Merge releases/v4 into releases/v3 by github-actions[bot] · Pull Request #3254 · github/codeql-action · GitHub

Merging 5fe9434 into releases/v3.

Conductor for this PR is @henrymercer.

Contains the following pull requests:

Please do the following:

Ensure the CHANGELOG displays the correct version and date.
Ensure the CHANGELOG includes all relevant, user-facing changes since the last release.
Check that there are not any unexpected commits being merged into the releases/v3 branch.
Ensure the docs team is aware of any documentation changes that need to be released.
Remove and re-add the "Rebuild" label to the PR to trigger just this workflow.
Wait for the "Rebuild" workflow to push a commit updating the distribution files.
Mark the PR as ready for review to trigger the full set of PR checks.
Approve and merge this PR. Make sure Create a merge commit is selected rather than Squash and merge or Rebase and merge.

Mergeback v4.31.0 refs/heads/releases/v4 into main

Ensure uniqueness of overlay-base database cache keys

…utation Move diff-range computation into utils

Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 4 to 5. - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](actions/upload-artifact@v4...v5) --- updated-dependencies: - dependency-name: actions/upload-artifact dependency-version: '5' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps the npm-minor group with 4 updates: [@octokit/types](https://github.com/octokit/types.ts), [@types/archiver](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/archiver), [@typescript-eslint/eslint-plugin](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin) and [@typescript-eslint/parser](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser). Updates `@octokit/types` from 15.0.0 to 15.0.1 - [Release notes](https://github.com/octokit/types.ts/releases) - [Commits](octokit/types.ts@v15.0.0...v15.0.1) Updates `@types/archiver` from 6.0.3 to 6.0.4 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/archiver) Updates `@typescript-eslint/eslint-plugin` from 8.46.1 to 8.46.2 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/eslint-plugin/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.46.2/packages/eslint-plugin) Updates `@typescript-eslint/parser` from 8.46.1 to 8.46.2 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/parser/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.46.2/packages/parser) --- updated-dependencies: - dependency-name: "@octokit/types" dependency-version: 15.0.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-minor - dependency-name: "@types/archiver" dependency-version: 6.0.4 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-minor - dependency-name: "@typescript-eslint/eslint-plugin" dependency-version: 8.46.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-minor - dependency-name: "@typescript-eslint/parser" dependency-version: 8.46.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-minor ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [@actions/artifact](https://github.com/actions/toolkit/tree/HEAD/packages/artifact) from 2.3.1 to 4.0.0. - [Changelog](https://github.com/actions/toolkit/blob/main/packages/artifact/RELEASES.md) - [Commits](https://github.com/actions/toolkit/commits/@actions/cache@4.0.0/packages/artifact) --- updated-dependencies: - dependency-name: "@actions/artifact" dependency-version: 4.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps the actions-minor group with 1 update in the /.github/workflows directory: [ruby/setup-ruby](https://github.com/ruby/setup-ruby). Updates `ruby/setup-ruby` from 1.265.0 to 1.267.0 - [Release notes](https://github.com/ruby/setup-ruby/releases) - [Changelog](https://github.com/ruby/setup-ruby/blob/master/release.rb) - [Commits](ruby/setup-ruby@ab177d4...d5126b9) --- updated-dependencies: - dependency-name: ruby/setup-ruby dependency-version: 1.267.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-minor ... Signed-off-by: dependabot[bot] <support@github.com>

This was introduced in Node.js 18

Support skipping workflow validation

This allows us to remove the `console-log-level` dependency.

Use Actions logger in API client

Turn enablement errors into configuration errors

Co-authored-by: Esben Sparre Andreasen <esbena@github.com>

Remove `add-snippets` input

Merge main into releases/v4

This reverts commit 7dd1575.

This reverts commit 9e3918e.

….1-5fe9434cd

Pushed a commit to rebuild the Action. Please mark the PR as ready for review to trigger PR checks.

Pull Request Overview

This PR merges changes from releases/v4 into releases/v3 as part of the release process for version 3.31.1. The primary purpose is to remove the deprecated add-snippets input from the analyze action and update several dependencies.

Key changes:

Removal of the add-snippets input and related functionality
Replacement of del and check-disk-space dependencies with native Node.js APIs
Update to Actions artifact upload action from v4 to v5
Improvements to workflow validation and disk usage checking

Reviewed Changes

Copilot reviewed 41 out of 54 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
CHANGELOG.md, package.json	Version bump to 3.31.1 and documentation of the add-snippets removal
analyze/action.yml, src/analyze-action.ts	Removal of add-snippets input and deprecation warnings
src/util.ts	Replaced del and check-disk-space with native fs.promises APIs
src/workflow.ts	Refactored workflow validation into a new checkWorkflow function
src/api-client.ts	Added feature enablement error handling and logging configuration
src/overlay-database-utils.ts	Enhanced cache key generation with run/attempt IDs
src/diff-informed-analysis-utils.ts	Moved diff range calculation logic from analyze.ts
Various workflow files	Updated artifact upload action to v5 and Ruby setup action version

The console-log-level dependency appears to be unused after the refactoring in src/api-client.ts which now uses core.debug, core.info, core.warning, and core.error directly. This dependency should be removed from package.json.

Suggested change

"console-log-level": "^1.4.1",

Resolved here: #3256

The default values of 1 for runId and attemptId could lead to cache key collisions if the workflow run ID or attempt ID cannot be retrieved. Consider using more distinctive default values (e.g., 0 or a unique identifier) to make it clearer when these values are fallbacks rather than actual workflow data.

Suggested change

      
              let runId = 1;
          
              let attemptId = 1;
          
              let runId = 0;
          
              let attemptId = 0;

cklin and others added 30 commits October 24, 2025 10:47

Add overlay-base database cache key tests

c4b7372

Ensure uniqueness of overlay-base database cache keys

b4ce335

Reorder components of overlay-base cache key postfix

cbcae45

Improve error handling for overlay-base cache key creation

66759e5

Update changelog and version after v4.31.0

fa46f22

Rebuild

dd565f3

Merge pull request #3236 from github/mergeback/v4.31.0-to-main-4e94bd11

ae78991

Mergeback v4.31.0 refs/heads/releases/v4 into main

Merge pull request #3232 from github/kaspersv/unique-overlay-base-keys

4e0b2cd

Ensure uniqueness of overlay-base database cache keys

Move diff-range computation into utils for reuse

91ec0ed

Move diff-range computation tests

cc17bed

Remove add-snippets input

db47d17

Merge pull request #3238 from github/kaspersv/extract-diff-range-comp…

8d77149

…utation Move diff-range computation into utils

Add environment variable for skipping workflow validation

127851b

Move workflow check to a function in init.ts and add tests

06fbd89

Also skip workflow validation for dynamic workflows

5060176

Move checkWorkflow to workflow.ts

55c0837

Downgrade log message from warning to debug level

52cec41

Rebuild

714962e

Rebuild

df9e49e

Rebuild

723a946

Rebuild

fcc1377

Check disk usage using Node.js API

239e305

This was introduced in Node.js 18

Merge pull request #3240 from github/mbg/allow-skip-workflow-validation

ad8ad98

Support skipping workflow validation

Build: Run npm install when package-lock.json out of date

20900ee

Use Actions logger in API client

8b1e55d

This allows us to remove the `console-log-level` dependency.

Disable SIP disablement check

57c7b6a

henrymercer and others added 14 commits October 28, 2025 17:05

Merge pull request #3249 from github/henrymercer/api-logging

ac9aeee

Use Actions logger in API client

Turn enablement errors into configuration errors

53acf0b

Make error message tests less brittle

194ba0e

Check for 403 status

52a7bd7

Warn if the add-snippets input is used

4ae68af

Merge pull request #3251 from github/mbg/user-error/enablement

34c50c1

Turn enablement errors into configuration errors

Update analyze/action.yml

74c8748

Co-authored-by: Esben Sparre Andreasen <esbena@github.com>

Merge pull request #3239 from github/mbg/remove/add-snippets

777daa0

Remove `add-snippets` input

Update changelog for v4.31.1

237497c

Merge pull request #3252 from github/update-v4.31.1-777daa0c7

5fe9434

Merge main into releases/v4

Revert "Update version and changelog for v3.31.0"

37e7dfb

This reverts commit 7dd1575.

Revert "Rebuild"

2f60793

This reverts commit 9e3918e.

Merge remote-tracking branch 'origin/releases/v4' into backport-v3.31…

ddd0dc7

….1-5fe9434cd

Update version and changelog for v3.31.1

c0d3370

github-actions Bot added the Rebuild Re-transpile JS & re-generate workflows label Oct 30, 2025

github-actions Bot assigned henrymercer Oct 30, 2025

henrymercer added Rebuild Re-transpile JS & re-generate workflows and removed Rebuild Re-transpile JS & re-generate workflows labels Oct 30, 2025

github-actions Bot removed the Rebuild Re-transpile JS & re-generate workflows label Oct 30, 2025

Rebuild

c2805e0

henrymercer marked this pull request as ready for review October 30, 2025 10:36

henrymercer requested a review from a team as a code owner October 30, 2025 10:36

Copilot AI review requested due to automatic review settings October 30, 2025 10:36

github-actions Bot added the size/XXL May be extremely hard to review label Oct 30, 2025

Copilot AI reviewed Oct 30, 2025

View reviewed changes

henrymercer approved these changes Oct 30, 2025

View reviewed changes

henrymercer enabled auto-merge October 30, 2025 10:41

henrymercer merged commit c503cb4 into releases/v3 Oct 30, 2025

henrymercer deleted the backport-v3.31.1-5fe9434cd branch October 30, 2025 11:00

                   "@schemastore/package": "0.0.10",
                   "archiver": "^7.0.1",
-                  "check-disk-space": "^3.4.0",
                   "console-log-level": "^1.4.1",

Merge releases/v4 into releases/v3 by github-actions[bot] · Pull Request #3254 · github/codeql-action · GitHub

Repository navigation

Merge releases/v4 into releases/v3 - #3254

Merge releases/v4 into releases/v3#3254
henrymercer merged 61 commits into
releases/v3from
backport-v3.31.1-5fe9434cd

github-actions Bot commented Oct 30, 2025

Uh oh!

github-actions Bot commented Oct 30, 2025

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Oct 30, 2025

Uh oh!

henrymercer Oct 30, 2025

Uh oh!

Copilot AI Oct 30, 2025

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

Merge releases/v4 into releases/v3 by github-actions[bot] · Pull Request #3254 · github/codeql-action · GitHub

Repository navigation

Merge releases/v4 into releases/v3 - #3254

Merge releases/v4 into releases/v3#3254henrymercer merged 61 commits intoreleases/v3github/codeql-action:releases/v3from backport-v3.31.1-5fe9434cdgithub/codeql-action:backport-v3.31.1-5fe9434cdCopy head branch name to clipboard

Conversation

github-actions Bot commented Oct 30, 2025

Uh oh!

github-actions Bot commented Oct 30, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Copilot AI Oct 30, 2025

Choose a reason for hiding this comment

Uh oh!

henrymercer Oct 30, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Oct 30, 2025

Choose a reason for hiding this comment

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

Merge releases/v4 into releases/v3#3254
henrymercer merged 61 commits into
releases/v3from
backport-v3.31.1-5fe9434cd