_RUN_UUID, existingJobUuid); + }) + .logs(t, `Job run UUID is `) + .notLogs(t, `Existing job run UUID is ${existingJobUuid}.`) + .passes(t.notDeepEqual, existingJobUuid); +}); + function setupEnvironmentAndStub(tmpDir: string) { setupActionsVars(tmpDir, tmpDir, { GITHUB_EVENT_NAME: "dynamic", From 2e251072b0a905f36699df95f6deabbff6a6ec5a Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Wed, 29 Jul 2026 10:19:14 +0100 Subject: [PATCH 66/95] Use `getEnv()` --- lib/entry-points.js | 2 +- src/start-proxy-action.ts | 3 +-- 2 files changed, 2 insertions(+), 3 deletions(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index 0bc32b8bfa..0f35b11dfd 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -162651,7 +162651,7 @@ async function run7(startedAt) { try { const action = { logger, - env: new Env(process.env), + env: getEnv(), actions: getActionsEnv() }; getJobUUID(action); diff --git a/src/start-proxy-action.ts b/src/start-proxy-action.ts index ee587c04df..67f6d50177 100644 --- a/src/start-proxy-action.ts +++ b/src/start-proxy-action.ts @@ -6,7 +6,6 @@ import * as core from "@actions/core"; import { ActionState } from "./action-common"; import * as actionsUtil from "./actions-util"; import { getGitHubVersion } from "./api-client"; -import { Env } from "./environment"; import { FeatureEnablement, initFeatures } from "./feature-flags"; import { BuiltInLanguage, parseBuiltInLanguage } from "./languages"; import { getActionsLogger, Logger } from "./logging"; @@ -43,7 +42,7 @@ async function run(startedAt: Date) { try { const action: ActionState<["Logger", "Env", "Actions"]> = { logger, - env: new Env(process.env), + env: util.getEnv(), actions: actionsUtil.getActionsEnv(), }; From de57c4a441d83a777b077184c67bfa79f5bd4457 Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Wed, 29 Jul 2026 10:38:08 +0100 Subject: [PATCH 67/95] Move `registry_types` to `StatusReportBase` --- src/start-proxy.ts | 8 +------- src/status-report.ts | 6 ++++++ 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/src/start-proxy.ts b/src/start-proxy.ts index 74e0b498c4..caa1b3054a 100644 --- a/src/start-proxy.ts +++ b/src/start-proxy.ts @@ -83,12 +83,6 @@ export class StartProxyError extends Error { } } -interface StartProxyStatus extends StatusReportBase { - // A comma-separated list of registry types which are configured for CodeQL. - // This only includes registry types we support, not all that are configured. - registry_types: string; -} - /** * Sends a status report for the `start-proxy` action indicating a successful outcome. * @@ -112,7 +106,7 @@ export async function sendSuccessStatusReport( logger, ); if (statusReportBase !== undefined) { - const statusReport: StartProxyStatus = { + const statusReport: StatusReportBase = { ...statusReportBase, registry_types: registry_types.join(","), }; diff --git a/src/status-report.ts b/src/status-report.ts index d9d2a7ba4c..c61bbb828b 100644 --- a/src/status-report.ts +++ b/src/status-report.ts @@ -159,6 +159,12 @@ export interface StatusReportBase { ml_powered_javascript_queries?: string; /** Ref that the workflow was triggered on. */ ref: string; + /** + * A comma-separated list of private registry types which are configured for CodeQL. + * This only includes registry types we support (as determined by the `start-proxy` action), + * not all that are configured. + */ + registry_types?: string; /** Action runner hardware architecture (context runner.arch). */ runner_arch?: string; /** Available disk space on the runner, in bytes. */ From aac07d2a4154cf30c74193cd5c01955a5a0d817e Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Wed, 29 Jul 2026 10:55:46 +0100 Subject: [PATCH 68/95] Include `registry_types` whenever `CODEQL_PROXY_URLS` is set --- lib/entry-points.js | 17 ++++++++++++++ src/status-report.test.ts | 47 ++++++++++++++++++++++++++++++++++++++- src/status-report.ts | 33 ++++++++++++++++++++++++++- 3 files changed, 95 insertions(+), 2 deletions(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index 46c44a8183..24a7eb5c70 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -146396,6 +146396,22 @@ function setJobStatusIfUnsuccessful(actionStatus) { ); } } +function getRegistryTypesFromEnv(logger, env = getEnv()) { + const value = env.getOptional("CODEQL_PROXY_URLS" /* PROXY_URLS */); + if (value === void 0) { + return void 0; + } + try { + const data = JSON.parse(value); + const types2 = new Set(data.map((r) => r.type)); + return Array.from(types2).sort().join(","); + } catch (err) { + logger.debug( + `Failed to parse '${"CODEQL_PROXY_URLS" /* PROXY_URLS */}' containing '${value}': ${getErrorMessage(err)}.` + ); + return void 0; + } +} async function createStatusReportBase(actionName, status, actionStartedAt, config, diskInfo, logger, cause, exception) { try { const commitOid = getOptionalInput("sha") || process.env["GITHUB_SHA"] || ""; @@ -146435,6 +146451,7 @@ async function createStatusReportBase(actionName, status, actionStartedAt, confi job_name: jobName, job_run_uuid: jobRunUUID, ref, + registry_types: getRegistryTypesFromEnv(logger), runner_os: runnerOs, started_at: workflowStartedAt, status, diff --git a/src/status-report.test.ts b/src/status-report.test.ts index 9086dd34ef..d8ce1b40b4 100644 --- a/src/status-report.test.ts +++ b/src/status-report.test.ts @@ -3,15 +3,17 @@ import * as sinon from "sinon"; import * as actionsUtil from "./actions-util"; import { Config } from "./config-utils"; -import { EnvVar } from "./environment"; +import { EnvVar, RegistryProxyVars } from "./environment"; import { BuiltInLanguage } from "./languages"; import { getRunnerLogger } from "./logging"; import { ToolsSource } from "./setup-codeql"; +import type { Registry } from "./start-proxy"; import { ActionName, createInitWithConfigStatusReport, createStatusReportBase, getActionsStatus, + getRegistryTypesFromEnv, InitStatusReport, InitWithConfigStatusReport, } from "./status-report"; @@ -20,11 +22,54 @@ import { setupActionsVars, createTestConfig, makeMacro, + getTestEnv, + RecordingLogger, } from "./testing-utils"; import { BuildMode, ConfigurationError, withTmpDir, wrapError } from "./util"; setupTests(test); +test("getRegistryTypesFromEnv - gets unique registry types from environment", async (t) => { + const logger = new RecordingLogger(true); + const env = getTestEnv({ + [RegistryProxyVars.PROXY_URLS]: JSON.stringify([ + { type: "git_source", url: "https://example.com" }, + { type: "git_source", url: "https://github.com" }, + { type: "docker_registry", url: "https://registry.example.com" }, + ] satisfies Array>), + }); + + const result = getRegistryTypesFromEnv(logger, env); + t.deepEqual(result, ["git_source", "docker_registry"].sort().join(",")); +}); + +test("getRegistryTypesFromEnv - returns undefined if the env var is not set", async (t) => { + const logger = new RecordingLogger(true); + const env = getTestEnv({}); + + const result = getRegistryTypesFromEnv(logger, env); + t.is(result, undefined); +}); + +test("getRegistryTypesFromEnv - returns undefined if the env var is not valid JSON", async (t) => { + const logger = new RecordingLogger(true); + const env = getTestEnv({ [RegistryProxyVars.PROXY_URLS]: "[" }); + + const result = getRegistryTypesFromEnv(logger, env); + t.is(result, undefined); +}); + +test("getRegistryTypesFromEnv - returns undefined if the env var is unexpected JSON", async (t) => { + const logger = new RecordingLogger(true); + const env = getTestEnv({ + // Top-level object rather than an array of objects. + [RegistryProxyVars.PROXY_URLS]: JSON.stringify({ type: "git_source" }), + }); + + const result = getRegistryTypesFromEnv(logger, env); + t.is(result, undefined); +}); + function setupEnvironmentAndStub(tmpDir: string) { setupActionsVars(tmpDir, tmpDir, { GITHUB_EVENT_NAME: "dynamic", diff --git a/src/status-report.ts b/src/status-report.ts index c61bbb828b..5778081153 100644 --- a/src/status-report.ts +++ b/src/status-report.ts @@ -17,12 +17,13 @@ import type { ComputedInput, InputName } from "./config/inputs"; import { parseRegistriesWithoutCredentials } from "./config/pack-registries"; import type { DependencyCacheRestoreStatusReport } from "./dependency-caching"; import { DocUrl } from "./doc-url"; -import { EnvVar } from "./environment"; +import { EnvVar, getEnv, ReadOnlyEnv, RegistryProxyVars } from "./environment"; import { getRef } from "./git-utils"; import type { Logger } from "./logging"; import type { OverlayBaseDatabaseDownloadStats } from "./overlay/caching"; import { getRepositoryNwo } from "./repository"; import type { ToolsSource } from "./setup-codeql"; +import type { Registry } from "./start-proxy"; import { ConfigurationError, getRequiredEnvParam, @@ -268,6 +269,35 @@ export interface EventReport { started_at: string; } +/** + * Attempts to retrieve a list of private registry types from the `CODEQL_PROXY_URLS` environment + * variable and returns it as a comma-separated string if successful. Returns `undefined` otherwise. + */ +export function getRegistryTypesFromEnv( + logger: Logger, + env: ReadOnlyEnv = getEnv(), +): string | undefined { + // Try to get the value of the environment variable. + const value = env.getOptional(RegistryProxyVars.PROXY_URLS); + + if (value === undefined) { + return undefined; + } + + // Try to parse the JSON we expect to find in it and return the comma-separated list of + // (unique) registry types. + try { + const data = JSON.parse(value) as Registry[]; + const types = new Set(data.map((r) => r.type)); + return Array.from(types).sort().join(","); + } catch (err) { + logger.debug( + `Failed to parse '${RegistryProxyVars.PROXY_URLS}' containing '${value}': ${getErrorMessage(err)}.`, + ); + return undefined; + } +} + /** * Compose a StatusReport. * @@ -330,6 +360,7 @@ export async function createStatusReportBase( job_name: jobName, job_run_uuid: jobRunUUID, ref, + registry_types: getRegistryTypesFromEnv(logger), runner_os: runnerOs, started_at: workflowStartedAt, status, From eb692f8b49def92b0d25277bd2be0639251c8a81 Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Wed, 29 Jul 2026 10:57:52 +0100 Subject: [PATCH 69/95] Add check to `createStatusReportBase` test --- src/status-report.test.ts | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/src/status-report.test.ts b/src/status-report.test.ts index d8ce1b40b4..9d3ce0f555 100644 --- a/src/status-report.test.ts +++ b/src/status-report.test.ts @@ -79,6 +79,9 @@ function setupEnvironmentAndStub(tmpDir: string) { process.env[EnvVar.ANALYSIS_KEY] = "analysis-key"; process.env["ImageVersion"] = "2023.05.19.1"; + process.env[RegistryProxyVars.PROXY_URLS] = JSON.stringify([ + { type: "maven_repository" }, + ] satisfies Array>); const getRequiredInput = sinon.stub(actionsUtil, "getRequiredInput"); getRequiredInput.withArgs("matrix").resolves("input/matrix"); @@ -122,6 +125,7 @@ test.serial("createStatusReportBase", async (t) => { t.is(typeof statusReport.job_run_uuid, "string"); t.is(statusReport.languages, "java,swift"); t.is(statusReport.ref, process.env["GITHUB_REF"]!); + t.is(statusReport.registry_types, "maven_repository"); t.is(statusReport.runner_available_disk_space_bytes, 100); t.is(statusReport.runner_image_version, process.env["ImageVersion"]); t.is(statusReport.runner_os, process.env["RUNNER_OS"]!); From e893985e8b57c9f9c845bc3320a4fb540653da70 Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Wed, 29 Jul 2026 11:19:21 +0100 Subject: [PATCH 70/95] Fix `makeValidator` returning `required: boolean` --- lib/entry-points.js | 4 ++-- src/json/index.ts | 7 ++----- 2 files changed, 4 insertions(+), 7 deletions(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index 24a7eb5c70..a69c9c02fd 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -144598,11 +144598,11 @@ function isStringOrUndefined(value) { function defaultCheck(validate) { return (arg) => ({ unknownKeys: [], invalidKeys: [], valid: validate(arg) }); } -function makeValidator(validate, required = true) { +function makeValidator(validate) { return { validate, check: defaultCheck(validate), - required + required: true }; } var string = makeValidator(isString); diff --git a/src/json/index.ts b/src/json/index.ts index 78923f8bac..f040acc932 100644 --- a/src/json/index.ts +++ b/src/json/index.ts @@ -62,14 +62,11 @@ function defaultCheck( return (arg) => ({ unknownKeys: [], invalidKeys: [], valid: validate(arg) }); } -function makeValidator( - validate: (arg: unknown) => arg is T, - required: boolean = true, -) { +function makeValidator(validate: (arg: unknown) => arg is T) { return { validate, check: defaultCheck(validate), - required, + required: true, } as const satisfies Validator; } From 51d51e81216d2a2764c063e5c4ca37c12aa92eb9 Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Wed, 29 Jul 2026 11:19:57 +0100 Subject: [PATCH 71/95] Add `boolean` `Validator` to `json` module --- lib/entry-points.js | 8 ++++++-- src/json/index.ts | 8 ++++++++ 2 files changed, 14 insertions(+), 2 deletions(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index a69c9c02fd..302bff49af 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -92812,10 +92812,10 @@ var require_util12 = __commonJS({ return objectToString(arg) === "[object Array]"; } exports2.isArray = isArray2; - function isBoolean(arg) { + function isBoolean2(arg) { return typeof arg === "boolean"; } - exports2.isBoolean = isBoolean; + exports2.isBoolean = isBoolean2; function isNull(arg) { return arg === null; } @@ -144592,6 +144592,9 @@ function isString(value) { function isNumber(value) { return typeof value === "number"; } +function isBoolean(value) { + return typeof value === "boolean"; +} function isStringOrUndefined(value) { return value === void 0 || isString(value); } @@ -144607,6 +144610,7 @@ function makeValidator(validate) { } var string = makeValidator(isString); var number = makeValidator(isNumber); +var boolean = makeValidator(isBoolean); function array(validator) { const validate = (val) => { return isArray(val) && val.every((e) => validator.validate(e)); diff --git a/src/json/index.ts b/src/json/index.ts index f040acc932..d3d3abac0c 100644 --- a/src/json/index.ts +++ b/src/json/index.ts @@ -35,6 +35,11 @@ export function isNumber(value: unknown): value is number { return typeof value === "number"; } +/** Asserts that `value` is a boolean. */ +export function isBoolean(value: unknown): value is boolean { + return typeof value === "boolean"; +} + /** Asserts that `value` is either a string or undefined. */ export function isStringOrUndefined( value: unknown, @@ -79,6 +84,9 @@ export const string = makeValidator(isString); /** A validator for number fields in schemas. */ export const number = makeValidator(isNumber); +/** A validator for boolean fields in schemas. */ +export const boolean = makeValidator(isBoolean); + /** A validator for arrays. */ export function array(validator: Validator) { const validate = (val: unknown) => { From e55a57b808525a6830cbf9c336f7ae221169a3a3 Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Wed, 29 Jul 2026 11:21:19 +0100 Subject: [PATCH 72/95] Add `RegistryBase` schema and type --- lib/entry-points.js | 6 ++++++ src/start-proxy/types.ts | 16 +++++++++++----- 2 files changed, 17 insertions(+), 5 deletions(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index 302bff49af..d52d8169cd 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -161989,6 +161989,12 @@ function credentialToStr(credential) { } return result; } +var registryBaseSchema = { + /** The type of the package registry. */ + type: string, + /** Whether the registry replaces the base registry for the ecosystem. */ + "replaces-base": optional(boolean) +}; function getAddressString(address) { if (address.url === void 0) { return address.host; diff --git a/src/start-proxy/types.ts b/src/start-proxy/types.ts index 13369edbfa..17803e9126 100644 --- a/src/start-proxy/types.ts +++ b/src/start-proxy/types.ts @@ -254,13 +254,19 @@ export function credentialToStr(credential: Credential): string { return result; } -/** A package registry is identified by its type and address. */ -export type Registry = { +/** The schema for `RegistryBase` objects. */ +export const registryBaseSchema = { /** The type of the package registry. */ - type: string; + type: json.string, /** Whether the registry replaces the base registry for the ecosystem. */ - "replaces-base"?: boolean; -} & Address; + "replaces-base": json.optional(json.boolean), +} as const satisfies json.Schema; + +/** Information about a registry, other than its address. */ +export type RegistryBase = json.FromSchema; + +/** A package registry is identified by its type and address. */ +export type Registry = RegistryBase & Address; // If a registry has an `url`, then that takes precedence over the `host` which may or may // not be defined. From 13d4882649ba1a2a6abb6c2303df10658daa41f7 Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Wed, 29 Jul 2026 11:35:46 +0100 Subject: [PATCH 73/95] Validate JSON more --- lib/entry-points.js | 316 ++++++++++++++++++++------------------ src/json/index.ts | 17 ++ src/status-report.test.ts | 26 +++- src/status-report.ts | 22 ++- 4 files changed, 222 insertions(+), 159 deletions(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index d52d8169cd..53b7f491af 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -96885,7 +96885,7 @@ var require_validators = __commonJS({ throw new ERR_INVALID_ARG_TYPE(name, "a dictionary", value); } }); - var validateArray = hideStackFrames((value, name, minLength = 0) => { + var validateArray2 = hideStackFrames((value, name, minLength = 0) => { if (!ArrayIsArray(value)) { throw new ERR_INVALID_ARG_TYPE(name, "Array", value); } @@ -96895,19 +96895,19 @@ var require_validators = __commonJS({ } }); function validateStringArray(value, name) { - validateArray(value, name); + validateArray2(value, name); for (let i = 0; i < value.length; i++) { validateString(value[i], `${name}[${i}]`); } } function validateBooleanArray(value, name) { - validateArray(value, name); + validateArray2(value, name); for (let i = 0; i < value.length; i++) { validateBoolean(value[i], `${name}[${i}]`); } } function validateAbortSignalArray(value, name) { - validateArray(value, name); + validateArray2(value, name); for (let i = 0; i < value.length; i++) { const signal = value[i]; const indexedName = `${name}[${i}]`; @@ -97003,7 +97003,7 @@ var require_validators = __commonJS({ isInt32, isUint32, parseFileMode, - validateArray, + validateArray: validateArray2, validateStringArray, validateBooleanArray, validateAbortSignalArray, @@ -144692,6 +144692,10 @@ function validateSchema(schema, obj) { const result = checkSchema(schema, obj, { failFast: true }); return result.valid; } +function validateArray(elementSchema, arr) { + const elementValidator = object(elementSchema); + return array(elementValidator).validate(arr); +} function successfulCheckSchema() { return { valid: true, @@ -146343,6 +146347,148 @@ async function getGeneratedFiles(workingDirectory) { return generatedFiles; } +// src/start-proxy/types.ts +var usernameSchema = { + /** The username needed to authenticate to the package registry, if any. */ + username: optionalOrNull(string) +}; +function hasUsername(config) { + return "username" in config; +} +var usernamePasswordSchema = { + /** The password needed to authenticate to the package registry, if any. */ + password: optionalOrNull(string), + ...usernameSchema +}; +function hasUsernameAndPassword(config) { + return hasUsername(config) && "password" in config; +} +var tokenSchema = { + /** The token needed to authenticate to the package registry, if any. */ + token: optionalOrNull(string), + ...usernameSchema +}; +function hasToken(config) { + return "token" in config; +} +function isToken(config) { + return "token" in config && validateSchema(tokenSchema, config); +} +var azureConfigSchema = { + "tenant-id": string, + "client-id": string +}; +function isAzureConfig(config) { + return validateSchema(azureConfigSchema, config); +} +var awsConfigSchema = { + "aws-region": string, + "account-id": string, + "role-name": string, + domain: string, + "domain-owner": string, + audience: optionalOrNull(string) +}; +function isAWSConfig(config) { + return validateSchema(awsConfigSchema, config); +} +var jfrogConfigSchema = { + "jfrog-oidc-provider-name": string, + audience: optionalOrNull(string), + "identity-mapping-name": optionalOrNull(string) +}; +function isJFrogConfig(config) { + return validateSchema(jfrogConfigSchema, config); +} +var cloudsmithConfigSchema = { + namespace: string, + "service-slug": string, + "api-host": string +}; +function isCloudsmithConfig(config) { + return validateSchema(cloudsmithConfigSchema, config); +} +var gcpConfigSchema = { + "workload-identity-provider": string, + "service-account": optionalOrNull(string), + audience: optionalOrNull(string) +}; +function isGCPConfig(config) { + return validateSchema(gcpConfigSchema, config); +} +var oidcSchemas = [ + { schema: azureConfigSchema, name: "Azure" }, + { schema: awsConfigSchema, name: "AWS" }, + { schema: jfrogConfigSchema, name: "JFrog" }, + { schema: cloudsmithConfigSchema, name: "Cloudsmith" }, + { schema: gcpConfigSchema, name: "GCP" } +]; +function credentialToStr(credential) { + let result = `Type: ${credential.type};`; + const appendIfDefined = (name, val) => { + if (isDefined2(val)) { + result += ` ${name}: ${val};`; + } + }; + appendIfDefined("Url", credential.url); + appendIfDefined("Host", credential.host); + if (hasUsername(credential)) { + appendIfDefined("Username", credential.username); + } + if ("password" in credential) { + appendIfDefined( + "Password", + isDefined2(credential.password) ? "***" : void 0 + ); + } + if (hasToken(credential)) { + appendIfDefined("Token", isDefined2(credential.token) ? "***" : void 0); + } + if (isAzureConfig(credential)) { + appendIfDefined("Tenant", credential["tenant-id"]); + appendIfDefined("Client", credential["client-id"]); + } else if (isAWSConfig(credential)) { + appendIfDefined("AWS Region", credential["aws-region"]); + appendIfDefined("AWS Account", credential["account-id"]); + appendIfDefined("AWS Role", credential["role-name"]); + appendIfDefined("AWS Domain", credential.domain); + appendIfDefined("AWS Domain Owner", credential["domain-owner"]); + appendIfDefined("AWS Audience", credential.audience); + } else if (isJFrogConfig(credential)) { + appendIfDefined("JFrog Provider", credential["jfrog-oidc-provider-name"]); + appendIfDefined( + "JFrog Identity Mapping", + credential["identity-mapping-name"] + ); + appendIfDefined("JFrog Audience", credential.audience); + } else if (isCloudsmithConfig(credential)) { + appendIfDefined("Cloudsmith Namespace", credential.namespace); + appendIfDefined("Cloudsmith Service Slug", credential["service-slug"]); + appendIfDefined("Cloudsmith API Host", credential["api-host"]); + } else if (isGCPConfig(credential)) { + appendIfDefined( + "GCP Workload Identity Provider", + credential["workload-identity-provider"] + ); + appendIfDefined("GCP Service Account", credential["service-account"]); + appendIfDefined("GCP Audience", credential.audience); + } + return result; +} +var registryBaseSchema = { + /** The type of the package registry. */ + type: string, + /** Whether the registry replaces the base registry for the ecosystem. */ + "replaces-base": optional(boolean) +}; +function getAddressString(address) { + if (address.url === void 0) { + return address.host; + } else { + return address.url; + } +} + // src/status-report.ts function getDisplayActionName(actionName) { if (actionName === "finish" /* Analyze */) { @@ -146407,11 +146553,23 @@ function getRegistryTypesFromEnv(logger, env = getEnv()) { } try { const data = JSON.parse(value); + if (!isArray(data)) { + logger.debug( + `Expected '${"CODEQL_PROXY_URLS" /* PROXY_URLS */}' to contain a JSON array, but got '${typeof data}'.` + ); + return void 0; + } + if (!validateArray(registryBaseSchema, data)) { + logger.debug( + `Expected '${"CODEQL_PROXY_URLS" /* PROXY_URLS */}' to contain a JSON array of registry objects, but got something else.` + ); + return void 0; + } const types2 = new Set(data.map((r) => r.type)); return Array.from(types2).sort().join(","); } catch (err) { logger.debug( - `Failed to parse '${"CODEQL_PROXY_URLS" /* PROXY_URLS */}' containing '${value}': ${getErrorMessage(err)}.` + `Failed to parse '${"CODEQL_PROXY_URLS" /* PROXY_URLS */}': ${getErrorMessage(err)}.` ); return void 0; } @@ -157400,7 +157558,7 @@ var import_async = __toESM(require_async(), 1); var import_path6 = require("path"); // node_modules/archiver/lib/error.js -var import_util33 = __toESM(require("util"), 1); +var import_util34 = __toESM(require("util"), 1); var ERROR_CODES = { ABORTED: "archive was aborted", DIRECTORYDIRPATHREQUIRED: "diretory dirpath argument must be a non-empty string value", @@ -157425,7 +157583,7 @@ function ArchiverError(code, data) { this.code = code; this.data = data; } -import_util33.default.inherits(ArchiverError, Error); +import_util34.default.inherits(ArchiverError, Error); // node_modules/archiver/lib/core.js var import_readable_stream2 = __toESM(require_ours(), 1); @@ -161861,148 +162019,6 @@ var path26 = __toESM(require("path")); var core26 = __toESM(require_core()); var toolcache4 = __toESM(require_tool_cache()); -// src/start-proxy/types.ts -var usernameSchema = { - /** The username needed to authenticate to the package registry, if any. */ - username: optionalOrNull(string) -}; -function hasUsername(config) { - return "username" in config; -} -var usernamePasswordSchema = { - /** The password needed to authenticate to the package registry, if any. */ - password: optionalOrNull(string), - ...usernameSchema -}; -function hasUsernameAndPassword(config) { - return hasUsername(config) && "password" in config; -} -var tokenSchema = { - /** The token needed to authenticate to the package registry, if any. */ - token: optionalOrNull(string), - ...usernameSchema -}; -function hasToken(config) { - return "token" in config; -} -function isToken(config) { - return "token" in config && validateSchema(tokenSchema, config); -} -var azureConfigSchema = { - "tenant-id": string, - "client-id": string -}; -function isAzureConfig(config) { - return validateSchema(azureConfigSchema, config); -} -var awsConfigSchema = { - "aws-region": string, - "account-id": string, - "role-name": string, - domain: string, - "domain-owner": string, - audience: optionalOrNull(string) -}; -function isAWSConfig(config) { - return validateSchema(awsConfigSchema, config); -} -var jfrogConfigSchema = { - "jfrog-oidc-provider-name": string, - audience: optionalOrNull(string), - "identity-mapping-name": optionalOrNull(string) -}; -function isJFrogConfig(config) { - return validateSchema(jfrogConfigSchema, config); -} -var cloudsmithConfigSchema = { - namespace: string, - "service-slug": string, - "api-host": string -}; -function isCloudsmithConfig(config) { - return validateSchema(cloudsmithConfigSchema, config); -} -var gcpConfigSchema = { - "workload-identity-provider": string, - "service-account": optionalOrNull(string), - audience: optionalOrNull(string) -}; -function isGCPConfig(config) { - return validateSchema(gcpConfigSchema, config); -} -var oidcSchemas = [ - { schema: azureConfigSchema, name: "Azure" }, - { schema: awsConfigSchema, name: "AWS" }, - { schema: jfrogConfigSchema, name: "JFrog" }, - { schema: cloudsmithConfigSchema, name: "Cloudsmith" }, - { schema: gcpConfigSchema, name: "GCP" } -]; -function credentialToStr(credential) { - let result = `Type: ${credential.type};`; - const appendIfDefined = (name, val) => { - if (isDefined2(val)) { - result += ` ${name}: ${val};`; - } - }; - appendIfDefined("Url", credential.url); - appendIfDefined("Host", credential.host); - if (hasUsername(credential)) { - appendIfDefined("Username", credential.username); - } - if ("password" in credential) { - appendIfDefined( - "Password", - isDefined2(credential.password) ? "***" : void 0 - ); - } - if (hasToken(credential)) { - appendIfDefined("Token", isDefined2(credential.token) ? "***" : void 0); - } - if (isAzureConfig(credential)) { - appendIfDefined("Tenant", credential["tenant-id"]); - appendIfDefined("Client", credential["client-id"]); - } else if (isAWSConfig(credential)) { - appendIfDefined("AWS Region", credential["aws-region"]); - appendIfDefined("AWS Account", credential["account-id"]); - appendIfDefined("AWS Role", credential["role-name"]); - appendIfDefined("AWS Domain", credential.domain); - appendIfDefined("AWS Domain Owner", credential["domain-owner"]); - appendIfDefined("AWS Audience", credential.audience); - } else if (isJFrogConfig(credential)) { - appendIfDefined("JFrog Provider", credential["jfrog-oidc-provider-name"]); - appendIfDefined( - "JFrog Identity Mapping", - credential["identity-mapping-name"] - ); - appendIfDefined("JFrog Audience", credential.audience); - } else if (isCloudsmithConfig(credential)) { - appendIfDefined("Cloudsmith Namespace", credential.namespace); - appendIfDefined("Cloudsmith Service Slug", credential["service-slug"]); - appendIfDefined("Cloudsmith API Host", credential["api-host"]); - } else if (isGCPConfig(credential)) { - appendIfDefined( - "GCP Workload Identity Provider", - credential["workload-identity-provider"] - ); - appendIfDefined("GCP Service Account", credential["service-account"]); - appendIfDefined("GCP Audience", credential.audience); - } - return result; -} -var registryBaseSchema = { - /** The type of the package registry. */ - type: string, - /** Whether the registry replaces the base registry for the ecosystem. */ - "replaces-base": optional(boolean) -}; -function getAddressString(address) { - if (address.url === void 0) { - return address.host; - } else { - return address.url; - } -} - // src/start-proxy/validation.ts var core25 = __toESM(require_core()); function cloneCredential(schema, obj) { diff --git a/src/json/index.ts b/src/json/index.ts index d3d3abac0c..d8764ec478 100644 --- a/src/json/index.ts +++ b/src/json/index.ts @@ -226,6 +226,23 @@ export function validateSchema< return result.valid; } +/** + * Validates that `arr` is an array whose elements satisfy at least `elementSchema`. + * Additional keys are accepted in each element. + * + * @param elementSchema The schema to validate the elements against. + * @param arr The array to validate. + * @returns Asserts that `arr` has elements of `schema`'s type if validation is successful. + */ +export function validateArray< + S extends Schema, + T extends UnvalidatedArray = Array>, +>(elementSchema: S, arr: UnvalidatedArray): arr is T { + const elementValidator = object(elementSchema); + + return array(elementValidator).validate(arr); +} + export interface CheckSchemaOptions { /** Whether to stop validation after the first error. */ failFast?: boolean; diff --git a/src/status-report.test.ts b/src/status-report.test.ts index 9d3ce0f555..917a2e4d8e 100644 --- a/src/status-report.test.ts +++ b/src/status-report.test.ts @@ -61,13 +61,27 @@ test("getRegistryTypesFromEnv - returns undefined if the env var is not valid JS test("getRegistryTypesFromEnv - returns undefined if the env var is unexpected JSON", async (t) => { const logger = new RecordingLogger(true); - const env = getTestEnv({ - // Top-level object rather than an array of objects. - [RegistryProxyVars.PROXY_URLS]: JSON.stringify({ type: "git_source" }), - }); - const result = getRegistryTypesFromEnv(logger, env); - t.is(result, undefined); + t.is( + getRegistryTypesFromEnv( + logger, + getTestEnv({ + // Top-level object rather than an array of objects. + [RegistryProxyVars.PROXY_URLS]: JSON.stringify({ type: "git_source" }), + }), + ), + undefined, + ); + t.is( + getRegistryTypesFromEnv( + logger, + getTestEnv({ + // Object has no "type" key. + [RegistryProxyVars.PROXY_URLS]: JSON.stringify([{}]), + }), + ), + undefined, + ); }); function setupEnvironmentAndStub(tmpDir: string) { diff --git a/src/status-report.ts b/src/status-report.ts index 5778081153..a6b263ee08 100644 --- a/src/status-report.ts +++ b/src/status-report.ts @@ -19,11 +19,12 @@ import type { DependencyCacheRestoreStatusReport } from "./dependency-caching"; import { DocUrl } from "./doc-url"; import { EnvVar, getEnv, ReadOnlyEnv, RegistryProxyVars } from "./environment"; import { getRef } from "./git-utils"; +import * as json from "./json"; import type { Logger } from "./logging"; import type { OverlayBaseDatabaseDownloadStats } from "./overlay/caching"; import { getRepositoryNwo } from "./repository"; import type { ToolsSource } from "./setup-codeql"; -import type { Registry } from "./start-proxy"; +import { registryBaseSchema } from "./start-proxy/types"; import { ConfigurationError, getRequiredEnvParam, @@ -287,12 +288,27 @@ export function getRegistryTypesFromEnv( // Try to parse the JSON we expect to find in it and return the comma-separated list of // (unique) registry types. try { - const data = JSON.parse(value) as Registry[]; + const data = JSON.parse(value) as unknown; + + // Check that the parsed JSON meets our expectations. + if (!json.isArray(data)) { + logger.debug( + `Expected '${RegistryProxyVars.PROXY_URLS}' to contain a JSON array, but got '${typeof data}'.`, + ); + return undefined; + } + if (!json.validateArray(registryBaseSchema, data)) { + logger.debug( + `Expected '${RegistryProxyVars.PROXY_URLS}' to contain a JSON array of registry objects, but got something else.`, + ); + return undefined; + } + const types = new Set(data.map((r) => r.type)); return Array.from(types).sort().join(","); } catch (err) { logger.debug( - `Failed to parse '${RegistryProxyVars.PROXY_URLS}' containing '${value}': ${getErrorMessage(err)}.`, + `Failed to parse '${RegistryProxyVars.PROXY_URLS}': ${getErrorMessage(err)}.`, ); return undefined; } From 42a3b947902ef5aef0cda3594c9e0cb60f8f4820 Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Wed, 29 Jul 2026 11:58:44 +0100 Subject: [PATCH 74/95] Add `CODEQL_ACTION_` prefix to `JOB_RUN_UUID` --- .github/workflows/__job-run-uuid-sarif.yml | 4 ++-- lib/entry-points.js | 8 ++++---- pr-checks/checks/job-run-uuid-sarif.yml | 4 ++-- src/environment.ts | 2 +- 4 files changed, 9 insertions(+), 9 deletions(-) diff --git a/.github/workflows/__job-run-uuid-sarif.yml b/.github/workflows/__job-run-uuid-sarif.yml index cd47fb577e..429a694947 100644 --- a/.github/workflows/__job-run-uuid-sarif.yml +++ b/.github/workflows/__job-run-uuid-sarif.yml @@ -71,8 +71,8 @@ jobs: run: | cd "$RUNNER_TEMP/results" actual=$(jq -r '.runs[0].properties.jobRunUuid' javascript.sarif) - if [[ "$actual" != "$JOB_RUN_UUID" ]]; then - echo "Expected SARIF output to contain job run UUID '$JOB_RUN_UUID', but found '$actual'." + if [[ "$actual" != "$CODEQL_ACTION_JOB_RUN_UUID" ]]; then + echo "Expected SARIF output to contain job run UUID '$CODEQL_ACTION_JOB_RUN_UUID', but found '$actual'." exit 1 else echo "Found job run UUID '$actual'." diff --git a/lib/entry-points.js b/lib/entry-points.js index 0f35b11dfd..a2f6d22c52 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -146404,14 +146404,14 @@ function getDisplayActionName(actionName) { return actionName; } function getJobUUID(action) { - const existingJobRunUuid = action.env.getOptional("JOB_RUN_UUID" /* JOB_RUN_UUID */); + const existingJobRunUuid = action.env.getOptional("CODEQL_ACTION_JOB_RUN_UUID" /* JOB_RUN_UUID */); if (existingJobRunUuid !== void 0 && validate_default(existingJobRunUuid)) { action.logger.info(`Existing job run UUID is ${existingJobRunUuid}.`); return existingJobRunUuid; } const jobRunUuid = v4_default(); action.logger.info(`Job run UUID is ${jobRunUuid}.`); - action.actions.exportVariable("JOB_RUN_UUID" /* JOB_RUN_UUID */, jobRunUuid); + action.actions.exportVariable("CODEQL_ACTION_JOB_RUN_UUID" /* JOB_RUN_UUID */, jobRunUuid); return jobRunUuid; } function isFirstPartyAnalysis(actionName) { @@ -146468,7 +146468,7 @@ async function createStatusReportBase(actionName, status, actionStartedAt, confi try { const commitOid = getOptionalInput("sha") || process.env["GITHUB_SHA"] || ""; const ref = await getRef(); - const jobRunUUID = process.env["JOB_RUN_UUID" /* JOB_RUN_UUID */] || ""; + const jobRunUUID = process.env["CODEQL_ACTION_JOB_RUN_UUID" /* JOB_RUN_UUID */] || ""; const workflowRunID = getWorkflowRunID(); const workflowRunAttempt = getWorkflowRunAttempt(); const workflowName = process.env["GITHUB_WORKFLOW"] || ""; @@ -152008,7 +152008,7 @@ function applyAutobuildAzurePipelinesTimeoutFix() { ].join(" "); } async function getJobRunUuidSarifOptions() { - const jobRunUuid = process.env["JOB_RUN_UUID" /* JOB_RUN_UUID */]; + const jobRunUuid = process.env["CODEQL_ACTION_JOB_RUN_UUID" /* JOB_RUN_UUID */]; return jobRunUuid ? [`--sarif-run-property=jobRunUuid=${jobRunUuid}`] : []; } diff --git a/pr-checks/checks/job-run-uuid-sarif.yml b/pr-checks/checks/job-run-uuid-sarif.yml index dc1dd02d43..b86725d944 100644 --- a/pr-checks/checks/job-run-uuid-sarif.yml +++ b/pr-checks/checks/job-run-uuid-sarif.yml @@ -21,8 +21,8 @@ steps: run: | cd "$RUNNER_TEMP/results" actual=$(jq -r '.runs[0].properties.jobRunUuid' javascript.sarif) - if [[ "$actual" != "$JOB_RUN_UUID" ]]; then - echo "Expected SARIF output to contain job run UUID '$JOB_RUN_UUID', but found '$actual'." + if [[ "$actual" != "$CODEQL_ACTION_JOB_RUN_UUID" ]]; then + echo "Expected SARIF output to contain job run UUID '$CODEQL_ACTION_JOB_RUN_UUID', but found '$actual'." exit 1 else echo "Found job run UUID '$actual'." diff --git a/src/environment.ts b/src/environment.ts index 1b00ab7cfb..fea553d602 100644 --- a/src/environment.ts +++ b/src/environment.ts @@ -88,7 +88,7 @@ export enum EnvVar { LOG_VERSION_DEPRECATION = "CODEQL_ACTION_DID_LOG_VERSION_DEPRECATION", /** UUID representing the current job run. */ - JOB_RUN_UUID = "JOB_RUN_UUID", + JOB_RUN_UUID = "CODEQL_ACTION_JOB_RUN_UUID", /** Status for the entire job, submitted to the status report in `init-post` */ JOB_STATUS = "CODEQL_ACTION_JOB_STATUS", From 3ca82bb259b52fe4d0f27055fa58f0fb99694b80 Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Wed, 29 Jul 2026 12:55:16 +0100 Subject: [PATCH 75/95] Change `withActions` to only allow mutations --- src/config/inputs.test.ts | 18 +++++------------- src/testing-utils.ts | 12 +++++------- 2 files changed, 10 insertions(+), 20 deletions(-) diff --git a/src/config/inputs.test.ts b/src/config/inputs.test.ts index a91dc258ea..851dd72e2f 100644 --- a/src/config/inputs.test.ts +++ b/src/config/inputs.test.ts @@ -1,7 +1,7 @@ import test from "ava"; import sinon from "sinon"; -import { getActionsEnv } from "../actions-util"; +import { ActionsEnv } from "../actions-util"; import { Feature } from "../feature-flags"; import { RepositoryPropertyName } from "../feature-flags/properties"; import { callee } from "../testing-utils"; @@ -22,32 +22,26 @@ const expectedRepositoryPropertyResult: ComputedInput = { value: "repo-property-input-value", }; -function stubGetToolsInput() { - const actions = getActionsEnv(); +function stubGetToolsInput(actions: ActionsEnv) { sinon .stub(actions, "getOptionalInput") .withArgs(InputName.Tools) .returns(expectedWorkflowResult.value); - return actions; } const workflowLogMessage = `Using ${InputName.Tools} input from workflow:`; test("getToolsInput - returns workflow input if available", async (t) => { - const actions = stubGetToolsInput(); - await callee(getToolsInput) - .withActions(actions) + .withActions(stubGetToolsInput) .withArgs({}) .logs(t, workflowLogMessage) .passes(t.deepEqual, expectedWorkflowResult); }); test("getToolsInput - returns repository property value if enforced", async (t) => { - const actions = stubGetToolsInput(); - const target = callee(getToolsInput) - .withActions(actions) + .withActions(stubGetToolsInput) .withArgs({ [RepositoryPropertyName.TOOLS]: `!${expectedRepositoryPropertyResult.value}`, }); @@ -65,10 +59,8 @@ test("getToolsInput - returns repository property value if enforced", async (t) }); test("getToolsInput - prefers workflow input", async (t) => { - const actions = stubGetToolsInput(); - const target = callee(getToolsInput) - .withActions(actions) + .withActions(stubGetToolsInput) .withArgs({ [RepositoryPropertyName.TOOLS]: expectedRepositoryPropertyResult.value, }); diff --git a/src/testing-utils.ts b/src/testing-utils.ts index 4402458d82..553a775e93 100644 --- a/src/testing-utils.ts +++ b/src/testing-utils.ts @@ -228,7 +228,8 @@ type DelayedCheck< Fs extends ReadonlyArray, > = (env: Readonly>) => Promise; -export type ValueOrMutation = T | ((val: T) => void); +export type Mutation = (val: T) => void; +export type ValueOrMutation = T | Mutation; /** * Wraps a function that accepts an `ActionState` for testing in different environments. @@ -324,13 +325,10 @@ abstract class BaseEnvBuilder< return result; } - public withActions(arg: ValueOrMutation): this { + /** Applies `fn` to the `ActionsEnv`. */ + public withActions(fn: Mutation): this { const result = this.clone(); - if (typeof arg === "function") { - arg(result.state.actions); - } else { - result.state.actions = arg; - } + fn(result.state.actions); return result; } From 30c33c9286fa4a7c5325301b5a2aa0c5b67a51ec Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Wed, 29 Jul 2026 12:56:51 +0100 Subject: [PATCH 76/95] Make results of function call available to delayed checks --- src/testing-utils.ts | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/src/testing-utils.ts b/src/testing-utils.ts index 553a775e93..d6fffb69b1 100644 --- a/src/testing-utils.ts +++ b/src/testing-utils.ts @@ -34,11 +34,14 @@ import { ActionName } from "./status-report"; import { DEFAULT_DEBUG_ARTIFACT_NAME, DEFAULT_DEBUG_DATABASE_NAME, + Failure, getEnv, GitHubVariant, GitHubVersion, HTTPError, resetCachedCodeQlVersion, + Result, + Success, } from "./util"; export const SAMPLE_DOTCOM_API_DETAILS = { @@ -226,7 +229,10 @@ type DelayedCheck< Args extends readonly any[], R, Fs extends ReadonlyArray, -> = (env: Readonly>) => Promise; +> = ( + env: Readonly>, + result: Result, ThrownError>, +) => Promise; export type Mutation = (val: T) => void; export type ValueOrMutation = T | Mutation; @@ -441,7 +447,7 @@ class CallableEnvBuilder< // Run other delayed checks. for (const delayedCheck of this.checks) { - await delayedCheck(this); + await delayedCheck(this, new Success(result)); } // Return the results of the function call and the main assertion. @@ -467,7 +473,7 @@ class CallableEnvBuilder< // Run other delayed checks. for (const delayedCheck of this.checks) { - await delayedCheck(this); + await delayedCheck(this, new Failure(error)); } // Return the error. From 36737508ece41f7da5ed9862108928b78f5c24ff Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Wed, 29 Jul 2026 13:00:31 +0100 Subject: [PATCH 77/95] Add `Env`-backed `ActionsEnv` implementation for tests --- src/testing-utils.ts | 66 +++++++++++++++++++++++++++++++------------- 1 file changed, 47 insertions(+), 19 deletions(-) diff --git a/src/testing-utils.ts b/src/testing-utils.ts index d6fffb69b1..94c8435218 100644 --- a/src/testing-utils.ts +++ b/src/testing-utils.ts @@ -185,17 +185,32 @@ export function getTestEnv(testEnv: NodeJS.ProcessEnv = {}): Env { return getEnv(testEnv); } +/** An implementation of `ActionsEnv` for use in tests. */ +class TestActionsEnv implements ActionsEnv { + constructor(private readonly env: Env) {} + + public clone(env: Env): this { + return Object.create(this, { env: { value: env } }) as this; + } + + public getRequiredInput(name: string): string { + throw new Error(`Input required and not supplied: ${name}`); + } + + public getOptionalInput(_name: string): string | undefined { + return undefined; + } + + public exportVariable(name: string, value: string): void { + this.env.set(name, value); + } +} + /** * Gets an `ActionsEnv` instance for use in tests. */ -export function getTestActionsEnv(): ActionsEnv { - return { - getRequiredInput: (name) => { - throw new Error(`Input required and not supplied: ${name}`); - }, - getOptionalInput: () => undefined, - exportVariable: () => {}, - }; +export function getTestActionsEnv(env: Env): TestActionsEnv { + return new TestActionsEnv(env); } /** For testing purposes, we make all available state features accessible in `TestEnv`. */ @@ -213,12 +228,13 @@ type AllState = [ export function initAllState( overrides?: Partial>, ): ActionState { + const env = getTestEnv(); return { name: ActionName.Init, startedAt: new Date(), logger: new RecordingLogger(), - env: getTestEnv(), - actions: getTestActionsEnv(), + env, + actions: getTestActionsEnv(env), apiClient: github.getOctokit("123"), features: createFeatures([]), ...overrides, @@ -247,6 +263,7 @@ abstract class BaseEnvBuilder< > { protected readonly fn: (state: ActionState, ...args: Args) => R; private logger: RecordingLogger; + private actions: TestActionsEnv; protected state: ActionState; protected checks: Array>; @@ -256,15 +273,26 @@ abstract class BaseEnvBuilder< ) { this.fn = fn; this.logger = new RecordingLogger(); - this.state = - cloneFrom !== undefined - ? ({ - ...cloneFrom.state, - env: cloneFrom.state.env.clone(), - actions: Object.create(cloneFrom.state.actions), - logger: this.logger, - } satisfies ActionState) - : initAllState({ logger: this.logger }); + + if (cloneFrom !== undefined) { + const env = cloneFrom.state.env.clone(); + this.actions = cloneFrom.actions.clone(env); + this.state = { + ...cloneFrom.state, + env, + actions: this.actions, + logger: this.logger, + } satisfies ActionState; + } else { + const env = getTestEnv(); + this.actions = getTestActionsEnv(env); + this.state = initAllState({ + logger: this.logger, + env, + actions: this.actions, + }); + } + this.checks = [...(cloneFrom?.checks ?? [])]; } From da0c1901011e62af9c02aae8bf5b8885b11f7741 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Wed, 29 Jul 2026 12:22:25 +0000 Subject: [PATCH 78/95] Update default bundle to codeql-bundle-v2.26.2 --- lib/defaults.json | 8 ++++---- lib/entry-points.js | 4 ++-- src/defaults.json | 8 ++++---- 3 files changed, 10 insertions(+), 10 deletions(-) diff --git a/lib/defaults.json b/lib/defaults.json index 39ecfc35fa..558dce6e24 100644 --- a/lib/defaults.json +++ b/lib/defaults.json @@ -1,6 +1,6 @@ { - "bundleVersion": "codeql-bundle-v2.26.1", - "cliVersion": "2.26.1", - "priorBundleVersion": "codeql-bundle-v2.26.0", - "priorCliVersion": "2.26.0" + "bundleVersion": "codeql-bundle-v2.26.2", + "cliVersion": "2.26.2", + "priorBundleVersion": "codeql-bundle-v2.26.1", + "priorCliVersion": "2.26.1" } diff --git a/lib/entry-points.js b/lib/entry-points.js index 46c44a8183..eb81affd67 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -146649,8 +146649,8 @@ var path5 = __toESM(require("path")); var semver4 = __toESM(require_semver2()); // src/defaults.json -var bundleVersion = "codeql-bundle-v2.26.1"; -var cliVersion = "2.26.1"; +var bundleVersion = "codeql-bundle-v2.26.2"; +var cliVersion = "2.26.2"; // src/overlay/index.ts var fs4 = __toESM(require("fs")); diff --git a/src/defaults.json b/src/defaults.json index 39ecfc35fa..558dce6e24 100644 --- a/src/defaults.json +++ b/src/defaults.json @@ -1,6 +1,6 @@ { - "bundleVersion": "codeql-bundle-v2.26.1", - "cliVersion": "2.26.1", - "priorBundleVersion": "codeql-bundle-v2.26.0", - "priorCliVersion": "2.26.0" + "bundleVersion": "codeql-bundle-v2.26.2", + "cliVersion": "2.26.2", + "priorBundleVersion": "codeql-bundle-v2.26.1", + "priorCliVersion": "2.26.1" } From c62d82468641dca0f8df108ab73e2a8407ac9cf7 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Wed, 29 Jul 2026 12:22:31 +0000 Subject: [PATCH 79/95] Add changelog note --- CHANGELOG.md | 1 + 1 file changed, 1 insertion(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 170e03cc37..5fca32b978 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -5,6 +5,7 @@ See the [releases page](https://github.com/github/codeql-action/releases) for th ## [UNRELEASED] - This version of the CodeQL Action adds support for the `tools` input for the `codeql-action/init` step to be specified using a `github-codeql-tools` [repository property](https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization). This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to `toolcache` to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for `tools` in the workflow definition always takes precedence unless the value of the repository property starts with `!`. [#4037](https://github.com/github/codeql-action/pull/4037) +- Update default CodeQL bundle version to [2.26.2](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2). [#4051](https://github.com/github/codeql-action/pull/4051) ## 4.37.3 - 22 Jul 2026 From d2f5cbbe919141b077e54396de7bb0c31da73912 Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Wed, 29 Jul 2026 13:22:46 +0100 Subject: [PATCH 80/95] Add `get` method to `ReadOnlyEnv` --- lib/entry-points.js | 4 ++++ src/environment.ts | 5 +++++ 2 files changed, 9 insertions(+) diff --git a/lib/entry-points.js b/lib/entry-points.js index a2f6d22c52..9a7fbaa8e2 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -141565,6 +141565,10 @@ var ReadOnlyEnv = class { clone() { return Object.create(this, { vars: { value: { ...this.vars } } }); } + /** Gets a copy of the underlying environment. */ + get() { + return { ...this.vars }; + } /** Tries to get the value for `name` and throws if there isn't one. */ getRequired(name) { return getRequiredEnvVar(this.vars, name); diff --git a/src/environment.ts b/src/environment.ts index fea553d602..d6ff20391a 100644 --- a/src/environment.ts +++ b/src/environment.ts @@ -270,6 +270,11 @@ export class ReadOnlyEnv { return Object.create(this, { vars: { value: { ...this.vars } } }) as this; } + /** Gets a copy of the underlying environment. */ + public get(): Record { + return { ...this.vars }; + } + /** Tries to get the value for `name` and throws if there isn't one. */ public getRequired(name: string): string { return getRequiredEnvVar(this.vars, name); From 0cebd1d28d761cf2fceb2a3a9ed79dff79ea5a8c Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Wed, 29 Jul 2026 13:24:33 +0100 Subject: [PATCH 81/95] Add `hasEnv` delayed assertion and use for `getJobUUID` test --- src/status-report.test.ts | 15 +++++---------- src/testing-utils.ts | 22 ++++++++++++++++++++++ 2 files changed, 27 insertions(+), 10 deletions(-) diff --git a/src/status-report.test.ts b/src/status-report.test.ts index 9d0c62efb1..17490a60cb 100644 --- a/src/status-report.test.ts +++ b/src/status-report.test.ts @@ -29,21 +29,16 @@ import { BuildMode, ConfigurationError, withTmpDir, wrapError } from "./util"; setupTests(test); test("getJobUUID - generates valid UUIDs", async (t) => { - const exportVariableStub: sinon.SinonStub<[string, string], void> = - sinon.stub(); - await callee(getJobUUID) .withArgs() - .withActions((env) => { - env.exportVariable = exportVariableStub; - }) .logs(t, "Job run UUID is ") + .hasEnv(t, (val) => { + return { + [EnvVar.JOB_RUN_UUID]: val, + }; + }) .passes((val) => { t.true(uuid.validate(val)); - - const calls = exportVariableStub.getCalls(); - t.is(calls.length, 1); - t.deepEqual(calls[0].args, [EnvVar.JOB_RUN_UUID, val]); }); }); diff --git a/src/testing-utils.ts b/src/testing-utils.ts index 94c8435218..279459275d 100644 --- a/src/testing-utils.ts +++ b/src/testing-utils.ts @@ -378,6 +378,28 @@ abstract class BaseEnvBuilder< return result; } + /** + * Adds a delayed check that the environment variables returned by `fn` + * are present in the environment after the main assertion passes. + */ + public hasEnv( + t: ExecutionContext, + fn: ( + value: Awaited | undefined, + error: ThrownError | undefined, + ) => Record, + ): this { + const result = this.clone(); + result.checks.push(async (env, r) => { + const value = r.orElse(undefined); + const error = r.isFailure() ? r.value : undefined; + const expected = fn(value, error); + + t.like(env.getState().env.get(), expected); + }); + return result; + } + /** * Adds a delayed check that `messages` are not logged. The check will be * performed after the main assertion passes. From b411bbcd4ad96437e66f359abc5b628477549c83 Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Wed, 29 Jul 2026 14:27:24 +0100 Subject: [PATCH 82/95] Move `getJobUUID` call into `runInActions` for `init` and `setup-codeql` --- lib/entry-points.js | 8 ++++---- src/action-common.ts | 10 ++++++++-- src/init-action.ts | 4 ---- src/setup-codeql-action.ts | 4 ---- 4 files changed, 12 insertions(+), 14 deletions(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index 9a7fbaa8e2..c56f671098 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -146700,13 +146700,15 @@ async function runInActions(action) { const env = getEnv(); const actionsEnv = getActionsEnv(); try { - await action.run({ + const actionState = { name: action.name, startedAt, logger, env, actions: actionsEnv - }); + }; + getJobUUID(actionState); + await action.run(actionState); } catch (error3) { core8.setFailed( `${getDisplayActionName(action.name)} action failed: ${getErrorMessage(error3)}` @@ -160779,7 +160781,6 @@ async function run3(actionState) { logger ); const repositoryProperties = repositoryPropertiesResult.orElse({}); - getJobUUID(actionState); core21.exportVariable("CODEQL_ACTION_INIT_HAS_RUN" /* INIT_ACTION_HAS_RUN */, "true"); sourceRoot = path24.resolve( getRequiredEnvParam("GITHUB_WORKSPACE"), @@ -161777,7 +161778,6 @@ async function run6(actionState) { ); const repositoryProperties = repositoryPropertiesResult.orElse({}); const actionStateWithFeatures = { ...actionState, features }; - getJobUUID(actionState); const statusReportBase = await createStatusReportBase( "setup-codeql" /* SetupCodeQL */, "starting", diff --git a/src/action-common.ts b/src/action-common.ts index cbb1cd3422..be8629addf 100644 --- a/src/action-common.ts +++ b/src/action-common.ts @@ -8,6 +8,7 @@ import { getActionsLogger, Logger } from "./logging"; import { ActionName, getDisplayActionName, + getJobUUID, sendUnhandledErrorStatusReport, } from "./status-report"; import { getEnv, getErrorMessage } from "./util"; @@ -88,13 +89,18 @@ export async function runInActions(action: Action) { const actionsEnv = getActionsEnv(); try { - await action.run({ + const actionState = { name: action.name, startedAt, logger, env, actions: actionsEnv, - }); + }; + + // Create a unique identifier for this run. + getJobUUID(actionState); + + await action.run(actionState); } catch (error) { core.setFailed( `${getDisplayActionName(action.name)} action failed: ${getErrorMessage(error)}`, diff --git a/src/init-action.ts b/src/init-action.ts index f1c3916318..00143df427 100644 --- a/src/init-action.ts +++ b/src/init-action.ts @@ -68,7 +68,6 @@ import { createInitWithConfigStatusReport, createStatusReportBase, getActionsStatus, - getJobUUID, sendStatusReport, } from "./status-report"; import { ToolsDownloadStatusReport } from "./tools-download"; @@ -255,9 +254,6 @@ async function run( ); const repositoryProperties = repositoryPropertiesResult.orElse({}); - // Create a unique identifier for this run. - getJobUUID(actionState); - core.exportVariable(EnvVar.INIT_ACTION_HAS_RUN, "true"); // path.resolve() respects the intended semantics of source-root. If diff --git a/src/setup-codeql-action.ts b/src/setup-codeql-action.ts index d2f8c6104b..7873449f9c 100644 --- a/src/setup-codeql-action.ts +++ b/src/setup-codeql-action.ts @@ -25,7 +25,6 @@ import { InitToolsDownloadFields, createStatusReportBase, getActionsStatus, - getJobUUID, sendStatusReport, } from "./status-report"; import { ToolsDownloadStatusReport } from "./tools-download"; @@ -140,9 +139,6 @@ async function run( const actionStateWithFeatures = { ...actionState, features }; - // Create a unique identifier for this run. - getJobUUID(actionState); - const statusReportBase = await createStatusReportBase( ActionName.SetupCodeQL, "starting", From ba46ff760e2acb42dc881f443ad2bb3cd9de9d28 Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Wed, 29 Jul 2026 14:39:30 +0100 Subject: [PATCH 83/95] Add `transformTelemetryError` option to `Action` --- lib/entry-points.js | 8 +++++++- src/action-common.ts | 20 ++++++++++++++++++-- 2 files changed, 25 insertions(+), 3 deletions(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index c56f671098..456ce1be7f 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -146713,7 +146713,13 @@ async function runInActions(action) { core8.setFailed( `${getDisplayActionName(action.name)} action failed: ${getErrorMessage(error3)}` ); - await sendUnhandledErrorStatusReport(action.name, startedAt, error3, logger); + const statusReportError = action.transformTelemetryError !== void 0 ? action.transformTelemetryError(wrapError(error3)) : error3; + await sendUnhandledErrorStatusReport( + action.name, + startedAt, + statusReportError, + logger + ); } } diff --git a/src/action-common.ts b/src/action-common.ts index be8629addf..95323e7f2a 100644 --- a/src/action-common.ts +++ b/src/action-common.ts @@ -11,7 +11,7 @@ import { getJobUUID, sendUnhandledErrorStatusReport, } from "./status-report"; -import { getEnv, getErrorMessage } from "./util"; +import { getEnv, getErrorMessage, wrapError } from "./util"; /** Base state that is available to an Action on startup. */ export interface BaseState { @@ -79,6 +79,12 @@ export interface Action { name: ActionName; /** The entry point for the Action. */ run: ActionMain; + /** + * An optional function that transforms a caught error into a message suitable for + * inclusion in a status report. This is primarily intended for the `start-proxy` + * action to replace the thrown `Error`'s message with a safe one. + */ + transformTelemetryError?: (error: Error) => string; } /** A generic entry point that sets up the basic environment for the `action` and runs it. */ @@ -105,6 +111,16 @@ export async function runInActions(action: Action) { core.setFailed( `${getDisplayActionName(action.name)} action failed: ${getErrorMessage(error)}`, ); - await sendUnhandledErrorStatusReport(action.name, startedAt, error, logger); + + const statusReportError = + action.transformTelemetryError !== undefined + ? action.transformTelemetryError(wrapError(error)) + : error; + await sendUnhandledErrorStatusReport( + action.name, + startedAt, + statusReportError, + logger, + ); } } From 8e6fdffc3205654e6d9f7e9a5976eaf55dee895b Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Wed, 29 Jul 2026 14:44:24 +0100 Subject: [PATCH 84/95] Use `runInActions` for `start-proxy` --- lib/entry-points.js | 38 +++++++++++-------------------- src/start-proxy-action.ts | 47 ++++++++++++--------------------------- 2 files changed, 27 insertions(+), 58 deletions(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index 456ce1be7f..66e153b792 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -21567,7 +21567,7 @@ var require_core = __commonJS({ exports2.getBooleanInput = getBooleanInput; exports2.setOutput = setOutput7; exports2.setCommandEcho = setCommandEcho; - exports2.setFailed = setFailed13; + exports2.setFailed = setFailed12; exports2.isDebug = isDebug5; exports2.debug = debug6; exports2.error = error3; @@ -21651,7 +21651,7 @@ Support boolean input list: \`true | True | TRUE | false | False | FALSE\``); function setCommandEcho(enabled) { (0, command_1.issue)("echo", enabled ? "on" : "off"); } - function setFailed13(message) { + function setFailed12(message) { process.exitCode = ExitCode.Failure; error3(message); } @@ -121094,11 +121094,11 @@ Support boolean input list: \`true | True | TRUE | false | False | FALSE\``); (0, command_1.issue)("echo", enabled ? "on" : "off"); } exports2.setCommandEcho = setCommandEcho; - function setFailed13(message) { + function setFailed12(message) { process.exitCode = ExitCode.Failure; error3(message); } - exports2.setFailed = setFailed13; + exports2.setFailed = setFailed12; function isDebug5() { return process.env["RUNNER_DEBUG"] === "1"; } @@ -162654,17 +162654,12 @@ async function checkConnections(logger, proxy, backend) { } // src/start-proxy-action.ts -async function run7(startedAt) { - const logger = getActionsLogger(); +async function run7(action) { + const startedAt = action.startedAt; + const logger = action.logger; let features; let language; try { - const action = { - logger, - env: getEnv(), - actions: getActionsEnv() - }; - getJobUUID(action); persistInputs(); const tempDir = getTemporaryDirectory(); const proxyLogFilePath = path28.resolve(tempDir, "proxy.log"); @@ -162727,20 +162722,13 @@ async function run7(startedAt) { await sendFailedStatusReport(logger, startedAt, language, unwrappedError); } } +var startProxyAction = { + name: "start-proxy" /* StartProxy */, + run: run7, + transformTelemetryError: getSafeErrorMessage +}; async function runWrapper8() { - const startedAt = /* @__PURE__ */ new Date(); - const logger = getActionsLogger(); - try { - await run7(startedAt); - } catch (error3) { - core27.setFailed(`start-proxy action failed: ${getErrorMessage(error3)}`); - await sendUnhandledErrorStatusReport( - "start-proxy" /* StartProxy */, - startedAt, - getSafeErrorMessage(wrapError(error3)), - logger - ); - } + await runInActions(startProxyAction); } async function startProxy(binPath, config, logFilePath, logger) { const host = "127.0.0.1"; diff --git a/src/start-proxy-action.ts b/src/start-proxy-action.ts index 67f6d50177..e8b89732f7 100644 --- a/src/start-proxy-action.ts +++ b/src/start-proxy-action.ts @@ -3,12 +3,12 @@ import * as path from "path"; import * as core from "@actions/core"; -import { ActionState } from "./action-common"; +import { Action, ActionState, runInActions } from "./action-common"; import * as actionsUtil from "./actions-util"; import { getGitHubVersion } from "./api-client"; import { FeatureEnablement, initFeatures } from "./feature-flags"; import { BuiltInLanguage, parseBuiltInLanguage } from "./languages"; -import { getActionsLogger, Logger } from "./logging"; +import { Logger } from "./logging"; import { getRepositoryNwo } from "./repository"; import { credentialToStr, @@ -24,31 +24,18 @@ import { import { generateCertificateAuthority } from "./start-proxy/ca"; import { checkProxyEnvironment } from "./start-proxy/environment"; import { checkConnections } from "./start-proxy/reachability"; -import { - ActionName, - getJobUUID, - sendUnhandledErrorStatusReport, -} from "./status-report"; +import { ActionName } from "./status-report"; import * as util from "./util"; -async function run(startedAt: Date) { +async function run(action: ActionState<["Base", "Logger", "Env", "Actions"]>) { // To capture errors appropriately, keep as much code within the try-catch as // possible, and only use safe functions outside. - - const logger = getActionsLogger(); + const startedAt = action.startedAt; + const logger = action.logger; let features: FeatureEnablement | undefined; let language: BuiltInLanguage | undefined; try { - const action: ActionState<["Logger", "Env", "Actions"]> = { - logger, - env: util.getEnv(), - actions: actionsUtil.getActionsEnv(), - }; - - // Create a unique identifier for this run. - getJobUUID(action); - // Make inputs accessible in the `post` step. actionsUtil.persistInputs(); @@ -136,21 +123,15 @@ async function run(startedAt: Date) { } } -export async function runWrapper() { - const startedAt = new Date(); - const logger = getActionsLogger(); +/** Defines the `start-proxy` Action. */ +const startProxyAction: Action = { + name: ActionName.StartProxy, + run, + transformTelemetryError: getSafeErrorMessage, +}; - try { - await run(startedAt); - } catch (error) { - core.setFailed(`start-proxy action failed: ${util.getErrorMessage(error)}`); - await sendUnhandledErrorStatusReport( - ActionName.StartProxy, - startedAt, - getSafeErrorMessage(util.wrapError(error)), - logger, - ); - } +export async function runWrapper() { + await runInActions(startProxyAction); } async function startProxy( From e40d079dd9dd4a5c74f625cecd83867c8208aa71 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Wed, 29 Jul 2026 14:37:39 +0000 Subject: [PATCH 85/95] Update changelog for v4.37.4 --- CHANGELOG.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 5fca32b978..51bb95d5c8 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,7 +2,7 @@ See the [releases page](https://github.com/github/codeql-action/releases) for the relevant changes to the CodeQL CLI and language packs. -## [UNRELEASED] +## 4.37.4 - 29 Jul 2026 - This version of the CodeQL Action adds support for the `tools` input for the `codeql-action/init` step to be specified using a `github-codeql-tools` [repository property](https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization). This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to `toolcache` to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for `tools` in the workflow definition always takes precedence unless the value of the repository property starts with `!`. [#4037](https://github.com/github/codeql-action/pull/4037) - Update default CodeQL bundle version to [2.26.2](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2). [#4051](https://github.com/github/codeql-action/pull/4051) From d57c3ffcba10414c396e4bc89f526c3875e18a0d Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Wed, 29 Jul 2026 15:38:27 +0100 Subject: [PATCH 86/95] Add tests for `runInActions` --- src/action-common.test.ts | 123 ++++++++++++++++++++++++++++++++++++++ 1 file changed, 123 insertions(+) create mode 100644 src/action-common.test.ts diff --git a/src/action-common.test.ts b/src/action-common.test.ts new file mode 100644 index 0000000000..fc2e0a9aaa --- /dev/null +++ b/src/action-common.test.ts @@ -0,0 +1,123 @@ +import * as core from "@actions/core"; +import test from "ava"; +import sinon from "sinon"; + +import * as common from "./action-common"; +import * as actionsUtil from "./actions-util"; +import * as environment from "./environment"; +import * as logging from "./logging"; +import { ActionName } from "./status-report"; +import * as statusReport from "./status-report"; +import { + getTestActionsEnv, + getTestEnv, + makeMacro, + RecordingLogger, + setupTests, +} from "./testing-utils"; +import { getErrorMessage } from "./util"; + +setupTests(test); + +interface RunInActionsTestOpts { + runFn?: () => Promise; + expectedErrorMessage?: string; + expectedTelemetryError?: string; +} + +const runInActionsMacro = makeMacro({ + exec: async (t, opts: RunInActionsTestOpts) => { + const expectFailure = opts?.expectedErrorMessage !== undefined; + + const logger = new RecordingLogger(); + const getActionsLogger = sinon + .stub(logging, "getActionsLogger") + .returns(logger); + + const env = getTestEnv(); + const getEnv = sinon.stub(environment, "getEnv").returns(env); + + const actionsEnv = getTestActionsEnv(env); + const getActionsEnv = sinon + .stub(actionsUtil, "getActionsEnv") + .returns(actionsEnv); + + const getJobUUID = sinon + .stub(statusReport, "getJobUUID") + .returns("test-job-uuid"); + + const setFailed = sinon.stub(core, "setFailed"); + const sendUnhandledErrorStatusReport = sinon.stub( + statusReport, + "sendUnhandledErrorStatusReport", + ); + + const name = ActionName.Init; + const run = sinon.stub(); + + if (opts?.runFn) { + run.callsFake(opts.runFn); + } + + const transformTelemetryError = sinon + .stub() + .callsFake((err) => opts?.expectedTelemetryError ?? getErrorMessage(err)); + const testAction: common.Action = { + name, + run, + transformTelemetryError, + }; + + await common.runInActions(testAction); + + // These always should have been called once. + t.true(getActionsLogger.calledOnce); + t.true(getEnv.calledOnce); + t.true(getActionsEnv.calledOnce); + + const expectedActionState = { + actions: actionsEnv, + env, + logger, + name: ActionName.Init, + }; + + t.true(getJobUUID.calledOnceWithExactly(sinon.match(expectedActionState))); + t.true(run.calledOnceWithExactly(sinon.match(expectedActionState))); + + t.is(setFailed.calledOnce, expectFailure ?? false); + t.is(sendUnhandledErrorStatusReport.calledOnce, expectFailure ?? false); + + if (expectFailure) { + t.true( + setFailed.calledOnceWithExactly( + `${statusReport.getDisplayActionName(name)} action failed: ${opts?.expectedErrorMessage}`, + ), + ); + t.true( + sendUnhandledErrorStatusReport.calledOnceWithExactly( + name, + sinon.match.any, + opts?.expectedTelemetryError ?? opts?.expectedErrorMessage, + logger, + ), + ); + } + }, + title: (providedTitle) => `runInActions - ${providedTitle}`, +}); + +runInActionsMacro.serial("calls run", {}); +runInActionsMacro.serial("handles run exceptions", { + runFn: () => { + throw new Error("Test failure"); + }, + expectedErrorMessage: "Test failure", +}); +runInActionsMacro.serial("transforms run exceptions", { + runFn: () => { + throw new Error("Test failure"); + }, + expectedErrorMessage: "Test failure", + expectedTelemetryError: "Transformed failure message", +}); From 8f0a4f23c4e6fd3bdc74965a57db44f356b5ee32 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 29 Jul 2026 17:54:52 +0000 Subject: [PATCH 87/95] Bump the npm-minor group across 1 directory with 2 updates Bumps the npm-minor group with 2 updates in the / directory: [sinon](https://github.com/sinonjs/sinon) and [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint). Updates `sinon` from 22.0.0 to 22.1.0 - [Release notes](https://github.com/sinonjs/sinon/releases) - [Changelog](https://github.com/sinonjs/sinon/blob/main/CHANGES.md) - [Commits](https://github.com/sinonjs/sinon/compare/v22.0.0...v22.1.0) Updates `typescript-eslint` from 8.64.0 to 8.65.0 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.65.0/packages/typescript-eslint) --- updated-dependencies: - dependency-name: sinon dependency-version: 22.1.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-minor - dependency-name: typescript-eslint dependency-version: 8.65.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-minor ... Signed-off-by: dependabot[bot] --- package-lock.json | 148 +++++++++++++++++++++++----------------------- package.json | 4 +- 2 files changed, 76 insertions(+), 76 deletions(-) diff --git a/package-lock.json b/package-lock.json index a01b4a12e7..1e395f75fb 100644 --- a/package-lock.json +++ b/package-lock.json @@ -63,9 +63,9 @@ "glob": "^13.0.6", "globals": "^17.7.0", "nock": "^14.0.16", - "sinon": "^22.0.0", + "sinon": "^22.1.0", "typescript": "^6.0.3", - "typescript-eslint": "^8.64.0" + "typescript-eslint": "^8.65.0" } }, "node_modules/@aashutoshrathi/word-wrap": { @@ -2591,17 +2591,17 @@ "license": "MIT" }, "node_modules/@typescript-eslint/eslint-plugin": { - "version": "8.64.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-8.64.0.tgz", - "integrity": "sha512-CGvQPBxN3wZLu6Rz2kFUpZeoCm78xUic92ck39KPePkO1NPOwjCqdQnm5Q87tpWw9vcBvW8XLrDXjH9PWYtJ3Q==", + "version": "8.65.0", + "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-8.65.0.tgz", + "integrity": "sha512-IEgob78X12rHpUmtcwFsXhZdVGJtwTVP8FiCLZkR6GlYVrl2PcuB+KhCE5BlVC/eQpQnu8WXRtkHZuPar+gCRA==", "dev": true, "license": "MIT", "dependencies": { "@eslint-community/regexpp": "^4.12.2", - "@typescript-eslint/scope-manager": "8.64.0", - "@typescript-eslint/type-utils": "8.64.0", - "@typescript-eslint/utils": "8.64.0", - "@typescript-eslint/visitor-keys": "8.64.0", + "@typescript-eslint/scope-manager": "8.65.0", + "@typescript-eslint/type-utils": "8.65.0", + "@typescript-eslint/utils": "8.65.0", + "@typescript-eslint/visitor-keys": "8.65.0", "ignore": "^7.0.5", "natural-compare": "^1.4.0", "ts-api-utils": "^2.5.0" @@ -2614,7 +2614,7 @@ "url": "https://opencollective.com/typescript-eslint" }, "peerDependencies": { - "@typescript-eslint/parser": "^8.64.0", + "@typescript-eslint/parser": "^8.65.0", "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0", "typescript": ">=4.8.4 <6.1.0" } @@ -2630,16 +2630,16 @@ } }, "node_modules/@typescript-eslint/parser": { - "version": "8.64.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-8.64.0.tgz", - "integrity": "sha512-KA0OshtlcCCXmbfqyZkM5pV3/WNraJf7DkJRLpyrmwPtud57H5BDX7C3k0LPSPxpprfRL+cJDGabF10mvNCoCw==", + "version": "8.65.0", + "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-8.65.0.tgz", + "integrity": "sha512-CZ4nMxWwgu1HEEFNkeaCptra9QCtkmKdgf3sWh1rl1trIhmxLilgTV4cwcbQ4wemnT4sWQN8CaKOmdYx+g2gMA==", "dev": true, "license": "MIT", "dependencies": { - "@typescript-eslint/scope-manager": "8.64.0", - "@typescript-eslint/types": "8.64.0", - "@typescript-eslint/typescript-estree": "8.64.0", - "@typescript-eslint/visitor-keys": "8.64.0", + "@typescript-eslint/scope-manager": "8.65.0", + "@typescript-eslint/types": "8.65.0", + "@typescript-eslint/typescript-estree": "8.65.0", + "@typescript-eslint/visitor-keys": "8.65.0", "debug": "^4.4.3" }, "engines": { @@ -2673,14 +2673,14 @@ } }, "node_modules/@typescript-eslint/project-service": { - "version": "8.64.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/project-service/-/project-service-8.64.0.tgz", - "integrity": "sha512-tk4WpOJ6IEbGrVHaNmM0YRrwAD3exZlIK3iadQNAxh4YKk6jvUQ4ecq18n+v7+meh+cJ3j+D8nbk8sRKhlwLQg==", + "version": "8.65.0", + "resolved": "https://registry.npmjs.org/@typescript-eslint/project-service/-/project-service-8.65.0.tgz", + "integrity": "sha512-SxnPhbTsGahizDgbu7oqFH/xVtzIqMd/s+WtnSxNxJZJpLbdT5IPdzg8EZxO3+PoKahXmwJLeNQOpKJb3/bi7Q==", "dev": true, "license": "MIT", "dependencies": { - "@typescript-eslint/tsconfig-utils": "^8.64.0", - "@typescript-eslint/types": "^8.64.0", + "@typescript-eslint/tsconfig-utils": "^8.65.0", + "@typescript-eslint/types": "^8.65.0", "debug": "^4.4.3" }, "engines": { @@ -2713,14 +2713,14 @@ } }, "node_modules/@typescript-eslint/scope-manager": { - "version": "8.64.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.64.0.tgz", - "integrity": "sha512-CXEaFdYXjSTgKhisNkwCcJwTP8Pl+fmRrEQrri4nm3vU743bALrxzLmq7fHG/7e6a5xO0lDYeURpZmBuhHk54w==", + "version": "8.65.0", + "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.65.0.tgz", + "integrity": "sha512-Esbl8OSYiVxBokYgWPf7VVWg/BE798wXhimnn9ML9Pt5qoDf8bfQlgjlKXR/k98+AcNzlLKYrpCcrcuZ9DZLgg==", "dev": true, "license": "MIT", "dependencies": { - "@typescript-eslint/types": "8.64.0", - "@typescript-eslint/visitor-keys": "8.64.0" + "@typescript-eslint/types": "8.65.0", + "@typescript-eslint/visitor-keys": "8.65.0" }, "engines": { "node": "^18.18.0 || ^20.9.0 || >=21.1.0" @@ -2731,9 +2731,9 @@ } }, "node_modules/@typescript-eslint/tsconfig-utils": { - "version": "8.64.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/tsconfig-utils/-/tsconfig-utils-8.64.0.tgz", - "integrity": "sha512-2yo8rRNKuzbVWQp5kslhANqZ2uDAeROQHBRZNPu8JDsHmeFNj/XJJhX/FhNUWmkHHvoNsKa6+tHJiig87EzsQw==", + "version": "8.65.0", + "resolved": "https://registry.npmjs.org/@typescript-eslint/tsconfig-utils/-/tsconfig-utils-8.65.0.tgz", + "integrity": "sha512-j6GzGqCiRdA7Qhur2VVmKZAkBLfnHFQfx4TaJGL9RMveZqCo48jSHHO0DTgizEnGhtWnqmbtCUSrqSkdiY/0Hg==", "dev": true, "license": "MIT", "engines": { @@ -2748,15 +2748,15 @@ } }, "node_modules/@typescript-eslint/type-utils": { - "version": "8.64.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/type-utils/-/type-utils-8.64.0.tgz", - "integrity": "sha512-XWG4Fmmv/6SvyS9nH8jWrKs6terwJvE8cyRt1CzYYqzp9OrPhCT4cMc/f7C6RZCwG+qMmiffJS1/qJP8G1URtg==", + "version": "8.65.0", + "resolved": "https://registry.npmjs.org/@typescript-eslint/type-utils/-/type-utils-8.65.0.tgz", + "integrity": "sha512-YjaZ7PRI5qY7ax2L3PbvX0rRyGtipAReCWs0mhhDBHjH/vl0g0BonaGXrKdKpMbIIsMIwDgbk/xzkBTyAltS5g==", "dev": true, "license": "MIT", "dependencies": { - "@typescript-eslint/types": "8.64.0", - "@typescript-eslint/typescript-estree": "8.64.0", - "@typescript-eslint/utils": "8.64.0", + "@typescript-eslint/types": "8.65.0", + "@typescript-eslint/typescript-estree": "8.65.0", + "@typescript-eslint/utils": "8.65.0", "debug": "^4.4.3", "ts-api-utils": "^2.5.0" }, @@ -2791,9 +2791,9 @@ } }, "node_modules/@typescript-eslint/types": { - "version": "8.64.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.64.0.tgz", - "integrity": "sha512-qjhfuTfLXjA4IOzXvz0rTjT01BqEiIgPoUeMwiEjnaHKJMTNo8rH5pYW1a2L/0Dnux2fPC85AeyJoWaGa8WxTA==", + "version": "8.65.0", + "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.65.0.tgz", + "integrity": "sha512-JSSwWNy+H0E/01jJEM+hrX6N0OFDzFzeIhHFSAS01tlVaevpG8cFyYRPhS5yjGOvBUx3sqQHVMjCL1CAZZMxBg==", "dev": true, "license": "MIT", "engines": { @@ -2805,16 +2805,16 @@ } }, "node_modules/@typescript-eslint/typescript-estree": { - "version": "8.64.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.64.0.tgz", - "integrity": "sha512-Pztpsn1aCE1oWDvDEfUk31nngvvF7vUB5SwHFEaZIFpvw7WJtqUHHL4plBZDA9HfWJJjL13BdG0YrJInTUvoVA==", + "version": "8.65.0", + "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.65.0.tgz", + "integrity": "sha512-JboAE2swaYt4tb1fHhHTABE2K+OLy09XfcTbhnk4Pw96f9dd2e9iYsJ28gBggHlo5z5x1rkyWvcPoTuNTd4oGg==", "dev": true, "license": "MIT", "dependencies": { - "@typescript-eslint/project-service": "8.64.0", - "@typescript-eslint/tsconfig-utils": "8.64.0", - "@typescript-eslint/types": "8.64.0", - "@typescript-eslint/visitor-keys": "8.64.0", + "@typescript-eslint/project-service": "8.65.0", + "@typescript-eslint/tsconfig-utils": "8.65.0", + "@typescript-eslint/types": "8.65.0", + "@typescript-eslint/visitor-keys": "8.65.0", "debug": "^4.4.3", "minimatch": "^10.2.2", "semver": "^7.7.3", @@ -2843,16 +2843,16 @@ } }, "node_modules/@typescript-eslint/typescript-estree/node_modules/brace-expansion": { - "version": "5.0.7", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.7.tgz", - "integrity": "sha512-7oFy703dxfY3/NLxC1fh2SUCQ0H9rmAY+5EpDVfXjUTTs+HEwR2nYaqLv+GWcTsumwxPfiz6CzCNkwXwBUwqCA==", + "version": "5.0.8", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.8.tgz", + "integrity": "sha512-JZyDyq3D4AUifKTPOB7DELf6XsB3WdPuNxCtob1vFXPsSXhdAiHBWJ/tJ8HAc9aH84BK+5JFZLNkJKx3G9kzQg==", "dev": true, "license": "MIT", "dependencies": { "balanced-match": "^4.0.2" }, "engines": { - "node": "18 || 20 || >=22" + "node": "20 || >=22" } }, "node_modules/@typescript-eslint/typescript-estree/node_modules/debug": { @@ -2874,13 +2874,13 @@ } }, "node_modules/@typescript-eslint/typescript-estree/node_modules/minimatch": { - "version": "10.2.5", - "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.5.tgz", - "integrity": "sha512-MULkVLfKGYDFYejP07QOurDLLQpcjk7Fw+7jXS2R2czRQzR56yHRveU5NDJEOviH+hETZKSkIk5c+T23GjFUMg==", + "version": "10.2.6", + "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.6.tgz", + "integrity": "sha512-vpLQEs+VLCr1nU0BXS07maYoFwlDAH0gngQuuttxIwutDFEMHq2blX+8vpgxDdK3J1PwjCJiep77OitTZ4Ll1A==", "dev": true, "license": "BlueOak-1.0.0", "dependencies": { - "brace-expansion": "^5.0.5" + "brace-expansion": "^5.0.8" }, "engines": { "node": "18 || 20 || >=22" @@ -2890,16 +2890,16 @@ } }, "node_modules/@typescript-eslint/utils": { - "version": "8.64.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-8.64.0.tgz", - "integrity": "sha512-aJUGVB3+U0htrrCjoA8qukw8cm8fNCGAxK/tVoS70k8aeb7DETKeFozRiVFIwEeN9WJLsjaP3ph8I60tY2XZoQ==", + "version": "8.65.0", + "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-8.65.0.tgz", + "integrity": "sha512-gXiwIHsYreboxeJucHKPvgwl7dXt50mF8s1/c00cP/WoVTyWKFdtfhRWwZiXYFU5H2O8vVoSLNrexFZjYS/SGA==", "dev": true, "license": "MIT", "dependencies": { "@eslint-community/eslint-utils": "^4.9.1", - "@typescript-eslint/scope-manager": "8.64.0", - "@typescript-eslint/types": "8.64.0", - "@typescript-eslint/typescript-estree": "8.64.0" + "@typescript-eslint/scope-manager": "8.65.0", + "@typescript-eslint/types": "8.65.0", + "@typescript-eslint/typescript-estree": "8.65.0" }, "engines": { "node": "^18.18.0 || ^20.9.0 || >=21.1.0" @@ -2914,13 +2914,13 @@ } }, "node_modules/@typescript-eslint/visitor-keys": { - "version": "8.64.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.64.0.tgz", - "integrity": "sha512-mrtuL8Nsn6gi2H4mo5KMTp823M+3Q19Ew/i+Zlikq20tIMm99C3Ez0dCmkWWnxut20esQvTg8aUSEhMcAOXhEw==", + "version": "8.65.0", + "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.65.0.tgz", + "integrity": "sha512-8C71BQkGjiMmXtop7pHVJu1l2NNShFdkCyD6a2ezzs5vU/L3LRtb69EtcteFwz0mYMPzIgOw0n6OV4VBUWZd7A==", "dev": true, "license": "MIT", "dependencies": { - "@typescript-eslint/types": "8.64.0", + "@typescript-eslint/types": "8.65.0", "eslint-visitor-keys": "^5.0.0" }, "engines": { @@ -8556,9 +8556,9 @@ } }, "node_modules/sinon": { - "version": "22.0.0", - "resolved": "https://registry.npmjs.org/sinon/-/sinon-22.0.0.tgz", - "integrity": "sha512-sq/6DpdXOrLyfbKlXLg/Usc7xu8YXPeLkOFZRvA3bNUSA2lhbrZ06yuXbH1fkzBPCbz9O10+7hznzUsjaYNm0Q==", + "version": "22.1.0", + "resolved": "https://registry.npmjs.org/sinon/-/sinon-22.1.0.tgz", + "integrity": "sha512-n1ajF2rBWMTtEwbKcw4UdFg4nCnDdq/U6RDoxtOd7oapOlRoJ5ynwFx60owROyhDpA9QhMZi0pCO/xtmwFjG7w==", "dev": true, "license": "BSD-3-Clause", "dependencies": { @@ -9320,16 +9320,16 @@ } }, "node_modules/typescript-eslint": { - "version": "8.64.0", - "resolved": "https://registry.npmjs.org/typescript-eslint/-/typescript-eslint-8.64.0.tgz", - "integrity": "sha512-0qg+pDNMnqYzqH9AnNK+39tejHvsShUOUUoRUgtnTGE7QuMZhiFDnozq8nHJVq+Wae6NMLKNWLg5WmkcC/ndyQ==", + "version": "8.65.0", + "resolved": "https://registry.npmjs.org/typescript-eslint/-/typescript-eslint-8.65.0.tgz", + "integrity": "sha512-/ggrHAwyjENDusvyxbuqxAC2dTnZg/Z8F+fgQtYIz+L6n/9HfSlEZcFGV/NsMNa6CkGk0xUjUAFwC0vHOflvIA==", "dev": true, "license": "MIT", "dependencies": { - "@typescript-eslint/eslint-plugin": "8.64.0", - "@typescript-eslint/parser": "8.64.0", - "@typescript-eslint/typescript-estree": "8.64.0", - "@typescript-eslint/utils": "8.64.0" + "@typescript-eslint/eslint-plugin": "8.65.0", + "@typescript-eslint/parser": "8.65.0", + "@typescript-eslint/typescript-estree": "8.65.0", + "@typescript-eslint/utils": "8.65.0" }, "engines": { "node": "^18.18.0 || ^20.9.0 || >=21.1.0" diff --git a/package.json b/package.json index cdd58cd167..ad959a5eee 100644 --- a/package.json +++ b/package.json @@ -71,9 +71,9 @@ "glob": "^13.0.6", "globals": "^17.7.0", "nock": "^14.0.16", - "sinon": "^22.0.0", + "sinon": "^22.1.0", "typescript": "^6.0.3", - "typescript-eslint": "^8.64.0" + "typescript-eslint": "^8.65.0" }, "overrides": { "@actions/tool-cache": { From 3502f795752239ff535bbb8c75134dce966e6700 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 29 Jul 2026 17:57:26 +0000 Subject: [PATCH 88/95] Bump ruby/setup-ruby Bumps the actions-minor group with 1 update in the /.github/workflows directory: [ruby/setup-ruby](https://github.com/ruby/setup-ruby). Updates `ruby/setup-ruby` from 1.319.0 to 1.321.0 - [Release notes](https://github.com/ruby/setup-ruby/releases) - [Changelog](https://github.com/ruby/setup-ruby/blob/master/release.rb) - [Commits](https://github.com/ruby/setup-ruby/compare/003a5c4d8d6321bd302e38f6f0ec593f77f06600...95ef2b042f9d7a56d8268cba8559e2842e2ad01b) --- updated-dependencies: - dependency-name: ruby/setup-ruby dependency-version: 1.321.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-minor ... Signed-off-by: dependabot[bot] --- .github/workflows/__rubocop-multi-language.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/__rubocop-multi-language.yml b/.github/workflows/__rubocop-multi-language.yml index 4809b680ab..c405b44fed 100644 --- a/.github/workflows/__rubocop-multi-language.yml +++ b/.github/workflows/__rubocop-multi-language.yml @@ -54,7 +54,7 @@ jobs: use-all-platform-bundle: 'false' setup-kotlin: 'true' - name: Set up Ruby - uses: ruby/setup-ruby@003a5c4d8d6321bd302e38f6f0ec593f77f06600 # v1.319.0 + uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0 with: ruby-version: 2.6 - name: Install Code Scanning integration From 60a57910be57f97ad7b63038a43680ac716a4039 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Wed, 29 Jul 2026 17:59:24 +0000 Subject: [PATCH 89/95] Rebuild --- pr-checks/checks/rubocop-multi-language.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pr-checks/checks/rubocop-multi-language.yml b/pr-checks/checks/rubocop-multi-language.yml index 7879653f38..37c5d36e90 100644 --- a/pr-checks/checks/rubocop-multi-language.yml +++ b/pr-checks/checks/rubocop-multi-language.yml @@ -5,7 +5,7 @@ versions: - default steps: - name: Set up Ruby - uses: ruby/setup-ruby@003a5c4d8d6321bd302e38f6f0ec593f77f06600 # v1.319.0 + uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0 with: ruby-version: 2.6 - name: Install Code Scanning integration From 82f035a50156142187b47d8eb748075dbde92426 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Thu, 30 Jul 2026 09:21:21 +0000 Subject: [PATCH 90/95] Update changelog and version after v4.37.4 --- CHANGELOG.md | 4 ++++ package-lock.json | 4 ++-- package.json | 2 +- 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 51bb95d5c8..65cd1e1fae 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,10 @@ See the [releases page](https://github.com/github/codeql-action/releases) for the relevant changes to the CodeQL CLI and language packs. +## [UNRELEASED] + +No user facing changes. + ## 4.37.4 - 29 Jul 2026 - This version of the CodeQL Action adds support for the `tools` input for the `codeql-action/init` step to be specified using a `github-codeql-tools` [repository property](https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization). This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to `toolcache` to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for `tools` in the workflow definition always takes precedence unless the value of the repository property starts with `!`. [#4037](https://github.com/github/codeql-action/pull/4037) diff --git a/package-lock.json b/package-lock.json index a01b4a12e7..b72c91e22b 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,12 +1,12 @@ { "name": "codeql", - "version": "4.37.4", + "version": "4.37.5", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "codeql", - "version": "4.37.4", + "version": "4.37.5", "license": "MIT", "workspaces": [ "pr-checks" diff --git a/package.json b/package.json index cdd58cd167..8b379f9c9c 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "codeql", - "version": "4.37.4", + "version": "4.37.5", "private": true, "description": "CodeQL action", "scripts": { From 06f1d4ffed243918940368743ff3fd9147859de6 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Thu, 30 Jul 2026 09:21:35 +0000 Subject: [PATCH 91/95] Rebuild --- lib/entry-points.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index eb81affd67..17f56246ae 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -145404,7 +145404,7 @@ function getDiffRangesJsonFilePath(env = getEnv()) { return path2.join(getTemporaryDirectory(env), PR_DIFF_RANGE_JSON_FILENAME); } function getActionVersion() { - return "4.37.4"; + return "4.37.5"; } function getWorkflowEventName(env = getEnv()) { return env.getRequired("GITHUB_EVENT_NAME" /* GITHUB_EVENT_NAME */); From 2d3b351ea6452a9b21346f8d64567e5b833924de Mon Sep 17 00:00:00 2001 From: sim Date: Thu, 30 Jul 2026 18:47:27 +0100 Subject: [PATCH 92/95] Handle network errors when streaming the CodeQL bundle download A network error such as `ECONNRESET` while streaming the download and extraction of the CodeQL bundle terminated the `init` Action rather than falling back to downloading the bundle before extracting it, since no `error` listener was attached to the request returned by `https.get`. Also pipe the response into `tar` using `stream.pipeline` so that errors on the response itself are surfaced and `tar`'s standard input is closed, and abort the request if it stalls. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- CHANGELOG.md | 2 +- lib/entry-points.js | 360 +++++++++++++++++++------------------ src/tar.test.ts | 33 ++++ src/tar.ts | 13 +- src/tools-download.test.ts | 37 ++++ src/tools-download.ts | 28 ++- 6 files changed, 290 insertions(+), 183 deletions(-) create mode 100644 src/tar.test.ts diff --git a/CHANGELOG.md b/CHANGELOG.md index 65cd1e1fae..c461878c51 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,7 +4,7 @@ See the [releases page](https://github.com/github/codeql-action/releases) for th ## [UNRELEASED] -No user facing changes. +- Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the `init` Action instead of falling back to downloading the bundle before extracting it. [#3367](https://github.com/github/codeql-action/issues/3367) ## 4.37.4 - 29 Jul 2026 diff --git a/lib/entry-points.js b/lib/entry-points.js index 8bea6abaaf..a03519a725 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -7069,7 +7069,7 @@ var require_client_h2 = __commonJS({ "node_modules/undici/lib/dispatcher/client-h2.js"(exports2, module2) { "use strict"; var assert = require("node:assert"); - var { pipeline } = require("node:stream"); + var { pipeline: pipeline2 } = require("node:stream"); var util3 = require_util(); var { RequestContentLengthMismatchError, @@ -7516,7 +7516,7 @@ var require_client_h2 = __commonJS({ } function writeStream(abort, socket, expectsPayload, h2stream, body, client, request3, contentLength) { assert(contentLength !== 0 || client[kRunning] === 0, "stream body cannot be pipelined"); - const pipe = pipeline( + const pipe = pipeline2( body, h2stream, (err) => { @@ -10506,7 +10506,7 @@ var require_api_pipeline = __commonJS({ util3.destroy(ret, err); } }; - function pipeline(opts, handler2) { + function pipeline2(opts, handler2) { try { const pipelineHandler = new PipelineHandler(opts, handler2); this.dispatch({ ...opts, body: pipelineHandler.req }, pipelineHandler); @@ -10515,7 +10515,7 @@ var require_api_pipeline = __commonJS({ return new PassThrough3().destroy(err); } } - module2.exports = pipeline; + module2.exports = pipeline2; } }); @@ -13680,7 +13680,7 @@ var require_fetch = __commonJS({ subresourceSet } = require_constants3(); var EE = require("node:events"); - var { Readable: Readable3, pipeline, finished } = require("node:stream"); + var { Readable: Readable3, pipeline: pipeline2, finished } = require("node:stream"); var { addAbortListener, isErrored, isReadable, bufferToLowerCasedHeaderName } = require_util(); var { dataURLProcessor, serializeAMimeType, minimizeSupportedMimeType } = require_data_url(); var { getGlobalDispatcher } = require_global2(); @@ -14624,7 +14624,7 @@ var require_fetch = __commonJS({ status, statusText, headersList, - body: decoders.length ? pipeline(this.body, ...decoders, (err) => { + body: decoders.length ? pipeline2(this.body, ...decoders, (err) => { if (err) { this.onError(err); } @@ -18604,7 +18604,7 @@ ${value}`; var require_eventsource = __commonJS({ "node_modules/undici/lib/web/eventsource/eventsource.js"(exports2, module2) { "use strict"; - var { pipeline } = require("node:stream"); + var { pipeline: pipeline2 } = require("node:stream"); var { fetching } = require_fetch(); var { makeRequest } = require_request2(); var { webidl } = require_webidl(); @@ -18762,7 +18762,7 @@ var require_eventsource = __commonJS({ )); } }); - pipeline( + pipeline2( response.body.stream, eventSourceStream, (error3) => { @@ -32788,8 +32788,8 @@ var require_internal_hash_files = __commonJS({ continue; } const hash2 = crypto3.createHash("sha256"); - const pipeline = util3.promisify(stream2.pipeline); - yield pipeline(fs31.createReadStream(file), hash2); + const pipeline2 = util3.promisify(stream2.pipeline); + yield pipeline2(fs31.createReadStream(file), hash2); result.write(hash2.digest()); count++; if (!hasMatch) { @@ -35356,12 +35356,12 @@ var require_pipeline = __commonJS({ } sendRequest(httpClient, request3) { const policies = this.getOrderedPolicies(); - const pipeline = policies.reduceRight((next, policy) => { + const pipeline2 = policies.reduceRight((next, policy) => { return (req) => { return policy.sendRequest(req, next); }; }, (req) => httpClient.sendRequest(req)); - return pipeline(request3); + return pipeline2(request3); } getOrderedPolicies() { if (!this._orderedPolicies) { @@ -38488,26 +38488,26 @@ var require_createPipelineFromOptions = __commonJS({ var tlsPolicy_js_1 = require_tlsPolicy(); var multipartPolicy_js_1 = require_multipartPolicy(); function createPipelineFromOptions(options) { - const pipeline = (0, pipeline_js_1.createEmptyPipeline)(); + const pipeline2 = (0, pipeline_js_1.createEmptyPipeline)(); if (checkEnvironment_js_1.isNodeLike) { if (options.agent) { - pipeline.addPolicy((0, agentPolicy_js_1.agentPolicy)(options.agent)); + pipeline2.addPolicy((0, agentPolicy_js_1.agentPolicy)(options.agent)); } if (options.tlsOptions) { - pipeline.addPolicy((0, tlsPolicy_js_1.tlsPolicy)(options.tlsOptions)); + pipeline2.addPolicy((0, tlsPolicy_js_1.tlsPolicy)(options.tlsOptions)); } - pipeline.addPolicy((0, proxyPolicy_js_1.proxyPolicy)(options.proxyOptions)); - pipeline.addPolicy((0, decompressResponsePolicy_js_1.decompressResponsePolicy)()); + pipeline2.addPolicy((0, proxyPolicy_js_1.proxyPolicy)(options.proxyOptions)); + pipeline2.addPolicy((0, decompressResponsePolicy_js_1.decompressResponsePolicy)()); } - pipeline.addPolicy((0, formDataPolicy_js_1.formDataPolicy)(), { beforePolicies: [multipartPolicy_js_1.multipartPolicyName] }); - pipeline.addPolicy((0, userAgentPolicy_js_1.userAgentPolicy)(options.userAgentOptions)); - pipeline.addPolicy((0, multipartPolicy_js_1.multipartPolicy)(), { afterPhase: "Deserialize" }); - pipeline.addPolicy((0, defaultRetryPolicy_js_1.defaultRetryPolicy)(options.retryOptions), { phase: "Retry" }); + pipeline2.addPolicy((0, formDataPolicy_js_1.formDataPolicy)(), { beforePolicies: [multipartPolicy_js_1.multipartPolicyName] }); + pipeline2.addPolicy((0, userAgentPolicy_js_1.userAgentPolicy)(options.userAgentOptions)); + pipeline2.addPolicy((0, multipartPolicy_js_1.multipartPolicy)(), { afterPhase: "Deserialize" }); + pipeline2.addPolicy((0, defaultRetryPolicy_js_1.defaultRetryPolicy)(options.retryOptions), { phase: "Retry" }); if (checkEnvironment_js_1.isNodeLike) { - pipeline.addPolicy((0, redirectPolicy_js_1.redirectPolicy)(options.redirectOptions), { afterPhase: "Retry" }); + pipeline2.addPolicy((0, redirectPolicy_js_1.redirectPolicy)(options.redirectOptions), { afterPhase: "Retry" }); } - pipeline.addPolicy((0, logPolicy_js_1.logPolicy)(options.loggingOptions), { afterPhase: "Sign" }); - return pipeline; + pipeline2.addPolicy((0, logPolicy_js_1.logPolicy)(options.loggingOptions), { afterPhase: "Sign" }); + return pipeline2; } } }); @@ -38729,21 +38729,21 @@ var require_clientHelpers = __commonJS({ var oauth2AuthenticationPolicy_js_1 = require_oauth2AuthenticationPolicy(); var cachedHttpClient; function createDefaultPipeline(options = {}) { - const pipeline = (0, createPipelineFromOptions_js_1.createPipelineFromOptions)(options); - pipeline.addPolicy((0, apiVersionPolicy_js_1.apiVersionPolicy)(options)); + const pipeline2 = (0, createPipelineFromOptions_js_1.createPipelineFromOptions)(options); + pipeline2.addPolicy((0, apiVersionPolicy_js_1.apiVersionPolicy)(options)); const { credential, authSchemes, allowInsecureConnection } = options; if (credential) { if ((0, credentials_js_1.isApiKeyCredential)(credential)) { - pipeline.addPolicy((0, apiKeyAuthenticationPolicy_js_1.apiKeyAuthenticationPolicy)({ authSchemes, credential, allowInsecureConnection })); + pipeline2.addPolicy((0, apiKeyAuthenticationPolicy_js_1.apiKeyAuthenticationPolicy)({ authSchemes, credential, allowInsecureConnection })); } else if ((0, credentials_js_1.isBasicCredential)(credential)) { - pipeline.addPolicy((0, basicAuthenticationPolicy_js_1.basicAuthenticationPolicy)({ authSchemes, credential, allowInsecureConnection })); + pipeline2.addPolicy((0, basicAuthenticationPolicy_js_1.basicAuthenticationPolicy)({ authSchemes, credential, allowInsecureConnection })); } else if ((0, credentials_js_1.isBearerTokenCredential)(credential)) { - pipeline.addPolicy((0, bearerAuthenticationPolicy_js_1.bearerAuthenticationPolicy)({ authSchemes, credential, allowInsecureConnection })); + pipeline2.addPolicy((0, bearerAuthenticationPolicy_js_1.bearerAuthenticationPolicy)({ authSchemes, credential, allowInsecureConnection })); } else if ((0, credentials_js_1.isOAuth2TokenCredential)(credential)) { - pipeline.addPolicy((0, oauth2AuthenticationPolicy_js_1.oauth2AuthenticationPolicy)({ authSchemes, credential, allowInsecureConnection })); + pipeline2.addPolicy((0, oauth2AuthenticationPolicy_js_1.oauth2AuthenticationPolicy)({ authSchemes, credential, allowInsecureConnection })); } } - return pipeline; + return pipeline2; } function getCachedDefaultHttpsClient() { if (!cachedHttpClient) { @@ -38879,11 +38879,11 @@ var require_sendRequest = __commonJS({ var clientHelpers_js_1 = require_clientHelpers(); var typeGuards_js_1 = require_typeGuards(); var multipart_js_1 = require_multipart(); - async function sendRequest(method, url2, pipeline, options = {}, customHttpClient) { + async function sendRequest(method, url2, pipeline2, options = {}, customHttpClient) { const httpClient = customHttpClient ?? (0, clientHelpers_js_1.getCachedDefaultHttpsClient)(); const request3 = buildPipelineRequest(method, url2, options); try { - const response = await pipeline.sendRequest(httpClient, request3); + const response = await pipeline2.sendRequest(httpClient, request3); const headers = response.headers.toJSON(); const stream2 = response.readableStreamBody ?? response.browserStreamBody; const parsedBody = options.responseAsStream || stream2 !== void 0 ? void 0 : getResponseBody(response); @@ -39146,11 +39146,11 @@ var require_getClient = __commonJS({ var urlHelpers_js_1 = require_urlHelpers(); var checkEnvironment_js_1 = require_checkEnvironment(); function getClient(endpoint2, clientOptions = {}) { - const pipeline = clientOptions.pipeline ?? (0, clientHelpers_js_1.createDefaultPipeline)(clientOptions); + const pipeline2 = clientOptions.pipeline ?? (0, clientHelpers_js_1.createDefaultPipeline)(clientOptions); if (clientOptions.additionalPolicies?.length) { for (const { policy, position } of clientOptions.additionalPolicies) { const afterPhase = position === "perRetry" ? "Sign" : void 0; - pipeline.addPolicy(policy, { + pipeline2.addPolicy(policy, { afterPhase }); } @@ -39161,53 +39161,53 @@ var require_getClient = __commonJS({ const getUrl = (requestOptions) => (0, urlHelpers_js_1.buildRequestUrl)(endpointUrl, path29, args, { allowInsecureConnection, ...requestOptions }); return { get: (requestOptions = {}) => { - return buildOperation("GET", getUrl(requestOptions), pipeline, requestOptions, allowInsecureConnection, httpClient); + return buildOperation("GET", getUrl(requestOptions), pipeline2, requestOptions, allowInsecureConnection, httpClient); }, post: (requestOptions = {}) => { - return buildOperation("POST", getUrl(requestOptions), pipeline, requestOptions, allowInsecureConnection, httpClient); + return buildOperation("POST", getUrl(requestOptions), pipeline2, requestOptions, allowInsecureConnection, httpClient); }, put: (requestOptions = {}) => { - return buildOperation("PUT", getUrl(requestOptions), pipeline, requestOptions, allowInsecureConnection, httpClient); + return buildOperation("PUT", getUrl(requestOptions), pipeline2, requestOptions, allowInsecureConnection, httpClient); }, patch: (requestOptions = {}) => { - return buildOperation("PATCH", getUrl(requestOptions), pipeline, requestOptions, allowInsecureConnection, httpClient); + return buildOperation("PATCH", getUrl(requestOptions), pipeline2, requestOptions, allowInsecureConnection, httpClient); }, delete: (requestOptions = {}) => { - return buildOperation("DELETE", getUrl(requestOptions), pipeline, requestOptions, allowInsecureConnection, httpClient); + return buildOperation("DELETE", getUrl(requestOptions), pipeline2, requestOptions, allowInsecureConnection, httpClient); }, head: (requestOptions = {}) => { - return buildOperation("HEAD", getUrl(requestOptions), pipeline, requestOptions, allowInsecureConnection, httpClient); + return buildOperation("HEAD", getUrl(requestOptions), pipeline2, requestOptions, allowInsecureConnection, httpClient); }, options: (requestOptions = {}) => { - return buildOperation("OPTIONS", getUrl(requestOptions), pipeline, requestOptions, allowInsecureConnection, httpClient); + return buildOperation("OPTIONS", getUrl(requestOptions), pipeline2, requestOptions, allowInsecureConnection, httpClient); }, trace: (requestOptions = {}) => { - return buildOperation("TRACE", getUrl(requestOptions), pipeline, requestOptions, allowInsecureConnection, httpClient); + return buildOperation("TRACE", getUrl(requestOptions), pipeline2, requestOptions, allowInsecureConnection, httpClient); } }; }; return { path: client, pathUnchecked: client, - pipeline + pipeline: pipeline2 }; } - function buildOperation(method, url2, pipeline, options, allowInsecureConnection, httpClient) { + function buildOperation(method, url2, pipeline2, options, allowInsecureConnection, httpClient) { allowInsecureConnection = options.allowInsecureConnection ?? allowInsecureConnection; return { then: function(onFulfilled, onrejected) { - return (0, sendRequest_js_1.sendRequest)(method, url2, pipeline, { ...options, allowInsecureConnection }, httpClient).then(onFulfilled, onrejected); + return (0, sendRequest_js_1.sendRequest)(method, url2, pipeline2, { ...options, allowInsecureConnection }, httpClient).then(onFulfilled, onrejected); }, async asBrowserStream() { if (checkEnvironment_js_1.isNodeLike) { throw new Error("`asBrowserStream` is supported only in the browser environment. Use `asNodeStream` instead to obtain the response body stream. If you require a Web stream of the response in Node, consider using `Readable.toWeb` on the result of `asNodeStream`."); } else { - return (0, sendRequest_js_1.sendRequest)(method, url2, pipeline, { ...options, allowInsecureConnection, responseAsStream: true }, httpClient); + return (0, sendRequest_js_1.sendRequest)(method, url2, pipeline2, { ...options, allowInsecureConnection, responseAsStream: true }, httpClient); } }, async asNodeStream() { if (checkEnvironment_js_1.isNodeLike) { - return (0, sendRequest_js_1.sendRequest)(method, url2, pipeline, { ...options, allowInsecureConnection, responseAsStream: true }, httpClient); + return (0, sendRequest_js_1.sendRequest)(method, url2, pipeline2, { ...options, allowInsecureConnection, responseAsStream: true }, httpClient); } else { throw new Error("`isNodeStream` is not supported in the browser environment. Use `asBrowserStream` to obtain the response body stream."); } @@ -40697,31 +40697,31 @@ var require_createPipelineFromOptions2 = __commonJS({ var tracingPolicy_js_1 = require_tracingPolicy(); var wrapAbortSignalLikePolicy_js_1 = require_wrapAbortSignalLikePolicy(); function createPipelineFromOptions(options) { - const pipeline = (0, pipeline_js_1.createEmptyPipeline)(); + const pipeline2 = (0, pipeline_js_1.createEmptyPipeline)(); if (core_util_1.isNodeLike) { if (options.agent) { - pipeline.addPolicy((0, agentPolicy_js_1.agentPolicy)(options.agent)); + pipeline2.addPolicy((0, agentPolicy_js_1.agentPolicy)(options.agent)); } if (options.tlsOptions) { - pipeline.addPolicy((0, tlsPolicy_js_1.tlsPolicy)(options.tlsOptions)); - } - pipeline.addPolicy((0, proxyPolicy_js_1.proxyPolicy)(options.proxyOptions)); - pipeline.addPolicy((0, decompressResponsePolicy_js_1.decompressResponsePolicy)()); - } - pipeline.addPolicy((0, wrapAbortSignalLikePolicy_js_1.wrapAbortSignalLikePolicy)()); - pipeline.addPolicy((0, formDataPolicy_js_1.formDataPolicy)(), { beforePolicies: [multipartPolicy_js_1.multipartPolicyName] }); - pipeline.addPolicy((0, userAgentPolicy_js_1.userAgentPolicy)(options.userAgentOptions)); - pipeline.addPolicy((0, setClientRequestIdPolicy_js_1.setClientRequestIdPolicy)(options.telemetryOptions?.clientRequestIdHeaderName)); - pipeline.addPolicy((0, multipartPolicy_js_1.multipartPolicy)(), { afterPhase: "Deserialize" }); - pipeline.addPolicy((0, defaultRetryPolicy_js_1.defaultRetryPolicy)(options.retryOptions), { phase: "Retry" }); - pipeline.addPolicy((0, tracingPolicy_js_1.tracingPolicy)({ ...options.userAgentOptions, ...options.loggingOptions }), { + pipeline2.addPolicy((0, tlsPolicy_js_1.tlsPolicy)(options.tlsOptions)); + } + pipeline2.addPolicy((0, proxyPolicy_js_1.proxyPolicy)(options.proxyOptions)); + pipeline2.addPolicy((0, decompressResponsePolicy_js_1.decompressResponsePolicy)()); + } + pipeline2.addPolicy((0, wrapAbortSignalLikePolicy_js_1.wrapAbortSignalLikePolicy)()); + pipeline2.addPolicy((0, formDataPolicy_js_1.formDataPolicy)(), { beforePolicies: [multipartPolicy_js_1.multipartPolicyName] }); + pipeline2.addPolicy((0, userAgentPolicy_js_1.userAgentPolicy)(options.userAgentOptions)); + pipeline2.addPolicy((0, setClientRequestIdPolicy_js_1.setClientRequestIdPolicy)(options.telemetryOptions?.clientRequestIdHeaderName)); + pipeline2.addPolicy((0, multipartPolicy_js_1.multipartPolicy)(), { afterPhase: "Deserialize" }); + pipeline2.addPolicy((0, defaultRetryPolicy_js_1.defaultRetryPolicy)(options.retryOptions), { phase: "Retry" }); + pipeline2.addPolicy((0, tracingPolicy_js_1.tracingPolicy)({ ...options.userAgentOptions, ...options.loggingOptions }), { afterPhase: "Retry" }); if (core_util_1.isNodeLike) { - pipeline.addPolicy((0, redirectPolicy_js_1.redirectPolicy)(options.redirectOptions), { afterPhase: "Retry" }); + pipeline2.addPolicy((0, redirectPolicy_js_1.redirectPolicy)(options.redirectOptions), { afterPhase: "Retry" }); } - pipeline.addPolicy((0, logPolicy_js_1.logPolicy)(options.loggingOptions), { afterPhase: "Sign" }); - return pipeline; + pipeline2.addPolicy((0, logPolicy_js_1.logPolicy)(options.loggingOptions), { afterPhase: "Sign" }); + return pipeline2; } } }); @@ -41635,8 +41635,8 @@ var require_disableKeepAlivePolicy = __commonJS({ } }; } - function pipelineContainsDisableKeepAlivePolicy(pipeline) { - return pipeline.getOrderedPolicies().some((policy) => policy.name === exports2.disableKeepAlivePolicyName); + function pipelineContainsDisableKeepAlivePolicy(pipeline2) { + return pipeline2.getOrderedPolicies().some((policy) => policy.name === exports2.disableKeepAlivePolicyName); } } }); @@ -42975,18 +42975,18 @@ var require_pipeline3 = __commonJS({ var core_rest_pipeline_1 = require_commonjs6(); var serializationPolicy_js_1 = require_serializationPolicy(); function createClientPipeline(options = {}) { - const pipeline = (0, core_rest_pipeline_1.createPipelineFromOptions)(options ?? {}); + const pipeline2 = (0, core_rest_pipeline_1.createPipelineFromOptions)(options ?? {}); if (options.credentialOptions) { - pipeline.addPolicy((0, core_rest_pipeline_1.bearerTokenAuthenticationPolicy)({ + pipeline2.addPolicy((0, core_rest_pipeline_1.bearerTokenAuthenticationPolicy)({ credential: options.credentialOptions.credential, scopes: options.credentialOptions.credentialScopes })); } - pipeline.addPolicy((0, serializationPolicy_js_1.serializationPolicy)(options.serializationOptions), { phase: "Serialize" }); - pipeline.addPolicy((0, deserializationPolicy_js_1.deserializationPolicy)(options.deserializationOptions), { + pipeline2.addPolicy((0, serializationPolicy_js_1.serializationPolicy)(options.serializationOptions), { phase: "Serialize" }); + pipeline2.addPolicy((0, deserializationPolicy_js_1.deserializationPolicy)(options.deserializationOptions), { phase: "Deserialize" }); - return pipeline; + return pipeline2; } } }); @@ -50204,11 +50204,11 @@ var require_Pipeline = __commonJS({ var StorageSharedKeyCredentialPolicyV2_js_1 = require_StorageSharedKeyCredentialPolicyV22(); var StorageBrowserPolicyFactory_js_1 = require_StorageBrowserPolicyFactory2(); var StorageCorrectContentLengthPolicy_js_1 = require_StorageCorrectContentLengthPolicy2(); - function isPipelineLike(pipeline) { - if (!pipeline || typeof pipeline !== "object") { + function isPipelineLike(pipeline2) { + if (!pipeline2 || typeof pipeline2 !== "object") { return false; } - const castPipeline = pipeline; + const castPipeline = pipeline2; return Array.isArray(castPipeline.factories) && typeof castPipeline.options === "object" && typeof castPipeline.toServiceClientOptions === "function"; } var Pipeline = class { @@ -50248,11 +50248,11 @@ var require_Pipeline = __commonJS({ if (!credential) { credential = new AnonymousCredential_js_1.AnonymousCredential(); } - const pipeline = new Pipeline([], pipelineOptions); - pipeline._credential = credential; - return pipeline; + const pipeline2 = new Pipeline([], pipelineOptions); + pipeline2._credential = credential; + return pipeline2; } - function processDownlevelPipeline(pipeline) { + function processDownlevelPipeline(pipeline2) { const knownFactoryFunctions = [ isAnonymousCredential, isStorageSharedKeyCredential, @@ -50262,8 +50262,8 @@ var require_Pipeline = __commonJS({ isStorageTelemetryPolicyFactory, isCoreHttpPolicyFactory ]; - if (pipeline.factories.length) { - const novelFactories = pipeline.factories.filter((factory) => { + if (pipeline2.factories.length) { + const novelFactories = pipeline2.factories.filter((factory) => { return !knownFactoryFunctions.some((knownFactory) => knownFactory(factory)); }); if (novelFactories.length) { @@ -50276,14 +50276,14 @@ var require_Pipeline = __commonJS({ } return void 0; } - function getCoreClientOptions(pipeline) { - const { httpClient: v1Client, ...restOptions } = pipeline.options; - let httpClient = pipeline._coreHttpClient; + function getCoreClientOptions(pipeline2) { + const { httpClient: v1Client, ...restOptions } = pipeline2.options; + let httpClient = pipeline2._coreHttpClient; if (!httpClient) { httpClient = v1Client ? (0, core_http_compat_1.convertHttpClient)(v1Client) : (0, storage_common_1.getCachedDefaultHttpClient)(); - pipeline._coreHttpClient = httpClient; + pipeline2._coreHttpClient = httpClient; } - let corePipeline = pipeline._corePipeline; + let corePipeline = pipeline2._corePipeline; if (!corePipeline) { const packageDetails = `azsdk-js-azure-storage-blob/${constants_js_1.SDK_VERSION}`; const userAgentPrefix = restOptions.userAgentOptions && restOptions.userAgentOptions.userAgentPrefix ? `${restOptions.userAgentOptions.userAgentPrefix} ${packageDetails}` : `${packageDetails}`; @@ -50324,11 +50324,11 @@ var require_Pipeline = __commonJS({ corePipeline.addPolicy((0, StorageRetryPolicyV2_js_1.storageRetryPolicy)(restOptions.retryOptions), { phase: "Retry" }); corePipeline.addPolicy((0, storage_common_1.storageRequestFailureDetailsParserPolicy)()); corePipeline.addPolicy((0, StorageBrowserPolicyV2_js_1.storageBrowserPolicy)()); - const downlevelResults = processDownlevelPipeline(pipeline); + const downlevelResults = processDownlevelPipeline(pipeline2); if (downlevelResults) { corePipeline.addPolicy(downlevelResults.wrappedPolicies, downlevelResults.afterRetry ? { afterPhase: "Retry" } : void 0); } - const credential = getCredentialFromPipeline(pipeline); + const credential = getCredentialFromPipeline(pipeline2); if ((0, core_auth_1.isTokenCredential)(credential)) { corePipeline.addPolicy((0, core_rest_pipeline_1.bearerTokenAuthenticationPolicy)({ credential, @@ -50341,7 +50341,7 @@ var require_Pipeline = __commonJS({ accountKey: credential.accountKey }), { phase: "Sign" }); } - pipeline._corePipeline = corePipeline; + pipeline2._corePipeline = corePipeline; } return { ...restOptions, @@ -50350,12 +50350,12 @@ var require_Pipeline = __commonJS({ pipeline: corePipeline }; } - function getCredentialFromPipeline(pipeline) { - if (pipeline._credential) { - return pipeline._credential; + function getCredentialFromPipeline(pipeline2) { + if (pipeline2._credential) { + return pipeline2._credential; } let credential = new AnonymousCredential_js_1.AnonymousCredential(); - for (const factory of pipeline.factories) { + for (const factory of pipeline2.factories) { if ((0, core_auth_1.isTokenCredential)(factory.credential)) { credential = factory.credential; } else if (isStorageSharedKeyCredential(factory)) { @@ -63880,13 +63880,13 @@ var require_StorageClient = __commonJS({ * @param url - url to resource * @param pipeline - request policy pipeline. */ - constructor(url2, pipeline) { + constructor(url2, pipeline2) { this.url = (0, utils_common_js_1.escapeURLPath)(url2); this.accountName = (0, utils_common_js_1.getAccountNameFromUrl)(url2); - this.pipeline = pipeline; - this.storageClientContext = new StorageContextClient_js_1.StorageContextClient(this.url, (0, Pipeline_js_1.getCoreClientOptions)(pipeline)); + this.pipeline = pipeline2; + this.storageClientContext = new StorageContextClient_js_1.StorageContextClient(this.url, (0, Pipeline_js_1.getCoreClientOptions)(pipeline2)); this.isHttps = (0, utils_common_js_1.iEqual)((0, utils_common_js_1.getURLScheme)(this.url) || "", "https"); - this.credential = (0, Pipeline_js_1.getCredentialFromPipeline)(pipeline); + this.credential = (0, Pipeline_js_1.getCredentialFromPipeline)(pipeline2); const storageClientContext = this.storageClientContext; storageClientContext.requestContentType = void 0; } @@ -68669,21 +68669,21 @@ var require_Clients = __commonJS({ } constructor(urlOrConnectionString, credentialOrPipelineOrContainerName, blobNameOrOptions, options) { options = options || {}; - let pipeline; + let pipeline2; let url2; if ((0, Pipeline_js_1.isPipelineLike)(credentialOrPipelineOrContainerName)) { url2 = urlOrConnectionString; - pipeline = credentialOrPipelineOrContainerName; + pipeline2 = credentialOrPipelineOrContainerName; } else if (core_util_1.isNodeLike && credentialOrPipelineOrContainerName instanceof StorageSharedKeyCredential_js_1.StorageSharedKeyCredential || credentialOrPipelineOrContainerName instanceof AnonymousCredential_js_1.AnonymousCredential || (0, core_auth_1.isTokenCredential)(credentialOrPipelineOrContainerName)) { url2 = urlOrConnectionString; options = blobNameOrOptions; - pipeline = (0, Pipeline_js_1.newPipeline)(credentialOrPipelineOrContainerName, options); + pipeline2 = (0, Pipeline_js_1.newPipeline)(credentialOrPipelineOrContainerName, options); } else if (!credentialOrPipelineOrContainerName && typeof credentialOrPipelineOrContainerName !== "string") { url2 = urlOrConnectionString; if (blobNameOrOptions && typeof blobNameOrOptions !== "string") { options = blobNameOrOptions; } - pipeline = (0, Pipeline_js_1.newPipeline)(new AnonymousCredential_js_1.AnonymousCredential(), options); + pipeline2 = (0, Pipeline_js_1.newPipeline)(new AnonymousCredential_js_1.AnonymousCredential(), options); } else if (credentialOrPipelineOrContainerName && typeof credentialOrPipelineOrContainerName === "string" && blobNameOrOptions && typeof blobNameOrOptions === "string") { const containerName = credentialOrPipelineOrContainerName; const blobName = blobNameOrOptions; @@ -68695,20 +68695,20 @@ var require_Clients = __commonJS({ if (!options.proxyOptions) { options.proxyOptions = (0, core_rest_pipeline_1.getDefaultProxySettings)(extractedCreds.proxyUri); } - pipeline = (0, Pipeline_js_1.newPipeline)(sharedKeyCredential, options); + pipeline2 = (0, Pipeline_js_1.newPipeline)(sharedKeyCredential, options); } else { throw new Error("Account connection string is only supported in Node.js environment"); } } else if (extractedCreds.kind === "SASConnString") { url2 = (0, utils_common_js_1.appendToURLPath)((0, utils_common_js_1.appendToURLPath)(extractedCreds.url, encodeURIComponent(containerName)), encodeURIComponent(blobName)) + "?" + extractedCreds.accountSas; - pipeline = (0, Pipeline_js_1.newPipeline)(new AnonymousCredential_js_1.AnonymousCredential(), options); + pipeline2 = (0, Pipeline_js_1.newPipeline)(new AnonymousCredential_js_1.AnonymousCredential(), options); } else { throw new Error("Connection string must be either an Account connection string or a SAS connection string"); } } else { throw new Error("Expecting non-empty strings for containerName and blobName parameters"); } - super(url2, pipeline); + super(url2, pipeline2); ({ blobName: this._name, containerName: this._containerName } = this.getBlobAndContainerNamesFromUrl()); this.blobContext = this.storageClientContext.blob; this._snapshot = (0, utils_common_js_1.getURLParameter)(this.url, constants_js_1.URLConstants.Parameters.SNAPSHOT); @@ -69694,19 +69694,19 @@ var require_Clients = __commonJS({ */ appendBlobContext; constructor(urlOrConnectionString, credentialOrPipelineOrContainerName, blobNameOrOptions, options) { - let pipeline; + let pipeline2; let url2; options = options || {}; if ((0, Pipeline_js_1.isPipelineLike)(credentialOrPipelineOrContainerName)) { url2 = urlOrConnectionString; - pipeline = credentialOrPipelineOrContainerName; + pipeline2 = credentialOrPipelineOrContainerName; } else if (core_util_1.isNodeLike && credentialOrPipelineOrContainerName instanceof StorageSharedKeyCredential_js_1.StorageSharedKeyCredential || credentialOrPipelineOrContainerName instanceof AnonymousCredential_js_1.AnonymousCredential || (0, core_auth_1.isTokenCredential)(credentialOrPipelineOrContainerName)) { url2 = urlOrConnectionString; options = blobNameOrOptions; - pipeline = (0, Pipeline_js_1.newPipeline)(credentialOrPipelineOrContainerName, options); + pipeline2 = (0, Pipeline_js_1.newPipeline)(credentialOrPipelineOrContainerName, options); } else if (!credentialOrPipelineOrContainerName && typeof credentialOrPipelineOrContainerName !== "string") { url2 = urlOrConnectionString; - pipeline = (0, Pipeline_js_1.newPipeline)(new AnonymousCredential_js_1.AnonymousCredential(), options); + pipeline2 = (0, Pipeline_js_1.newPipeline)(new AnonymousCredential_js_1.AnonymousCredential(), options); } else if (credentialOrPipelineOrContainerName && typeof credentialOrPipelineOrContainerName === "string" && blobNameOrOptions && typeof blobNameOrOptions === "string") { const containerName = credentialOrPipelineOrContainerName; const blobName = blobNameOrOptions; @@ -69718,20 +69718,20 @@ var require_Clients = __commonJS({ if (!options.proxyOptions) { options.proxyOptions = (0, core_rest_pipeline_1.getDefaultProxySettings)(extractedCreds.proxyUri); } - pipeline = (0, Pipeline_js_1.newPipeline)(sharedKeyCredential, options); + pipeline2 = (0, Pipeline_js_1.newPipeline)(sharedKeyCredential, options); } else { throw new Error("Account connection string is only supported in Node.js environment"); } } else if (extractedCreds.kind === "SASConnString") { url2 = (0, utils_common_js_1.appendToURLPath)((0, utils_common_js_1.appendToURLPath)(extractedCreds.url, encodeURIComponent(containerName)), encodeURIComponent(blobName)) + "?" + extractedCreds.accountSas; - pipeline = (0, Pipeline_js_1.newPipeline)(new AnonymousCredential_js_1.AnonymousCredential(), options); + pipeline2 = (0, Pipeline_js_1.newPipeline)(new AnonymousCredential_js_1.AnonymousCredential(), options); } else { throw new Error("Connection string must be either an Account connection string or a SAS connection string"); } } else { throw new Error("Expecting non-empty strings for containerName and blobName parameters"); } - super(url2, pipeline); + super(url2, pipeline2); this.appendBlobContext = this.storageClientContext.appendBlob; } /** @@ -69967,22 +69967,22 @@ var require_Clients = __commonJS({ */ blockBlobContext; constructor(urlOrConnectionString, credentialOrPipelineOrContainerName, blobNameOrOptions, options) { - let pipeline; + let pipeline2; let url2; options = options || {}; if ((0, Pipeline_js_1.isPipelineLike)(credentialOrPipelineOrContainerName)) { url2 = urlOrConnectionString; - pipeline = credentialOrPipelineOrContainerName; + pipeline2 = credentialOrPipelineOrContainerName; } else if (core_util_1.isNodeLike && credentialOrPipelineOrContainerName instanceof StorageSharedKeyCredential_js_1.StorageSharedKeyCredential || credentialOrPipelineOrContainerName instanceof AnonymousCredential_js_1.AnonymousCredential || (0, core_auth_1.isTokenCredential)(credentialOrPipelineOrContainerName)) { url2 = urlOrConnectionString; options = blobNameOrOptions; - pipeline = (0, Pipeline_js_1.newPipeline)(credentialOrPipelineOrContainerName, options); + pipeline2 = (0, Pipeline_js_1.newPipeline)(credentialOrPipelineOrContainerName, options); } else if (!credentialOrPipelineOrContainerName && typeof credentialOrPipelineOrContainerName !== "string") { url2 = urlOrConnectionString; if (blobNameOrOptions && typeof blobNameOrOptions !== "string") { options = blobNameOrOptions; } - pipeline = (0, Pipeline_js_1.newPipeline)(new AnonymousCredential_js_1.AnonymousCredential(), options); + pipeline2 = (0, Pipeline_js_1.newPipeline)(new AnonymousCredential_js_1.AnonymousCredential(), options); } else if (credentialOrPipelineOrContainerName && typeof credentialOrPipelineOrContainerName === "string" && blobNameOrOptions && typeof blobNameOrOptions === "string") { const containerName = credentialOrPipelineOrContainerName; const blobName = blobNameOrOptions; @@ -69994,20 +69994,20 @@ var require_Clients = __commonJS({ if (!options.proxyOptions) { options.proxyOptions = (0, core_rest_pipeline_1.getDefaultProxySettings)(extractedCreds.proxyUri); } - pipeline = (0, Pipeline_js_1.newPipeline)(sharedKeyCredential, options); + pipeline2 = (0, Pipeline_js_1.newPipeline)(sharedKeyCredential, options); } else { throw new Error("Account connection string is only supported in Node.js environment"); } } else if (extractedCreds.kind === "SASConnString") { url2 = (0, utils_common_js_1.appendToURLPath)((0, utils_common_js_1.appendToURLPath)(extractedCreds.url, encodeURIComponent(containerName)), encodeURIComponent(blobName)) + "?" + extractedCreds.accountSas; - pipeline = (0, Pipeline_js_1.newPipeline)(new AnonymousCredential_js_1.AnonymousCredential(), options); + pipeline2 = (0, Pipeline_js_1.newPipeline)(new AnonymousCredential_js_1.AnonymousCredential(), options); } else { throw new Error("Connection string must be either an Account connection string or a SAS connection string"); } } else { throw new Error("Expecting non-empty strings for containerName and blobName parameters"); } - super(url2, pipeline); + super(url2, pipeline2); this.blockBlobContext = this.storageClientContext.blockBlob; this._blobContext = this.storageClientContext.blob; } @@ -70579,19 +70579,19 @@ var require_Clients = __commonJS({ */ pageBlobContext; constructor(urlOrConnectionString, credentialOrPipelineOrContainerName, blobNameOrOptions, options) { - let pipeline; + let pipeline2; let url2; options = options || {}; if ((0, Pipeline_js_1.isPipelineLike)(credentialOrPipelineOrContainerName)) { url2 = urlOrConnectionString; - pipeline = credentialOrPipelineOrContainerName; + pipeline2 = credentialOrPipelineOrContainerName; } else if (core_util_1.isNodeLike && credentialOrPipelineOrContainerName instanceof StorageSharedKeyCredential_js_1.StorageSharedKeyCredential || credentialOrPipelineOrContainerName instanceof AnonymousCredential_js_1.AnonymousCredential || (0, core_auth_1.isTokenCredential)(credentialOrPipelineOrContainerName)) { url2 = urlOrConnectionString; options = blobNameOrOptions; - pipeline = (0, Pipeline_js_1.newPipeline)(credentialOrPipelineOrContainerName, options); + pipeline2 = (0, Pipeline_js_1.newPipeline)(credentialOrPipelineOrContainerName, options); } else if (!credentialOrPipelineOrContainerName && typeof credentialOrPipelineOrContainerName !== "string") { url2 = urlOrConnectionString; - pipeline = (0, Pipeline_js_1.newPipeline)(new AnonymousCredential_js_1.AnonymousCredential(), options); + pipeline2 = (0, Pipeline_js_1.newPipeline)(new AnonymousCredential_js_1.AnonymousCredential(), options); } else if (credentialOrPipelineOrContainerName && typeof credentialOrPipelineOrContainerName === "string" && blobNameOrOptions && typeof blobNameOrOptions === "string") { const containerName = credentialOrPipelineOrContainerName; const blobName = blobNameOrOptions; @@ -70603,20 +70603,20 @@ var require_Clients = __commonJS({ if (!options.proxyOptions) { options.proxyOptions = (0, core_rest_pipeline_1.getDefaultProxySettings)(extractedCreds.proxyUri); } - pipeline = (0, Pipeline_js_1.newPipeline)(sharedKeyCredential, options); + pipeline2 = (0, Pipeline_js_1.newPipeline)(sharedKeyCredential, options); } else { throw new Error("Account connection string is only supported in Node.js environment"); } } else if (extractedCreds.kind === "SASConnString") { url2 = (0, utils_common_js_1.appendToURLPath)((0, utils_common_js_1.appendToURLPath)(extractedCreds.url, encodeURIComponent(containerName)), encodeURIComponent(blobName)) + "?" + extractedCreds.accountSas; - pipeline = (0, Pipeline_js_1.newPipeline)(new AnonymousCredential_js_1.AnonymousCredential(), options); + pipeline2 = (0, Pipeline_js_1.newPipeline)(new AnonymousCredential_js_1.AnonymousCredential(), options); } else { throw new Error("Connection string must be either an Account connection string or a SAS connection string"); } } else { throw new Error("Expecting non-empty strings for containerName and blobName parameters"); } - super(url2, pipeline); + super(url2, pipeline2); this.pageBlobContext = this.storageClientContext.pageBlob; } /** @@ -71681,10 +71681,10 @@ var require_BlobBatch = __commonJS({ accountKey: credential.accountKey }), { phase: "Sign" }); } - const pipeline = new Pipeline_js_1.Pipeline([]); - pipeline._credential = credential; - pipeline._corePipeline = corePipeline; - return pipeline; + const pipeline2 = new Pipeline_js_1.Pipeline([]); + pipeline2._credential = credential; + pipeline2._corePipeline = corePipeline; + return pipeline2; } appendSubRequestToBody(request3) { this.body += [ @@ -71776,15 +71776,15 @@ var require_BlobBatchClient = __commonJS({ var BlobBatchClient = class { serviceOrContainerContext; constructor(url2, credentialOrPipeline, options) { - let pipeline; + let pipeline2; if ((0, Pipeline_js_1.isPipelineLike)(credentialOrPipeline)) { - pipeline = credentialOrPipeline; + pipeline2 = credentialOrPipeline; } else if (!credentialOrPipeline) { - pipeline = (0, Pipeline_js_1.newPipeline)(new AnonymousCredential_js_1.AnonymousCredential(), options); + pipeline2 = (0, Pipeline_js_1.newPipeline)(new AnonymousCredential_js_1.AnonymousCredential(), options); } else { - pipeline = (0, Pipeline_js_1.newPipeline)(credentialOrPipeline, options); + pipeline2 = (0, Pipeline_js_1.newPipeline)(credentialOrPipeline, options); } - const storageClientContext = new StorageContextClient_js_1.StorageContextClient(url2, (0, Pipeline_js_1.getCoreClientOptions)(pipeline)); + const storageClientContext = new StorageContextClient_js_1.StorageContextClient(url2, (0, Pipeline_js_1.getCoreClientOptions)(pipeline2)); const path29 = (0, utils_common_js_1.getURLPath)(url2); if (path29 && path29 !== "/") { this.serviceOrContainerContext = storageClientContext.container; @@ -71947,18 +71947,18 @@ var require_ContainerClient = __commonJS({ return this._containerName; } constructor(urlOrConnectionString, credentialOrPipelineOrContainerName, options) { - let pipeline; + let pipeline2; let url2; options = options || {}; if ((0, Pipeline_js_1.isPipelineLike)(credentialOrPipelineOrContainerName)) { url2 = urlOrConnectionString; - pipeline = credentialOrPipelineOrContainerName; + pipeline2 = credentialOrPipelineOrContainerName; } else if (core_util_1.isNodeLike && credentialOrPipelineOrContainerName instanceof StorageSharedKeyCredential_js_1.StorageSharedKeyCredential || credentialOrPipelineOrContainerName instanceof AnonymousCredential_js_1.AnonymousCredential || (0, core_auth_1.isTokenCredential)(credentialOrPipelineOrContainerName)) { url2 = urlOrConnectionString; - pipeline = (0, Pipeline_js_1.newPipeline)(credentialOrPipelineOrContainerName, options); + pipeline2 = (0, Pipeline_js_1.newPipeline)(credentialOrPipelineOrContainerName, options); } else if (!credentialOrPipelineOrContainerName && typeof credentialOrPipelineOrContainerName !== "string") { url2 = urlOrConnectionString; - pipeline = (0, Pipeline_js_1.newPipeline)(new AnonymousCredential_js_1.AnonymousCredential(), options); + pipeline2 = (0, Pipeline_js_1.newPipeline)(new AnonymousCredential_js_1.AnonymousCredential(), options); } else if (credentialOrPipelineOrContainerName && typeof credentialOrPipelineOrContainerName === "string") { const containerName = credentialOrPipelineOrContainerName; const extractedCreds = (0, utils_common_js_1.extractConnectionStringParts)(urlOrConnectionString); @@ -71969,20 +71969,20 @@ var require_ContainerClient = __commonJS({ if (!options.proxyOptions) { options.proxyOptions = (0, core_rest_pipeline_1.getDefaultProxySettings)(extractedCreds.proxyUri); } - pipeline = (0, Pipeline_js_1.newPipeline)(sharedKeyCredential, options); + pipeline2 = (0, Pipeline_js_1.newPipeline)(sharedKeyCredential, options); } else { throw new Error("Account connection string is only supported in Node.js environment"); } } else if (extractedCreds.kind === "SASConnString") { url2 = (0, utils_common_js_1.appendToURLPath)(extractedCreds.url, encodeURIComponent(containerName)) + "?" + extractedCreds.accountSas; - pipeline = (0, Pipeline_js_1.newPipeline)(new AnonymousCredential_js_1.AnonymousCredential(), options); + pipeline2 = (0, Pipeline_js_1.newPipeline)(new AnonymousCredential_js_1.AnonymousCredential(), options); } else { throw new Error("Connection string must be either an Account connection string or a SAS connection string"); } } else { throw new Error("Expecting non-empty strings for containerName parameter"); } - super(url2, pipeline); + super(url2, pipeline2); this._containerName = this.getContainerNameFromUrl(); this.containerContext = this.storageClientContext.container; } @@ -73660,28 +73660,28 @@ var require_BlobServiceClient = __commonJS({ if (!options.proxyOptions) { options.proxyOptions = (0, core_rest_pipeline_1.getDefaultProxySettings)(extractedCreds.proxyUri); } - const pipeline = (0, Pipeline_js_1.newPipeline)(sharedKeyCredential, options); - return new _BlobServiceClient(extractedCreds.url, pipeline); + const pipeline2 = (0, Pipeline_js_1.newPipeline)(sharedKeyCredential, options); + return new _BlobServiceClient(extractedCreds.url, pipeline2); } else { throw new Error("Account connection string is only supported in Node.js environment"); } } else if (extractedCreds.kind === "SASConnString") { - const pipeline = (0, Pipeline_js_1.newPipeline)(new AnonymousCredential_js_1.AnonymousCredential(), options); - return new _BlobServiceClient(extractedCreds.url + "?" + extractedCreds.accountSas, pipeline); + const pipeline2 = (0, Pipeline_js_1.newPipeline)(new AnonymousCredential_js_1.AnonymousCredential(), options); + return new _BlobServiceClient(extractedCreds.url + "?" + extractedCreds.accountSas, pipeline2); } else { throw new Error("Connection string must be either an Account connection string or a SAS connection string"); } } constructor(url2, credentialOrPipeline, options) { - let pipeline; + let pipeline2; if ((0, Pipeline_js_1.isPipelineLike)(credentialOrPipeline)) { - pipeline = credentialOrPipeline; + pipeline2 = credentialOrPipeline; } else if (core_util_1.isNodeLike && credentialOrPipeline instanceof StorageSharedKeyCredential_js_1.StorageSharedKeyCredential || credentialOrPipeline instanceof AnonymousCredential_js_1.AnonymousCredential || (0, core_auth_1.isTokenCredential)(credentialOrPipeline)) { - pipeline = (0, Pipeline_js_1.newPipeline)(credentialOrPipeline, options); + pipeline2 = (0, Pipeline_js_1.newPipeline)(credentialOrPipeline, options); } else { - pipeline = (0, Pipeline_js_1.newPipeline)(new AnonymousCredential_js_1.AnonymousCredential(), options); + pipeline2 = (0, Pipeline_js_1.newPipeline)(new AnonymousCredential_js_1.AnonymousCredential(), options); } - super(url2, pipeline); + super(url2, pipeline2); this.serviceContext = this.storageClientContext.service; } /** @@ -75082,8 +75082,8 @@ var require_downloadUtils = __commonJS({ var abort_controller_1 = require_dist4(); function pipeResponseToStream(response, output) { return __awaiter2(this, void 0, void 0, function* () { - const pipeline = util3.promisify(stream2.pipeline); - yield pipeline(response.message, output); + const pipeline2 = util3.promisify(stream2.pipeline); + yield pipeline2(response.message, output); }); } var DownloadProgress = class { @@ -82212,12 +82212,12 @@ var require_tool_cache = __commonJS({ core31.debug(`Failed to download from "${url2}". Code(${response.message.statusCode}) Message(${response.message.statusMessage})`); throw err; } - const pipeline = util3.promisify(stream2.pipeline); + const pipeline2 = util3.promisify(stream2.pipeline); const responseMessageFactory = _getGlobal("TEST_DOWNLOAD_TOOL_RESPONSE_MESSAGE_FACTORY", () => response.message); const readStream = responseMessageFactory(); let succeeded = false; try { - yield pipeline(readStream, fs31.createWriteStream(dest)); + yield pipeline2(readStream, fs31.createWriteStream(dest)); core31.debug("download complete"); succeeded = true; return dest; @@ -100809,7 +100809,7 @@ var require_pipeline4 = __commonJS({ } } } - function pipeline(...streams) { + function pipeline2(...streams) { return pipelineImpl(streams, once(popCallback(streams))); } function pipelineImpl(streams, callback, opts) { @@ -101075,7 +101075,7 @@ var require_pipeline4 = __commonJS({ } module2.exports = { pipelineImpl, - pipeline + pipeline: pipeline2 }; } }); @@ -101084,7 +101084,7 @@ var require_pipeline4 = __commonJS({ var require_compose = __commonJS({ "node_modules/readable-stream/lib/internal/streams/compose.js"(exports2, module2) { "use strict"; - var { pipeline } = require_pipeline4(); + var { pipeline: pipeline2 } = require_pipeline4(); var Duplex = require_duplex(); var { destroyer } = require_destroy2(); var { @@ -101144,7 +101144,7 @@ var require_compose = __commonJS({ } } const head = streams[0]; - const tail = pipeline(streams, onfinished); + const tail = pipeline2(streams, onfinished); const writable = !!(isWritable(head) || isWritableStream(head) || isTransformStream(head)); const readable = !!(isReadable(tail) || isReadableStream(tail) || isTransformStream(tail)); d = new Duplex({ @@ -101687,7 +101687,7 @@ var require_promises = __commonJS({ var { pipelineImpl: pl } = require_pipeline4(); var { finished } = require_end_of_stream(); require_stream2(); - function pipeline(...streams) { + function pipeline2(...streams) { return new Promise2((resolve14, reject) => { let signal; let end; @@ -101715,7 +101715,7 @@ var require_promises = __commonJS({ } module2.exports = { finished, - pipeline + pipeline: pipeline2 }; } }); @@ -101735,7 +101735,7 @@ var require_stream2 = __commonJS({ } = require_errors4(); var compose = require_compose(); var { setDefaultHighWaterMark, getDefaultHighWaterMark } = require_state3(); - var { pipeline } = require_pipeline4(); + var { pipeline: pipeline2 } = require_pipeline4(); var { destroyer } = require_destroy2(); var eos = require_end_of_stream(); var promises6 = require_promises(); @@ -101799,7 +101799,7 @@ var require_stream2 = __commonJS({ Stream.Duplex = require_duplex(); Stream.Transform = require_transform(); Stream.PassThrough = require_passthrough2(); - Stream.pipeline = pipeline; + Stream.pipeline = pipeline2; var { addAbortSignal } = require_add_abort_signal(); Stream.addAbortSignal = addAbortSignal; Stream.finished = eos; @@ -101815,7 +101815,7 @@ var require_stream2 = __commonJS({ return promises6; } }); - ObjectDefineProperty(pipeline, customPromisify, { + ObjectDefineProperty(pipeline2, customPromisify, { __proto__: null, enumerable: true, get() { @@ -109038,13 +109038,13 @@ var require_streamx = __commonJS({ } function pipelinePromise(...streams) { return new Promise((resolve14, reject) => { - return pipeline(...streams, (err) => { + return pipeline2(...streams, (err) => { if (err) return reject(err); resolve14(); }); }); } - function pipeline(stream2, ...streams) { + function pipeline2(stream2, ...streams) { const all = Array.isArray(stream2) ? [...stream2, ...streams] : [stream2, ...streams]; const done = all.length && typeof all[all.length - 1] === "function" ? all.pop() : null; if (all.length < 2) throw new Error("Pipeline requires at least 2 streams"); @@ -109129,7 +109129,7 @@ var require_streamx = __commonJS({ return s._writev !== Writable.prototype._writev && s._writev !== Duplex.prototype._writev; } module2.exports = { - pipeline, + pipeline: pipeline2, pipelinePromise, isStream: isStream2, isStreamx, @@ -150565,10 +150565,12 @@ async function extractTarZst(tar, dest, tarVersion, logger) { reject(new Error(`Error while extracting tar: ${err}`)); }); if (tar instanceof stream.Readable) { - tar.pipe(tarProcess.stdin).on("error", (err) => { - reject( - new Error(`Error while downloading and extracting tar: ${err}`) - ); + stream.pipeline(tar, tarProcess.stdin, (err) => { + if (err) { + reject( + new Error(`Error while downloading and extracting tar: ${err}`) + ); + } }); } tarProcess.on("exit", (code) => { @@ -150615,6 +150617,7 @@ var toolcache2 = __toESM(require_tool_cache()); var import_follow_redirects = __toESM(require_follow_redirects()); var semver8 = __toESM(require_semver2()); var STREAMING_HIGH_WATERMARK_BYTES = 4 * 1024 * 1024; +var STREAMING_STALL_TIMEOUT_MS = 5 * 60 * 1e3; var TOOLCACHE_TOOL_NAME = "CodeQL"; async function downloadAndExtract(codeqlURL, compressionMethod, dest, authorization, headers, tarVersion, logger) { logger.info( @@ -150692,8 +150695,8 @@ async function downloadAndExtractZstdWithStreaming(codeqlURL, dest, authorizatio authorization ? { authorization } : {}, headers ); - const response = await new Promise( - (resolve14) => import_follow_redirects.https.get( + const response = await new Promise((resolve14, reject) => { + const request3 = import_follow_redirects.https.get( codeqlURL, { headers, @@ -150703,9 +150706,18 @@ async function downloadAndExtractZstdWithStreaming(codeqlURL, dest, authorizatio agent }, (r) => resolve14(r) - ) - ); + ); + request3.on("error", reject); + request3.setTimeout(STREAMING_STALL_TIMEOUT_MS, () => { + request3.destroy( + new Error( + `No data received for ${formatDuration(STREAMING_STALL_TIMEOUT_MS)}.` + ) + ); + }); + }); if (response.statusCode !== 200) { + response.resume(); throw new Error( `Failed to download CodeQL bundle from ${codeqlURL}. HTTP status code: ${response.statusCode}.` ); diff --git a/src/tar.test.ts b/src/tar.test.ts new file mode 100644 index 0000000000..48f4e866d3 --- /dev/null +++ b/src/tar.test.ts @@ -0,0 +1,33 @@ +import * as path from "path"; +import * as stream from "stream"; + +import test from "ava"; + +import { getRunnerLogger } from "./logging"; +import { extractTarZst } from "./tar"; +import { setupTests } from "./testing-utils"; +import { withTmpDir } from "./util"; + +setupTests(test); + +test("extractTarZst rejects if the input stream errors", async (t) => { + await withTmpDir(async (tmpDir) => { + const archive = new stream.PassThrough(); + const promise = extractTarZst( + archive, + path.join(tmpDir, "dest"), + { type: "gnu", version: "1.34" }, + getRunnerLogger(true), + ); + + archive.destroy( + Object.assign(new Error("socket hang up"), { + code: "ECONNRESET", + }), + ); + + await t.throwsAsync(promise, { + message: /Error while downloading and extracting tar/, + }); + }); +}); diff --git a/src/tar.ts b/src/tar.ts index 723716b016..3a0d79cc64 100644 --- a/src/tar.ts +++ b/src/tar.ts @@ -194,10 +194,15 @@ export async function extractTarZst( }); if (tar instanceof stream.Readable) { - tar.pipe(tarProcess.stdin).on("error", (err) => { - reject( - new Error(`Error while downloading and extracting tar: ${err}`), - ); + // Use `pipeline` rather than `pipe` so that an error on either stream is reported here + // rather than being emitted as an unhandled `error` event, and so that `tar`'s standard + // input is closed if the download fails partway through. + stream.pipeline(tar, tarProcess.stdin, (err) => { + if (err) { + reject( + new Error(`Error while downloading and extracting tar: ${err}`), + ); + } }); } diff --git a/src/tools-download.test.ts b/src/tools-download.test.ts index e17d38c5be..66fe0e72e4 100644 --- a/src/tools-download.test.ts +++ b/src/tools-download.test.ts @@ -38,6 +38,43 @@ test.serial( }, ); +test.serial( + "downloadAndExtract falls back to downloading before extracting if streaming fails", + async (t) => { + await withTmpDir(async (tmpDir) => { + sinon.stub(process, "platform").value("linux"); + const archivePath = path.join(tmpDir, "codeql-bundle.tar.zst"); + const destination = path.join(tmpDir, "codeql"); + const downloadTool = sinon + .stub(toolcache, "downloadTool") + .resolves(archivePath); + const extract = sinon.stub(tar, "extract").resolves(destination); + const extractTarZst = sinon.stub(tar, "extractTarZst").resolves(); + const request = nock("https://example.com") + .get("/codeql-bundle.tar.zst") + .replyWithError( + Object.assign(new Error("socket hang up"), { code: "ECONNRESET" }), + ); + + const statusReport = await downloadAndExtract( + "https://example.com/codeql-bundle.tar.zst", + "zstd", + destination, + undefined, + {}, + { type: "gnu", version: "1.34" }, + getRunnerLogger(true), + ); + + t.assert(Number.isInteger(statusReport.downloadDurationMs)); + t.true(request.isDone()); + t.false(extractTarZst.called); + t.true(downloadTool.calledOnce); + t.true(extract.calledOnce); + }); + }, +); + test.serial( "downloadAndExtract omits the download duration when streaming extraction", async (t) => { diff --git a/src/tools-download.ts b/src/tools-download.ts index c19cedb13e..9b2fa8723a 100644 --- a/src/tools-download.ts +++ b/src/tools-download.ts @@ -19,6 +19,12 @@ import { cleanUpPath, getErrorMessage, getRequiredEnvParam } from "./util"; */ const STREAMING_HIGH_WATERMARK_BYTES = 4 * 1024 * 1024; // 4 MiB +/** + * How long the streaming download of the CodeQL tools may stall for before we abort it. This + * applies both to establishing the connection and to gaps between chunks of the response body. + */ +const STREAMING_STALL_TIMEOUT_MS = 5 * 60 * 1000; // 5 minutes + /** * The name of the tool cache directory for the CodeQL tools. */ @@ -137,8 +143,8 @@ async function downloadAndExtractZstdWithStreaming( authorization ? { authorization } : {}, headers, ); - const response = await new Promise((resolve) => - https.get( + const response = await new Promise((resolve, reject) => { + const request = https.get( codeqlURL, { headers, @@ -148,10 +154,24 @@ async function downloadAndExtractZstdWithStreaming( agent, } as unknown as RequestOptions, (r) => resolve(r), - ), - ); + ); + // Without this listener, connection failures such as `ECONNRESET` are emitted as unhandled + // `error` events, which terminate the process instead of letting us fall back to downloading + // the bundle before extracting it. This listener stays attached after the response arrives, so + // it also handles errors that occur while the response is being streamed. + request.on("error", reject); + request.setTimeout(STREAMING_STALL_TIMEOUT_MS, () => { + request.destroy( + new Error( + `No data received for ${formatDuration(STREAMING_STALL_TIMEOUT_MS)}.`, + ), + ); + }); + }); if (response.statusCode !== 200) { + // Discard the response body so that the connection can be released. + response.resume(); throw new Error( `Failed to download CodeQL bundle from ${codeqlURL}. HTTP status code: ${response.statusCode}.`, ); From 155e5229973b426bd1ae2f83bb1bf42417fa2a8f Mon Sep 17 00:00:00 2001 From: sim Date: Thu, 30 Jul 2026 18:48:10 +0100 Subject: [PATCH 93/95] Link the PR from the changelog entry Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- CHANGELOG.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index c461878c51..36092606b4 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,7 +4,7 @@ See the [releases page](https://github.com/github/codeql-action/releases) for th ## [UNRELEASED] -- Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the `init` Action instead of falling back to downloading the bundle before extracting it. [#3367](https://github.com/github/codeql-action/issues/3367) +- Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the `init` Action instead of falling back to downloading the bundle before extracting it. [#4061](https://github.com/github/codeql-action/pull/4061) ## 4.37.4 - 29 Jul 2026 From c29563eeaafbc75499c7bb0d74bf77b3506c1cbd Mon Sep 17 00:00:00 2001 From: Sam Robson Date: Fri, 31 Jul 2026 10:10:39 +0100 Subject: [PATCH 94/95] ci: use federated enterprise release PAT --- .../workflows/update-supported-enterprise-server-versions.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/update-supported-enterprise-server-versions.yml b/.github/workflows/update-supported-enterprise-server-versions.yml index 01cd6ab8fb..ee2649ad0e 100644 --- a/.github/workflows/update-supported-enterprise-server-versions.yml +++ b/.github/workflows/update-supported-enterprise-server-versions.yml @@ -38,7 +38,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: repository: github/enterprise-releases - token: ${{ secrets.ENTERPRISE_RELEASE_TOKEN }} + token: ${{ secrets.CODEQL_CI_ENTERPRISE_RELEASE_PAT }} path: ${{ github.workspace }}/enterprise-releases/ sparse-checkout: releases.json From e74600b0d945db9734eb044f95cd43f34b773451 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Mon, 3 Aug 2026 09:18:21 +0000 Subject: [PATCH 95/95] Update changelog for v4.37.5 --- CHANGELOG.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 36092606b4..0008822f0e 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,7 +2,7 @@ See the [releases page](https://github.com/github/codeql-action/releases) for the relevant changes to the CodeQL CLI and language packs. -## [UNRELEASED] +## 4.37.5 - 03 Aug 2026 - Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the `init` Action instead of falling back to downloading the bundle before extracting it. [#4061](https://github.com/github/codeql-action/pull/4061)