Address `ubuntu-26.04`-related CI failures by mbg · Pull Request #4267 · github/codeql-action · GitHub

ubuntu-latest is transitioning to ubuntu-26.04, which is causing a number of our CI checks to fail. This PR addresses the immediate failures to unblock other PRs:

The version of Kotlin installed by setup-kotlin uses Java functionality that is hard-deprecated. Kotlin is installed on the runners by default, but the version that is pre-installed is too new to be supported by CodeQL. This PR bumps the Kotlin version to a newer version that is compatible, and also updates the verion of setup-kotlin itself in our prepare-test action to the latest version (v2.1).
The setup-kotlin action hasn't been getting updates from Dependabot and I suspect the reason is that the Dependabot config is pointed at .github/actions while it expects to be pointed at the individual directories for re-usable actions. The directories key supports glob patterns, so I have updated this to a suitable one.
Some older versions of CodeQL aren't compatible with the Java version on ubuntu-26.04. I updated sync.ts to run them on the 24.04 images, but alternatively could have kept them on the newer ones with an explicit setup-java step to downgrade Java (although I didn't test whether that works or not).
We need to install a newer version of Ruby on ubuntu-26.04. The one we installed previously is not supported there.
code-scanning-rubocop hasn't had any updates in 2 years and even the latest version of it doesn't work with the version of Ruby we now need to install.
Therefore, I have removed the workflow that tests code-scanning-rubocop.

🟢 Approval recommended

The pinned version preserves the existing input contract, and no blocking issues were identified.

No open issues 🎉

What changed in this PR

Updates Kotlin setup for CI tests and adjusts Dependabot discovery to cover individual local action directories.

Changes:

Pins fwilhe2/setup-kotlin to the commit for v2.1.
Uses a directory glob for Dependabot updates to local actions.

File	Description
.github/dependabot.yml	Targets individual local action directories with a glob.
.github/actions/prepare-test/action.yml	Updates the Kotlin setup pin to v2.1 and normalizes input quoting.

Review effort: Max

🔵 Needs a closer look

Runner and compiler compatibility across the affected CodeQL matrix still needs confirmation from successful CI runs.

1 open issue

Document rationale for version-specific runner pin · New

6 files not reviewed

.github/workflows/__go-tracing-autobuilder.yml: Excluded by your content exclusion settings
.github/workflows/__go-tracing-custom-build-steps.yml: Excluded by your content exclusion settings
.github/workflows/__go-tracing-legacy-workflow.yml: Excluded by your content exclusion settings
.github/workflows/__multi-language-autodetect.yml: Excluded by your content exclusion settings
.github/workflows/__rubocop-multi-language.yml: Excluded by your content exclusion settings
.github/workflows/__rust.yml: Excluded by your content exclusion settings

Review effort: Max

…ror once removed

Thanks for doing this, I have a few suggestions, but none of them are blocking.

Another valid approach here would be overriding the runner image for (I think just) the multi-language check, since I believe this issue only affects checks that analyze Java.

True, but I think we probably should just merge this for now to unblock other work.

(Though I believe we don't build the PR checks project as part of CI, so we'd only see this locally)

Seeing it locally is the intended scenario, because you'd locally remove it from defaultTestVersions and then this would immediately flag up as an error.

That said, it might be worth running tsc -noEmit over the TypeScript sources in CI if we don't already. (But not in this PR.)

I presume this probably happened automatically, but we should consider adding a YAML formatter to CI to avoid this sort of noise.

Yeah it happened automatically. Agreed on adding a formatter check, but not as part of this PR.

@henrymercer Thanks for the review! I have addressed a bunch of your comments that I thought made sense to address here. The remaining ones are better for follow-up PRs I think.

Thanks!

mbg added 2 commits October 26, 2026 12:49

Update setup-kotlin to the latest version

b63386c

Point Dependabot at subdirectories in .github/actions

b913bf6

mbg requested a review from a team as a code owner October 26, 2026 12:56

Copilot AI max review requested due to automatic review settings October 26, 2026 12:56

github-actions Bot added the size/XS Should be very easy to review label Oct 26, 2026

Copilot started reviewing on behalf of mbg October 26, 2026 12:56

View session

Copilot AI reviewed Oct 26, 2026

View reviewed changes

mbg added 3 commits October 26, 2026 13:23

Install newer Kotlin version

ce7d3f7

Install a newer Ruby version

dd68f13

Temporarily switch old CLI checks to older Ubuntu runner

eac0005

mbg force-pushed the mbg/deps/setup-kotlin branch from 0d10f7b to eac0005 Compare October 26, 2026 13:23

github-actions Bot added size/S Should be easy to review and removed size/XS Should be very easy to review labels Oct 26, 2026

mbg added 2 commits October 26, 2026 13:29

Install newer version of code-scanning-rubocop

ab743b6

Remove Rubocop workflow

171607b

github-actions Bot added size/M Should be of average difficulty to review and removed size/S Should be easy to review labels Oct 26, 2026

mbg changed the title Update setup-kotlin action to the latest version Address ubuntu-26.04-related CI failures Oct 26, 2026

mbg requested review from henrymercer and a max review from Copilot October 26, 2026 13:51

Copilot started reviewing on behalf of mbg October 26, 2026 13:51

View session

Copilot AI reviewed Oct 26, 2026

View reviewed changes

Comment thread pr-checks/sync.ts Outdated

os: runnerImage,

version,

});

if (runnerImage === "ubuntu-latest" && version === "stable-v2.20.7") {

mbg added 2 commits October 26, 2026 14:26

Add comment to sync.ts

34b4917

Improve sync.ts version typing so that check constant becomes an er…

63b184d

…ror once removed

henrymercer previously approved these changes Oct 26, 2026

View reviewed changes

mbg added 4 commits October 27, 2026 10:20

Consistently use JSDocs in sync.ts

8fb8b47

Add comment for the Kotlin version

0b8f456

Add comment to debug-artifacts workflows

bcc1fbe

Remove Rubocop from deflake workflow

2908c78

mbg dismissed henrymercer’s stale review via 2908c78 October 27, 2026 11:19

mbg requested a review from henrymercer October 27, 2026 11:23

henrymercer approved these changes Oct 27, 2026

View reviewed changes

mbg added this pull request to the merge queue Oct 27, 2026

Merged via the queue into main with commit bc9bb20 Oct 27, 2026
227 checks passed

mbg deleted the mbg/deps/setup-kotlin branch October 27, 2026 11:52

mbg mentioned this pull request Oct 27, 2026

Add typecheck commands #4272

Merged

This was referenced Nov 3, 2026

Merge main into releases/v4 #4286

Merged

Merge releases/v4 into releases/v3 #4291

Merged

+                      // stable-v2.20.7 requires an older version of Java than the default on `ubuntu-latest`.
+                      // We could install that older version on the newer runners, or use the older runner.
+                      // We do the latter here. This can be removed once we stop supporting `v2.20.7`.
+                      // Since this is typed as `DefaultTestVersion`, it will become an error once `stable-v2.20.7`
+                      // is removed from `defaultTestVersions`.
+                      const requiresOlderRunnerImage: DefaultTestVersion = "stable-v2.20.7";
+                      if (
+                        runnerImage === "ubuntu-latest" &&
+                        version === requiresOlderRunnerImage
+                      ) {
+                        matrix.push({ os: "ubuntu-24.04", version });
+                      } else {

                 use-all-platform-bundle:
                   description: "If true, we output a tools URL with codeql-bundle.tar.gz file rather than platform-specific URL"
-                  default: 'false'
+                  default: "false"

-                        os: runnerImage,
-                        version,
-                      });
+                      if (runnerImage === "ubuntu-latest" && version === "stable-v2.20.7") {

		// Since this is typed as `DefaultTestVersion`, it will become an error once `stable-v2.20.7`
		// is removed from `defaultTestVersions`.

Address `ubuntu-26.04`-related CI failures by mbg · Pull Request #4267 · github/codeql-action · GitHub

Repository navigation

Address ubuntu-26.04-related CI failures - #4267

Address ubuntu-26.04-related CI failures#4267mbg merged 13 commits intomaingithub/codeql-action:mainfrom mbg/deps/setup-kotlingithub/codeql-action:mbg/deps/setup-kotlinCopy head branch name to clipboard

Conversation

mbg commented Oct 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟢 Approval recommended

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🔵 Needs a closer look

Uh oh!

henrymercer left a comment

Choose a reason for hiding this comment

Uh oh!

henrymercer Oct 26, 2026

Choose a reason for hiding this comment

Uh oh!

mbg Oct 27, 2026

Choose a reason for hiding this comment

Uh oh!

henrymercer Oct 26, 2026

Choose a reason for hiding this comment

Uh oh!

mbg Oct 27, 2026

Choose a reason for hiding this comment

Uh oh!

mbg Oct 27, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

henrymercer Oct 26, 2026

Choose a reason for hiding this comment

Uh oh!

mbg Oct 27, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

mbg commented Oct 27, 2026

Uh oh!

henrymercer left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Address ubuntu-26.04-related CI failures#4267
mbg merged 13 commits into
mainfrom
mbg/deps/setup-kotlin

mbg commented Oct 26, 2026 •
edited
Loading