PR checks: Only run Go macOS tests on latest CodeQL versions by henrymercer · Pull Request #3565 · github/codeql-action · GitHub

Drop Go macOS tests on older CodeQL versions due to usage in production being predominantly Linux and using up to date CodeQL versions.

Pull request overview

This PR updates the PR-check specification templates and their generated workflows, with the stated goal of reducing macOS coverage for Go tracing checks on older CodeQL bundle versions.

Changes:

Reformats many check specs to use multi-line YAML lists for versions, operatingSystems, and analysisKinds.
Introduces an osCodeQlVersions key in Go tracing check specs to try to restrict macOS runs to newer CodeQL versions.
Updates corresponding generated __*.yml workflows.

Reviewed changes

Copilot reviewed 57 out of 57 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
pr-checks/checks/with-checkout-path.yml	Reformat versions list
pr-checks/checks/upload-sarif.yml	Reformat versions/analysisKinds
pr-checks/checks/upload-ref-sha-input.yml	Reformat versions list
pr-checks/checks/swift-custom-build.yml	Reformat versions/operatingSystems
pr-checks/checks/swift-autobuild.yml	Reformat versions/operatingSystems
pr-checks/checks/submit-sarif-failure.yml	Reformat versions list
pr-checks/checks/start-proxy.yml	Reformat operatingSystems/versions
pr-checks/checks/split-workflow.yml	Reformat lists; move comment
pr-checks/checks/ruby.yml	Reformat versions/operatingSystems
pr-checks/checks/rubocop-multi-language.yml	Reformat versions list
pr-checks/checks/resolve-environment-action.yml	Reformat versions list
pr-checks/checks/packaging-inputs-js.yml	Reformat versions; move comment
pr-checks/checks/packaging-config-js.yml	Reformat versions; move comment
pr-checks/checks/packaging-config-inputs-js.yml	Reformat versions; move comment
pr-checks/checks/packaging-codescanning-config-inputs-js.yml	Reformat versions; move comment
pr-checks/checks/overlay-init-fallback.yml	Reformat versions list
pr-checks/checks/multi-language-autodetect.yml	Update description; reformat OS list
pr-checks/checks/local-bundle.yml	Reformat versions list
pr-checks/checks/language-aliases.yml	Reformat versions list
pr-checks/checks/job-run-uuid-sarif.yml	Reformat versions list
pr-checks/checks/javascript-source-root.yml	Reformat versions; move comment
pr-checks/checks/init-with-registries.yml	Convert bracketed versions to list
pr-checks/checks/go-tracing-legacy-workflow.yml	Add osCodeQlVersions for macOS
pr-checks/checks/go-tracing-custom-build-steps.yml	Add osCodeQlVersions for macOS
pr-checks/checks/go-tracing-autobuilder.yml	Add osCodeQlVersions for macOS
pr-checks/checks/go-indirect-tracing-workaround.yml	Reformat versions list
pr-checks/checks/go-indirect-tracing-workaround-no-file-program.yml	Reformat versions list
pr-checks/checks/go-indirect-tracing-workaround-diagnostic.yml	Reformat versions list
pr-checks/checks/global-proxy.yml	Reformat versions list
pr-checks/checks/extractor-ram-threads.yml	Reformat versions list
pr-checks/checks/export-file-baseline-information.yml	Reformat operatingSystems/versions
pr-checks/checks/diagnostics-export.yml	Reformat versions list
pr-checks/checks/cpp-deptrace-enabled.yml	Reformat versions list
pr-checks/checks/cpp-deptrace-enabled-on-macos.yml	Reformat OS/versions lists
pr-checks/checks/cpp-deptrace-disabled.yml	Reformat versions list
pr-checks/checks/config-input.yml	Reformat versions list
pr-checks/checks/config-export.yml	Reformat versions list
pr-checks/checks/cleanup-db-cluster-dir.yml	Reformat versions list
pr-checks/checks/bundle-zstd.yml	Reorder operatingSystems list
pr-checks/checks/bundle-toolcache.yml	Reorder operatingSystems list
pr-checks/checks/build-mode-rollback.yml	Reformat versions list
pr-checks/checks/build-mode-none.yml	Reformat versions list
pr-checks/checks/build-mode-manual.yml	Reformat versions list
pr-checks/checks/build-mode-autobuild.yml	Reformat OS/versions lists
pr-checks/checks/autobuild-working-dir.yml	Reformat versions list
pr-checks/checks/autobuild-direct-tracing-with-working-dir.yml	Reformat OS/versions lists
pr-checks/checks/autobuild-action.yml	Reformat OS/versions lists
pr-checks/checks/analyze-ref-input.yml	Reformat versions list
pr-checks/checks/analysis-kinds.yml	Reformat versions/analysisKinds
pr-checks/checks/all-platform-bundle.yml	Reformat OS/versions lists
.github/workflows/__resolve-environment-action.yml	Regenerated workflow output
.github/workflows/__multi-language-autodetect.yml	Regenerated workflow output
.github/workflows/__go-tracing-legacy-workflow.yml	Regenerated workflow output
.github/workflows/__go-tracing-custom-build-steps.yml	Regenerated workflow output
.github/workflows/__go-tracing-autobuilder.yml	Regenerated workflow output
.github/workflows/__bundle-zstd.yml	Regenerated workflow output
.github/workflows/__bundle-toolcache.yml	Regenerated workflow output

Lists are easier to modify

Pull request overview

Copilot reviewed 58 out of 58 changed files in this pull request and generated 1 comment.

osCodeQlVersions is assumed to be a string[], but if a template accidentally provides a scalar (e.g. macos: linked) or other non-array value, this code will still run (because strings have .includes) and can silently produce an incomplete/incorrect matrix. Consider validating allowedVersions with Array.isArray(...) (and throwing a clear error if not), and optionally validating that the osCodeQlVersions keys match entries in operatingSystems to catch typos early.

Might be worth adding a JSON schema for the PR checks to validate this, rather than needing to validate each property individually. I think this is best left to a future PR.

LGTM with one minor thought on maintainability.

Stray thought: it could be useful to be able to flip this around and specify what we don't want to run on.

Yeah, our approach could use a rethink. We support a bunch of Action / CLI combinations, but is impractical to run PR checks against every combination so in practice most checks just run against linked, default, and nightly-latest. Providing CI is sufficiently unflaky though, it could be useful to start running nightly checks against the full set of combinations.

henrymercer requested a review from a team as a code owner March 11, 2026 15:32

Copilot AI review requested due to automatic review settings March 11, 2026 15:32

github-actions Bot added the size/L May be hard to review label Mar 11, 2026

Copilot started reviewing on behalf of henrymercer March 11, 2026 15:32 View session

henrymercer marked this pull request as draft March 11, 2026 15:33

Copilot AI reviewed Mar 11, 2026

View reviewed changes

Comment thread pr-checks/checks/go-tracing-autobuilder.yml

Comment thread pr-checks/checks/go-tracing-custom-build-steps.yml

Comment thread pr-checks/checks/go-tracing-legacy-workflow.yml

henrymercer added 4 commits March 11, 2026 17:10

PR checks: Add support for per-OS CodeQL version

2bc0658

PR checks: Only run Go macOS tests on latest CodeQL versions

4174779

PR checks: Replace inline arrays

30ecc82

Lists are easier to modify

Sort OS list and versions consistently

117bf91

henrymercer force-pushed the henrymercer/go-macos-checks branch from 84db137 to 117bf91 Compare March 11, 2026 17:13

henrymercer marked this pull request as ready for review March 11, 2026 17:13

henrymercer requested a review from Copilot March 11, 2026 17:13

Copilot started reviewing on behalf of henrymercer March 11, 2026 17:14 View session

Copilot AI reviewed Mar 11, 2026

View reviewed changes

esbena approved these changes Mar 11, 2026

View reviewed changes

henrymercer added this pull request to the merge queue Mar 11, 2026

Merged via the queue into main with commit 309fd2a Mar 11, 2026
269 of 444 checks passed

henrymercer deleted the henrymercer/go-macos-checks branch March 11, 2026 19:27

This was referenced Mar 16, 2026

Merge main into releases/v4 #3574

Merged

Merge releases/v4 into releases/v3 #3577

Merged

+                    // If osCodeQlVersions is set for this OS, only include the specified CodeQL versions.
+                    const allowedVersions =
+                      checkSpecification.osCodeQlVersions?.[operatingSystem];
+                    if (allowedVersions && !allowedVersions.includes(version)) {
+                      continue;
+                    }

PR checks: Only run Go macOS tests on latest CodeQL versions by henrymercer · Pull Request #3565 · github/codeql-action · GitHub

Uh oh!

PR checks: Only run Go macOS tests on latest CodeQL versions - #3565

PR checks: Only run Go macOS tests on latest CodeQL versions#3565
henrymercer merged 4 commits into
mainfrom
henrymercer/go-macos-checks

henrymercer commented Mar 11, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Mar 11, 2026

Uh oh!

henrymercer Mar 11, 2026

Uh oh!

esbena left a comment

Uh oh!

esbena Mar 11, 2026

Uh oh!

henrymercer Mar 11, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

+              versions:
+                - linked
+                - default
+                - nightly-latest

PR checks: Only run Go macOS tests on latest CodeQL versions by henrymercer · Pull Request #3565 · github/codeql-action · GitHub

Uh oh!

PR checks: Only run Go macOS tests on latest CodeQL versions - #3565

PR checks: Only run Go macOS tests on latest CodeQL versions#3565henrymercer merged 4 commits intomaingithub/codeql-action:mainfrom henrymercer/go-macos-checksgithub/codeql-action:henrymercer/go-macos-checksCopy head branch name to clipboard

Conversation

henrymercer commented Mar 11, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Mar 11, 2026

Choose a reason for hiding this comment

Uh oh!

henrymercer Mar 11, 2026

Choose a reason for hiding this comment

Uh oh!

esbena left a comment

Choose a reason for hiding this comment

Uh oh!

esbena Mar 11, 2026

Choose a reason for hiding this comment

Uh oh!

henrymercer Mar 11, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

PR checks: Only run Go macOS tests on latest CodeQL versions#3565
henrymercer merged 4 commits into
mainfrom
henrymercer/go-macos-checks