Consistently format YAML and add CI check by mbg · Pull Request #4280 · github/codeql-action · GitHub

Improves some YAML-related project configuration, adds prettier as a dev dependency along with a command to use it to format YAML files in the repository. Also adds a CI check to ensure that the YAML files are correctly formatted, which is done with a cherry-picked change from #4064 that converts check-js.sh to TypeScript that is then extended to be able to run checks for either JS or YAML.

Notes for reviewers

The formatting/checking is done using prettier, which we already have configured for TypeScript in .vscode/settings.json.
The PR updates some project configuration files to make sure that prettier is used consistently and using consistent settings.
The PR bumps prettier to the latest version (at the time of writing), which causes some minor TypeScript formatting changes.
All of the YAML files are formatted using prettier and sync.ts is updated to emit compatible formatting where that wasn't already the case. This simplifies sync.ts a bit.
There's also a change to some production code in src/analyze.ts for diffRangeExtensionPackContents which constructs a YAML file using string concatenation. I think ideally we'd update this to just build the required object and then have one call to YAML.dump, but I didn't want to change this more than necessary.
- This change was needed because we have a YAML file in the repo with the expected output from this, and which is now subject to the formatting requirements. We could manually exclude that file instead.

🟡 Changes recommended

A byte-for-byte fixture mismatch risks CI test failures, while dirty-checkout handling and a Node 20-incompatible entry-point guard can silently bypass required checks.

4 open issues

Formatted fixture no longer matches generated output · New
Dirty checkout incorrectly skips rebuild and formatting · New
Failure summaries are not written before exit · New
Compiled-JS check is skipped on Node 20 · New

58 files not reviewed

.github/workflows/__all-platform-bundle.yml: Excluded by your content exclusion settings
.github/workflows/__analysis-kinds.yml: Excluded by your content exclusion settings
.github/workflows/__analyze-ref-input.yml: Excluded by your content exclusion settings
.github/workflows/__autobuild-action.yml: Excluded by your content exclusion settings
.github/workflows/__autobuild-direct-tracing-with-working-dir.yml: Excluded by your content exclusion settings
.github/workflows/__autobuild-working-dir.yml: Excluded by your content exclusion settings
.github/workflows/__build-mode-autobuild.yml: Excluded by your content exclusion settings
.github/workflows/__build-mode-manual.yml: Excluded by your content exclusion settings
.github/workflows/__build-mode-none.yml: Excluded by your content exclusion settings
.github/workflows/__build-mode-rollback.yml: Excluded by your content exclusion settings
.github/workflows/__bundle-from-nightly.yml: Excluded by your content exclusion settings
.github/workflows/__bundle-from-toolcache.yml: Excluded by your content exclusion settings
.github/workflows/__bundle-toolcache.yml: Excluded by your content exclusion settings
.github/workflows/__cleanup-db-cluster-dir.yml: Excluded by your content exclusion settings
.github/workflows/__config-export.yml: Excluded by your content exclusion settings
.github/workflows/__config-input.yml: Excluded by your content exclusion settings
.github/workflows/__cpp-deptrace-disabled.yml: Excluded by your content exclusion settings
.github/workflows/__cpp-deptrace-enabled-on-macos.yml: Excluded by your content exclusion settings
.github/workflows/__cpp-deptrace-enabled.yml: Excluded by your content exclusion settings
.github/workflows/__diagnostics-export.yml: Excluded by your content exclusion settings

And 38 more.

What changed in this PR

This PR standardizes YAML formatting across the CodeQL Action repository and adds CI enforcement, extending the TypeScript CI-script migration from #4064.

Changes:

Adds Prettier, a YAML formatting command, and editor configuration.
Replaces the JavaScript verification shell script with a shared TypeScript checker for JavaScript and YAML.
Normalizes YAML formatting and adjusts workflow generation to use double quotes.

File	Description
upload-sarif/action.yml	Normalizes YAML quoting.
tsconfig.json	Excludes the Prettier configuration from compilation.
tests/multi-language-repo/codeql-qlpacks/python-qlpack/qlpack.yml	Adds a final newline.
tests/multi-language-repo/codeql-qlpacks/javascript-qlpack/qlpack.yml	Adds a final newline.
tests/multi-language-repo/codeql-qlpacks/java-qlpack/qlpack.yml	Adds a final newline.
tests/multi-language-repo/codeql-qlpacks/go-qlpack/qlpack.yml	Adds a final newline.
tests/multi-language-repo/codeql-qlpacks/csharp-qlpack/qlpack.yml	Adds a final newline.
tests/multi-language-repo/codeql-qlpacks/cpp-qlpack/qlpack.yml	Adds a final newline.
tests/multi-language-repo/codeql-qlpacks/complex-python-qlpack/qlpack.yml	Adds a final newline.
tests/multi-language-repo/codeql-qlpacks/complex-javascript-qlpack/qlpack.yml	Adds a final newline.
tests/multi-language-repo/.github/codeql/custom-queries.yml	Aligns comments with query entries.
tests/multi-language-repo/.github/codeql/codeql-config-query-filters3.yml	Normalizes indentation and spacing.
tests/multi-language-repo/.github/codeql/codeql-config-query-filters2.yml	Normalizes filter indentation.
tests/multi-language-repo/.github/codeql/codeql-config-query-filters1.yml	Normalizes filter indentation.
src/testdata/pr-diff-range.yml	Formats the diff-range fixture.
setup-codeql/action.yml	Normalizes YAML quoting.
resolve-environment/action.yml	Normalizes YAML quoting.
prettier.config.mts	Sets the formatter’s print width.
pr-checks/update-release-branch.ts	Imports extracted command helpers.
pr-checks/sync.ts	Uses double quotes in generated YAML.
pr-checks/config.ts	Exports shared repository paths.
pr-checks/command.ts	Houses shared command and Git helpers.
pr-checks/checks/upload-sarif.yml	Normalizes input quoting.
pr-checks/checks/upload-ref-sha-input.yml	Normalizes input quoting.
pr-checks/checks/overlay-init-fallback.yml	Normalizes inline-comment spacing.
pr-checks/checks/init-with-registries.yml	Normalizes block-scalar indentation.
pr-checks/checks/analyze-ref-input.yml	Normalizes input quoting.
pr-checks/check-unchanged.ts	Adds shared JavaScript and YAML verification.
package.json	Adds Prettier and the formatting command.
package-lock.json	Records the Prettier dependency update.
init/action.yml	Normalizes YAML quoting.
eslint.config.mjs	Excludes the Prettier configuration from linting.
autobuild/action.yml	Normalizes YAML quoting.
action.yml	Normalizes stub-action quoting.
.vscode/settings.json	Configures YAML formatting in VS Code.
.github/workflows/update-supported-enterprise-server-versions.yml	Normalizes cache-input quoting.
.github/workflows/update-release-branch.yml	Normalizes indentation and comment spacing.
.github/workflows/update-bundle.yml	Normalizes YAML quoting.
.github/workflows/test-codeql-bundle-all.yml	Normalizes indentation and quoting.
.github/workflows/script/check-js.sh	Removes the replaced shell checker.
.github/workflows/rebuild.yml	Normalizes cache-input quoting.
.github/workflows/query-filters.yml	Normalizes indentation, quoting, and spacing.
.github/workflows/python312-windows.yml	Normalizes indentation and schedule quoting.
.github/workflows/publish-immutable-action.yml	Normalizes name and tag-pattern quoting.
.github/workflows/pr-checks.yml	Invokes the TypeScript checker for both formats.
.github/workflows/post-release-mergeback.yml	Normalizes quoting and comment spacing.
.github/workflows/codescanning-config-cli.yml	Normalizes indentation and quoting.
.github/workflows/codeql.yml	Normalizes indentation and matrix formatting.
.github/ISSUE_TEMPLATE/config.yml	Removes trailing whitespace.
.github/actions/release-initialise/action.yml	Normalizes quoting and spacing.
.github/actions/release-branches/action.yml	Normalizes metadata quoting.
.github/actions/query-filter-test/action.yml	Removes extra input spacing.
.github/actions/check-codescanning-config/action.yml	Normalizes indentation and quoting.
.editorconfig	Adds a YAML indentation section.

Review effort: Balanced (auto)

…y initial line

Is it worth running this through prettier.format?

Maybe, but as far as I can tell the formatting that comes out of here and the prettier expectations are fairly well aligned. We could look at doing this if we find that it's a problem in the future.

Copilot AI dynamic review requested due to automatic review settings October 30, 2026 12:45

mbg requested a review from a team as a code owner October 30, 2026 12:45

Copilot started reviewing on behalf of mbg October 30, 2026 12:46

View session

Copilot AI reviewed Oct 30, 2026

View reviewed changes

Comment thread src/testdata/pr-diff-range.yml Resolved

Comment thread pr-checks/check-unchanged.ts Resolved

Comment thread pr-checks/check-unchanged.ts Resolved

Comment thread pr-checks/check-unchanged.ts Resolved

github-actions Bot added the size/XL May be very hard to review label Oct 30, 2026

mbg force-pushed the mbg/ci/validate-yaml branch from 40a548c to fa95e87 Compare October 30, 2026 15:04

mbg added 13 commits October 30, 2026 15:13

Update .editorconfig with explicit indent_size for YAML

d805a56

Update VSCode settings with YAML formatter

3f9319d

Add prettier as dev dependency

fef5200

Apply consistent YAML formatting

2c6d525

Move subprocess helpers from update-release-branch.ts to command.ts

6c2d540

Convert check-js.sh to TypeScript

c8db21e

Refactor check-js.ts into separate functions

549d739

Rename to check-unchanged and add YAML check

b2e3b75

Fix checkUnchanged returning -1

ff6ba28

Fix missing core.summary.write call

c434c1b

Fix inconsistent quoting in diffRangeExtensionPackContents and empt…

878c513

…y initial line

Configure VSCode to use local version of prettier

69543ab

Run lint-fix with newer version of prettier

fab591c

mbg force-pushed the mbg/ci/validate-yaml branch from fa95e87 to fab591c Compare October 30, 2026 15:34

mbg added 4 commits October 30, 2026 17:41

Avoid ESM-specific entry check for now

9fe80b6

Merge branch 'main' into mbg/ci/validate-yaml

9151e90

Merge remote-tracking branch 'origin/main' into mbg/ci/validate-yaml

70417cd

Merge branch 'main' into mbg/ci/validate-yaml

7bcfa1e

mbg requested a review from henrymercer November 3, 2026 13:42

henrymercer reviewed Nov 4, 2026

View reviewed changes

mbg added 4 commits November 4, 2026 11:56

Merge remote-tracking branch 'origin/main' into mbg/ci/validate-yaml

160e547

Use normal .editorconfig pattern

8eb7cdf

Remove exclude entry that's no longer needed

7287bb3

Return different exit code when a language is not recognised

cea289b

henrymercer approved these changes Nov 4, 2026

View reviewed changes

mbg enabled auto-merge November 4, 2026 12:07

mbg added this pull request to the merge queue Nov 4, 2026

Merged via the queue into main with commit 8cd4dfa Nov 4, 2026
231 checks passed

mbg deleted the mbg/ci/validate-yaml branch November 4, 2026 12:29

This was referenced Nov 4, 2026

Merge main into releases/v4 #4299

Merged

Merge releases/v4 into releases/v3 #4304

Merged

                 const yamlStr = yaml.stringify(workflowDoc, {
                   aliasDuplicateObjects: false,
-                  singleQuote: true,
+                  singleQuote: false,
                   lineWidth: 0,
                 });

Consistently format YAML and add CI check by mbg · Pull Request #4280 · github/codeql-action · GitHub

Repository navigation

Consistently format YAML and add CI check - #4280

Consistently format YAML and add CI check#4280
mbg merged 21 commits into
mainfrom
mbg/ci/validate-yaml

mbg commented Oct 30, 2026 •
edited
Loading

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

henrymercer Nov 4, 2026

Uh oh!

mbg Nov 4, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Consistently format YAML and add CI check by mbg · Pull Request #4280 · github/codeql-action · GitHub

Repository navigation

Consistently format YAML and add CI check - #4280

Consistently format YAML and add CI check#4280mbg merged 21 commits intomaingithub/codeql-action:mainfrom mbg/ci/validate-yamlgithub/codeql-action:mbg/ci/validate-yamlCopy head branch name to clipboard

Conversation

mbg commented Oct 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

henrymercer Nov 4, 2026

Choose a reason for hiding this comment

Uh oh!

mbg Nov 4, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Consistently format YAML and add CI check#4280
mbg merged 21 commits into
mainfrom
mbg/ci/validate-yaml

mbg commented Oct 30, 2026 •
edited
Loading