Repository navigation
Merge releases/v4 into releases/v3 - #4304
Merged
Merged
Conversation
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Migrate bundle update workflow to new changenote tooling
Bumps [glob](https://github.com/isaacs/node-glob) from 13.0.6 to 14.0.3. - [Changelog](https://github.com/isaacs/node-glob/blob/main/changelog.md) - [Commits](isaacs/node-glob@v13.0.6...v14.0.3) --- updated-dependencies: - dependency-name: glob dependency-version: 14.0.3 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [node-forge](https://github.com/digitalbazaar/forge) from 1.4.0 to 1.4.1. - [Changelog](https://github.com/digitalbazaar/forge/blob/main/CHANGELOG.md) - [Commits](digitalbazaar/forge@v1.4.0...v1.4.1) --- updated-dependencies: - dependency-name: node-forge dependency-version: 1.4.1 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
Mergeback v4.39.2 refs/heads/releases/v4 into main
This avoids failures on PRs where `sync-back.ts` is run as part of the "Rebuild" job if there are already version inconsistencies on the base branch.
…s/glob-14.0.3 Bump glob from 13.0.6 to 14.0.3 in /pr-checks
…ge-1.4.1 Bump node-forge from 1.4.0 to 1.4.1
…sarif-uris fix: decode SARIF location URIs in diff-informed alert filtering
Consistently format YAML and add CI check
Update `glob` to `14.0.3`
Merge main into releases/v4
This reverts commit 4c53ff5.
This reverts commit d94ff1d.
….3-33d7b85da # Conflicts: # autobuild/action.yml # init/action.yml # resolve-environment/action.yml # setup-codeql/action.yml # upload-sarif/action.yml
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
Unresolved conflict markers invalidate five action manifests and prevent workflows from loading the affected actions.
6 open issues
What changed in this PR
Backports fixes and maintenance from releases/v4 into releases/v3 for CodeQL Action 3.39.3, including the diff-informed alert-filtering fix.
Changes:
- Decodes percent-encoded SARIF paths before diff-range matching, with regression tests.
- Standardizes YAML formatting and adds CI validation.
- Updates dependencies, bundle changenote generation, and per-workflow action-version synchronization.
This pull request requires changes.
- Critical: Five action manifests contain unresolved merge conflicts, making them invalid YAML and preventing workflows from loading them. Resolve each to a single Node 20 runtime mapping; preserve the formatted entry-point paths in
upload-sarif. - Moderate:
pr-checks/check-unchanged.ts:139leaves formatting edits behind after failure, causing the subsequent workflow-validation check to reject the dirty tree before validation. Restore the edits after capturing the diff or use a non-mutating check. - Nit: Add a regression test for two workflows using different versions of the same action, asserting workflow-scoped version data and verifying each template receives its corresponding version.
| File | Description |
|---|---|
upload-sarif/action.yml |
Reformats manifest; critical unresolved runtime conflict at line 44. |
tests/multi-language-repo/codeql-qlpacks/python-qlpack/qlpack.yml |
Adds final newline. |
tests/multi-language-repo/codeql-qlpacks/javascript-qlpack/qlpack.yml |
Adds final newline. |
tests/multi-language-repo/codeql-qlpacks/java-qlpack/qlpack.yml |
Adds final newline. |
tests/multi-language-repo/codeql-qlpacks/go-qlpack/qlpack.yml |
Adds final newline. |
tests/multi-language-repo/codeql-qlpacks/csharp-qlpack/qlpack.yml |
Adds final newline. |
tests/multi-language-repo/codeql-qlpacks/cpp-qlpack/qlpack.yml |
Adds final newline. |
tests/multi-language-repo/codeql-qlpacks/complex-python-qlpack/qlpack.yml |
Adds final newline. |
tests/multi-language-repo/codeql-qlpacks/complex-javascript-qlpack/qlpack.yml |
Adds final newline. |
tests/multi-language-repo/.github/codeql/custom-queries.yml |
Normalizes comment indentation. |
tests/multi-language-repo/.github/codeql/codeql-config-query-filters3.yml |
Normalizes filter and comment indentation. |
tests/multi-language-repo/.github/codeql/codeql-config-query-filters2.yml |
Normalizes filter-list indentation. |
tests/multi-language-repo/.github/codeql/codeql-config-query-filters1.yml |
Normalizes filter-list indentation. |
src/upload-sarif-action.ts |
Reformats interface inheritance. |
src/upload-lib.ts |
Decodes SARIF paths before diff matching, with raw-path fallback. |
src/upload-lib.test.ts |
Tests encoded paths, malformed URIs, and related locations. |
src/testing-utils.ts |
Reformats generic parameters. |
src/testdata/pr-diff-range.yml |
Updates expected generated YAML formatting. |
src/start-proxy/types.ts |
Reformats the OIDC union type. |
src/setup-codeql.test.ts |
Reformats a type assertion. |
src/init-action-post.ts |
Applies TypeScript formatting changes. |
src/environment.ts |
Reformats a union type. |
src/debug-artifacts.ts |
Reformats a union type. |
src/analyze.ts |
Aligns generated diff-range YAML formatting. |
src/analyze-action.ts |
Applies TypeScript formatting changes. |
setup-codeql/action.yml |
Reformats manifest; critical unresolved runtime conflict at line 54. |
resolve-environment/action.yml |
Reformats manifest; critical unresolved runtime conflict at line 24. |
pr-checks/update-release-branch.ts |
Uses extracted command-execution helpers. |
pr-checks/sync.ts |
Emits consistently double-quoted workflow YAML. |
pr-checks/sync-back.ts |
Tracks action versions per workflow; regression-test nit at line 88. |
pr-checks/sync-back.test.ts |
Adapts tests to workflow-scoped version mappings. |
pr-checks/package.json |
Updates glob. |
pr-checks/config.ts |
Exports shared repository paths. |
pr-checks/command.ts |
Extracts command and Git execution helpers. |
pr-checks/checks/upload-sarif.yml |
Normalizes input quoting. |
pr-checks/checks/upload-ref-sha-input.yml |
Normalizes input quoting. |
pr-checks/checks/unsupported-macos.yml |
Updates the artifact-download action. |
pr-checks/checks/overlay-init-fallback.yml |
Normalizes inline-comment spacing. |
pr-checks/checks/init-with-registries.yml |
Normalizes registry-block indentation. |
pr-checks/checks/analyze-ref-input.yml |
Normalizes input quoting. |
pr-checks/check-unchanged.ts |
Adds JavaScript/YAML checks; moderate failure-cleanup issue at line 139. |
pr-checks/bundle-changelog.ts |
Writes bundle updates as unreleased changenotes. |
pr-checks/bundle-changelog.test.ts |
Tests generated changenote content. |
package.json |
Updates release version, dependencies, and formatting tooling. |
package-lock.json |
Updates locked dependencies and release metadata. |
init/action.yml |
Reformats manifest; critical unresolved runtime conflict at line 183. |
CHANGELOG.md |
Documents the v3.39.3 alert-filtering fix. |
autobuild/action.yml |
Reformats manifest; critical unresolved runtime conflict at line 18. |
action.yml |
Normalizes manifest quoting. |
.vscode/settings.json |
Configures Prettier for YAML. |
.github/workflows/update-supported-enterprise-server-versions.yml |
Normalizes cache-input quoting. |
.github/workflows/update-release-branch.yml |
Normalizes workflow indentation. |
.github/workflows/update-bundle.yml |
Creates and stages generated bundle changenotes. |
.github/workflows/test-codeql-bundle-all.yml |
Normalizes workflow formatting. |
.github/workflows/script/check-js.sh |
Removes the superseded JavaScript checker. |
.github/workflows/query-filters.yml |
Normalizes workflow formatting. |
.github/workflows/python312-windows.yml |
Normalizes workflow formatting. |
.github/workflows/publish-immutable-action.yml |
Normalizes workflow quoting. |
.github/workflows/pr-checks.yml |
Integrates the TypeScript checker and YAML validation. |
.github/workflows/codescanning-config-cli.yml |
Normalizes workflow formatting. |
.github/workflows/codeql.yml |
Normalizes workflow formatting. |
.github/workflows/__with-checkout-path.yml |
Regenerates YAML formatting. |
.github/workflows/__upload-sarif.yml |
Regenerates YAML formatting. |
.github/workflows/__upload-ref-sha-input.yml |
Regenerates YAML formatting. |
.github/workflows/__unsupported-macos.yml |
Regenerates formatting and artifact-action update. |
.github/workflows/__unset-environment.yml |
Regenerates YAML formatting. |
.github/workflows/__swift-custom-build.yml |
Regenerates YAML formatting. |
.github/workflows/__swift-autobuild.yml |
Regenerates YAML formatting. |
.github/workflows/__submit-sarif-failure.yml |
Regenerates YAML formatting. |
.github/workflows/__start-proxy.yml |
Regenerates YAML formatting. |
.github/workflows/__split-workflow.yml |
Regenerates YAML formatting. |
.github/workflows/__rust.yml |
Regenerates YAML formatting. |
.github/workflows/__ruby.yml |
Regenerates YAML formatting. |
.github/workflows/__resolve-environment-action.yml |
Regenerates YAML formatting. |
.github/workflows/__remote-config.yml |
Regenerates YAML formatting. |
.github/workflows/__per-language-bundle-validation.yml |
Regenerates YAML formatting. |
.github/workflows/__packaging-inputs-js.yml |
Regenerates YAML formatting. |
.github/workflows/__packaging-config-js.yml |
Regenerates YAML formatting. |
.github/workflows/__packaging-config-inputs-js.yml |
Regenerates YAML formatting. |
.github/workflows/__packaging-codescanning-config-inputs-js.yml |
Regenerates YAML formatting. |
.github/workflows/__overlay-init-fallback.yml |
Regenerates YAML formatting. |
.github/workflows/__multi-language-autodetect.yml |
Regenerates YAML formatting. |
.github/workflows/__local-bundle.yml |
Regenerates YAML formatting. |
.github/workflows/__linux-arm64.yml |
Regenerates YAML formatting. |
.github/workflows/__language-aliases.yml |
Regenerates YAML formatting. |
.github/workflows/__job-run-uuid-sarif.yml |
Regenerates YAML formatting. |
.github/workflows/__javascript-source-root.yml |
Regenerates YAML formatting. |
.github/workflows/__init-with-registries.yml |
Regenerates YAML formatting. |
.github/workflows/__go.yml |
Regenerates YAML formatting. |
.github/workflows/__go-tracing-legacy-workflow.yml |
Regenerates YAML formatting. |
.github/workflows/__go-tracing-custom-build-steps.yml |
Regenerates YAML formatting. |
.github/workflows/__go-tracing-autobuilder.yml |
Regenerates YAML formatting. |
.github/workflows/__go-indirect-tracing-workaround.yml |
Regenerates YAML formatting. |
.github/workflows/__go-indirect-tracing-workaround-no-file-program.yml |
Regenerates YAML formatting. |
.github/workflows/__go-indirect-tracing-workaround-diagnostic.yml |
Regenerates YAML formatting. |
.github/workflows/__go-custom-queries.yml |
Regenerates YAML formatting. |
.github/workflows/__global-proxy.yml |
Regenerates YAML formatting. |
.github/workflows/__extractor-ram-threads.yml |
Regenerates YAML formatting. |
.github/workflows/__export-file-baseline-information.yml |
Regenerates YAML formatting. |
.github/workflows/__diagnostics-without-db.yml |
Regenerates YAML formatting. |
.github/workflows/__diagnostics-export.yml |
Regenerates YAML formatting. |
.github/workflows/__cpp-deptrace-enabled.yml |
Regenerates YAML formatting. |
.github/workflows/__cpp-deptrace-enabled-on-macos.yml |
Regenerates YAML formatting. |
.github/workflows/__cpp-deptrace-disabled.yml |
Regenerates YAML formatting. |
.github/workflows/__config-input.yml |
Regenerates YAML formatting. |
.github/workflows/__config-export.yml |
Regenerates YAML formatting. |
.github/workflows/__cleanup-db-cluster-dir.yml |
Regenerates YAML formatting. |
.github/workflows/__bundle-toolcache.yml |
Regenerates YAML formatting. |
.github/workflows/__bundle-from-toolcache.yml |
Regenerates YAML formatting. |
.github/workflows/__bundle-from-nightly.yml |
Regenerates YAML formatting. |
.github/workflows/__build-mode-rollback.yml |
Regenerates YAML formatting. |
.github/workflows/__build-mode-none.yml |
Regenerates YAML formatting. |
.github/workflows/__build-mode-manual.yml |
Regenerates YAML formatting. |
.github/workflows/__build-mode-autobuild.yml |
Regenerates YAML formatting. |
.github/workflows/__autobuild-working-dir.yml |
Regenerates YAML formatting. |
.github/workflows/__autobuild-direct-tracing-with-working-dir.yml |
Regenerates YAML formatting. |
.github/workflows/__autobuild-action.yml |
Regenerates YAML formatting. |
.github/workflows/__analyze-ref-input.yml |
Regenerates YAML formatting. |
.github/workflows/__analysis-kinds.yml |
Regenerates YAML formatting. |
.github/workflows/__all-platform-bundle.yml |
Regenerates YAML formatting. |
.github/ISSUE_TEMPLATE/config.yml |
Removes trailing whitespace. |
.github/actions/release-initialise/action.yml |
Normalizes formatting and quoting. |
.github/actions/release-branches/action.yml |
Normalizes manifest quoting. |
.github/actions/query-filter-test/action.yml |
Normalizes input spacing. |
.github/actions/check-codescanning-config/action.yml |
Normalizes indentation and quoting. |
.editorconfig |
Sets YAML indentation width. |
Review effort: Balanced (auto)
| // Assume that version numbers are consistent (this should be the case on a Dependabot update PR) | ||
| actionVersions[actionName] = versionWithComment; | ||
| // Record the version of the action for this workflow. | ||
| actionVersionsByWorkflow[workflowName][actionName] = versionWithComment; |
henrymercer
approved these changes
Nov 4, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Merging 33d7b85 into
releases/v3.Conductor for this PR is @sam-robson.
Contains the following pull requests:
sync-back.ts#4292 (@mbg)globto14.0.3#4297 (@mbg)Please do the following:
package.jsonfile contains the correct version.autobuild/action.ymlinit/action.ymlresolve-environment/action.ymlsetup-codeql/action.ymlupload-sarif/action.ymlnpm run build) and push any changes to the built output inlibas a separate commit named exactlyRebuild.releases/v3branch.Create a merge commitis selected rather thanSquash and mergeorRebase and merge.