Merge releases/v4 into releases/v3 - #3577
Merged
mbg merged 147 commits intoMar 16, 2026
Merged
Conversation
Copy link
Copy Markdown
Contributor
Sorry, something went wrong.
Mergeback v4.32.6 refs/heads/releases/v4 into main
Copy link
Copy Markdown
Contributor
Author
|
Pushed a commit to rebuild the Action. Please mark the PR as ready for review to trigger PR checks. |
Sorry, something went wrong.
mbg
approved these changes
Mar 16, 2026
oscarsj
enabled auto-merge
March 16, 2026 11:29
Copy link
Copy Markdown
Contributor
There was a problem hiding this comment.
Pull request overview
This PR prepares the CodeQL Action v3.33.0 release by adding new configuration/feature plumbing (repository properties, file-coverage PR deprecation messaging), improving robustness (DB upload retries, JSON validation helpers), and extending start-proxy credential support (OIDC-style configs), along with associated test/workflow/pr-checks updates.
Changes:
- Add typed JSON parsing/validation helpers and apply them across multiple codepaths (credentials parsing, overlay status parsing, etc.).
- Add repository-property support enhancements (including GHES) and introduce file-coverage-on-PRs deprecation messaging + opt-out mechanisms.
- Fix database upload retry behavior for streaming bodies and refactor action version sourcing to be injected at build time.
Reviewed changes
Copilot reviewed 135 out of 140 changed files in this pull request and generated 4 comments.
Show a summary per file| File | Description |
|---|---|
| src/json/index.ts | Introduces shared helpers for parsing/validating JSON-derived values. |
| src/util.ts | Uses new JSON helpers for safer HTTP error detection. |
| src/start-proxy/types.ts | Refactors credential typing, adds OIDC auth config types, and moves credential pretty-printing here. |
| src/start-proxy/types.test.ts | Adds unit tests for credential pretty-printing and secret masking. |
| src/start-proxy.ts | Strengthens credentials parsing/validation, adds auth-config extraction, and exports updated types/helpers. |
| src/start-proxy.test.ts | Updates/expands credential parsing tests including OIDC configurations. |
| src/start-proxy-action.ts | Uses exported credential pretty-printing for logging loaded registries. |
| src/upload-lib.ts | Simplifies combine-SARIF deprecation warning logic/signature and updates call sites. |
| src/upload-lib.test.ts | Updates tests for the updated combine-SARIF deprecation warning signature/behavior. |
| src/overlay/status.ts | Uses JSON helpers for validating overlay status file shape. |
| src/overlay/index.ts | Adds per-language minimum CLI version constants for overlay analysis gating. |
| src/feature-flags.ts | Updates overlay feature-flag set and adds tools-feature gating for skipping PR file coverage. |
| src/tools-features.ts | Adds a tools-feature flag related to suppressing missing baseline warnings. |
| src/config-utils.ts | Makes overlay per-language flag maps partial and adds isRiskAssessmentEnabled. |
| src/config-utils.test.ts | Adds test ensuring languages without per-language overlay flags can’t enable overlay. |
| src/feature-flags/properties.ts | Enhances repository property parsing/typing, supports non-string value types for unknown properties, and warns on unrecognized CodeQL-prefixed properties. |
| src/feature-flags/properties.test.ts | Updates/adds tests for new repository property parsing and warning behavior. |
| src/environment.ts | Adds env vars for file-coverage PR opt-out and “warning already logged” tracking. |
| src/init.ts | Implements file-coverage-on-PRs enablement logic with repository-property/env-var opt-outs and adds deprecation-warning logger. |
| src/init.test.ts | Updates tests for new file-coverage enablement return type and warning behavior. |
| src/init-action.ts | Wires file-coverage enablement results into config init, telemetry, and warning logging; simplifies repository-properties loading call chain. |
| src/init-action-post.ts | Renames post-init helper entrypoint to uploadFailureInfo. |
| src/init-action-post-helper.ts | Refactors failed-SARIF generation/upload; adds artifact upload path for risk assessment runs. |
| src/init-action-post-helper.test.ts | Adds/updates tests for risk-assessment artifact uploads and refactored post-init behavior. |
| src/fingerprints.ts | Uses JSON helper for robust object validation in SARIF artifact handling. |
| src/debug-artifacts.ts | Uses JSON helper for matrix parsing when constructing artifact suffixes. |
| src/api-client.ts | Extracts retry “do-not-retry” statuses into a shared exported constant. |
| src/api-client.test.ts | Updates tests to assert shared retry status constant is used. |
| src/database-upload.ts | Implements manual retry loop for database upload to avoid retrying consumed ReadStreams; factors out upload helper. |
| src/database-upload.test.ts | Expands tests to cover retryable vs non-retryable failure paths and verifies backoff behavior. |
| src/actions-util.ts | Replaces runtime package.json read with build-time injected __CODEQL_ACTION_VERSION__. |
| build.mjs | Injects __CODEQL_ACTION_VERSION__ into the bundle via esbuild define. |
| ava.config.mjs | Moves AVA config out of package.json and ensures setup is required. |
| ava.setup.mjs | Sets __CODEQL_ACTION_VERSION__ for tests before imports use it. |
| eslint.config.mjs | Adjusts ignored files and adds a dedicated TypeScript-eslint config for pr-checks scripts. |
| pr-checks/tsconfig.json | Adds a TS config for pr-checks to support project-aware linting. |
| pr-checks/sync-back.ts | Minor refactors/formatting and regex simplifications. |
| pr-checks/sync-back.test.ts | Updates test import path/name and restructures test definitions. |
| .github/workflows/pr-checks.yml | Moves pr-checks verification/tests into a separate Node 24 job; keeps unit tests on Node 20/24 matrix. |
| .github/workflows/rebuild.yml | Adds Node 24 setup/caching and tweaks merge/commit flow; updates sync-back script name. |
| pr-checks/checks/*.yml | Normalizes YAML formatting and adjusts some per-check setup behavior. |
| CHANGELOG.md | Adds v3.33.0 release notes (file coverage PR deprecation, repo properties fixes/behavior, OIDC registries, DB upload retry fix, etc.). |
| package.json | Bumps version to 3.33.0, adds workspaces, updates devDependencies, and moves AVA config to ava.config.mjs. |
| lib/* (generated) | Compiled output updates (not reviewed; expected to mirror src changes). |
| .github/workflows/__*.yml (generated) | Generated workflow updates (not reviewed; expected output of pr-checks sync). |
- pr-checks/package-lock.json: Language not supported
Sorry, something went wrong.
Comment thread
src/start-proxy.ts
Comment on lines
+455
to
+457
| (isToken(authConfig) && | ||
| isDefined(authConfig.token) && | ||
| isPAT(authConfig.token)) |
Copy link
Copy Markdown
Member
There was a problem hiding this comment.
Copilot shouldn't be reviewing changes in a release PR, but this might be an actual oversight that didn't get caught in the relevant feature PR.
I don't think it should block us from wrapping up this release, especially since v4 is already out with this change.
We can fix it if needed afterwards and release a new version / include it in the release at the end of the current CLI release cycle.
Sorry, something went wrong.
Comment thread
build.mjs
Comment thread
ava.setup.mjs
Comment thread
src/init.ts
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Merging b1bff81 into releases/v3.
Conductor for this PR is @mbg.
Contains the following pull requests:
Please do the following: