Merge releases/v4 into releases/v3 by github-actions[bot] · Pull Request #3778 · github/codeql-action · GitHub

Merging b8bb9f2 into releases/v3.

Conductor for this PR is @oscarsj.

Contains the following pull requests:

Please do the following:

Ensure the CHANGELOG displays the correct version and date.
Ensure the CHANGELOG includes all relevant, user-facing changes since the last release.
Check that there are not any unexpected commits being merged into the releases/v3 branch.
Ensure the docs team is aware of any documentation changes that need to be released.
Remove and re-add the "Rebuild" label to the PR to trigger just this workflow.
Wait for the "Rebuild" workflow to push a commit updating the distribution files.
Mark the PR as ready for review to trigger the full set of PR checks.
Approve and merge this PR. Make sure Create a merge commit is selected rather than Squash and merge or Rebase and merge.

Bumps [fast-xml-parser](https://github.com/NaturalIntelligence/fast-xml-parser) from 5.5.6 to 5.5.7. - [Release notes](https://github.com/NaturalIntelligence/fast-xml-parser/releases) - [Changelog](https://github.com/NaturalIntelligence/fast-xml-parser/blob/master/CHANGELOG.md) - [Commits](NaturalIntelligence/fast-xml-parser@v5.5.6...v5.5.7) --- updated-dependencies: - dependency-name: fast-xml-parser dependency-version: 5.5.7 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>

Mergeback v4.34.1 refs/heads/releases/v4 into main

…-parser-5.5.7 Bump fast-xml-parser from 5.5.6 to 5.5.7

…um-git-version Reduce the minimum Git version required for overlay

…-check-fixes

Fix warning for PAT-like token with username

…ction

…r-3536e7c6f0 Bump the npm-minor group with 5 updates

Bumps [yaml](https://github.com/eemeli/yaml) from 2.8.2 to 2.8.3. - [Release notes](https://github.com/eemeli/yaml/releases) - [Commits](eemeli/yaml@v2.8.2...v2.8.3) --- updated-dependencies: - dependency-name: yaml dependency-version: 2.8.3 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>

Bump yaml from 2.8.2 to 2.8.3

Update default bundle to 2.25.1

Merge main into releases/v4

This reverts commit 95a5620.

This reverts commit 97fd992.

….0-b8bb9f28b

Pushed a commit to rebuild the Action. Please mark the PR as ready for review to trigger PR checks.

Pull request overview

This PR merges changes from releases/v4 into releases/v3, bringing over improvements to diff-informed analysis/overlay behavior, release tooling/scripts, and several dependency/version updates needed for the v3 release line.

Changes:

Persist PR diff ranges during init and reuse them in analyze and overlay change-file computation.
Lower the minimum Git version required for overlay analysis by switching git ls-files OID collection to --stage.
Replace/augment release & required-checks tooling with TypeScript scripts under pr-checks/, plus related config/docs/workflow updates.

Reviewed changes

Copilot reviewed 39 out of 47 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
src/testing-utils.ts	Enhances test logger utilities (message matching, negative assertions) and refactors getRecordingLogger.
src/start-proxy.ts	Fixes PAT-with-username warning logic by restructuring the condition.
src/start-proxy.test.ts	Expands credentials warning coverage and introduces a shared AVA macro pattern.
src/overlay/index.ts	Merges diff-range file paths into overlay changed-file list; adds diff-range JSON reading/conversion logic.
src/overlay/index.test.ts	Adds tests for overlay changes merging and source-root-relative conversion behavior.
src/init-action.ts	Computes and persists PR diff ranges during init for later reuse.
src/git-utils.ts	Lowers overlay Git minimum to 2.11.0 and updates OID collection to parse git ls-files --stage.
src/git-utils.test.ts	Updates tests for new git ls-files --stage output parsing.
src/diff-informed-analysis-utils.ts	Centralizes diff-range JSON path and hardens JSON parsing with error handling.
src/defaults.json	Bumps default bundle/CLI versions to 2.25.1 (and shifts prior versions accordingly).
src/config-utils.test.ts	Updates overlay fallback test to reflect the new minimum Git version (2.11.0).
src/analyze.ts	Switches diff-informed analysis setup to read precomputed diff ranges rather than recomputing.
src/analyze-action.ts	Updates analyze flow to call the new setupDiffInformedQueryRun(logger) signature.
src/actions-util.ts	Adds a shared helper for locating pr-diff-range.json in the temp directory.
pr-checks/sync-checks.ts	New TS tool to sync required checks using the GitHub API and exclusions config.
pr-checks/sync-checks.test.ts	Unit tests for required-check exclusion filtering logic.
pr-checks/release-branches.ts	New TS tool to compute backport source/targets based on tags and support policy.
pr-checks/release-branches.test.ts	Unit tests for backport-branch computation and input validation.
pr-checks/package.json	Adds dependencies needed for the new pr-checks scripts and bumps yaml.
pr-checks/excluded.yml	New config file defining which checks should be excluded from “required checks”.
pr-checks/config.ts	Centralizes pr-checks constants (oldest supported major version, exclusions path).
pr-checks/checks/rubocop-multi-language.yml	Updates pinned ruby/setup-ruby SHA/version used by the check.
package.json	Bumps action version to 3.35.0 and updates dev dependency versions.
package-lock.json	Updates lockfile for dependency bumps (but currently has inconsistent version metadata).
eslint.config.mjs	Tightens extraneous-dependency checks for pr-checks and adjusts config structure.
CONTRIBUTING.md	Updates contributor instructions to reference the new TS required-checks tool and config location.
CHANGELOG.md	Adds v3.35.0 entry including Git minimum reduction and default bundle update.
.vscode/tests.code-snippets	Adds a VS Code snippet for an AVA test macro template.
.github/workflows/script/update-required-checks.sh	Removes the legacy shell script now replaced by TS tooling.
.github/releases.ini	Removes legacy support-policy config file (moved to pr-checks config).
.github/actions/release-initialise/action.yml	Ensures Node is set up (with npm cache) for release workflows/actions.
.github/actions/release-branches/release-branches.py	Removes legacy Python backport-branch computation script.
.github/actions/release-branches/action.yml	Switches release-branches action to run the TS implementation via tsx.
.github/workflows/__rubocop-multi-language.yml	Generated workflow update reflecting new ruby/setup-ruby pin (not reviewed).
lib/*	Generated build artifacts updated (not reviewed).

After JSON.parse, diffRanges is assumed to be Array<{path: string}> (uses .length, .map). If the file is malformed but still valid JSON (e.g. an object, or array entries without a string path), this will throw later and can break overlay generation. Add runtime validation (array + string path) and fall back to []/warning on invalid shape.

hasLoggedMessage uses RegExp.test(). If callers pass a global/sticky regex (e.g. /foo/g), test() mutates lastIndex, which can make subsequent checks incorrect/flaky. Consider normalizing by resetting lastIndex to 0 before testing, or by using a non-global copy of the regex.

mbg and others added 30 commits March 16, 2026 19:34

Add snippet to scaffold test.macros

193dd19

Refactor PAT test into a test.macro

6e67ef6

Add params for credentials and checkAccepted to testPATWarning

f86097d

Add "token without a username" test

0393130

Add assertNotLogged test helper

740f177

Replace getRecordingLogger implementation with RecordingLogger

ddafddb

Add hasMessage to RecordingLogger

de06821

Add tests for the absence of the warning

28f515d

Fix warning for PAT-like token with username

f88d49e

Rebuild

64507ed

Update changelog and version after v4.34.1

8fd6c0e

Rebuild

8dc2e5d

Merge pull request #3764 from github/mergeback/v4.34.1-to-main-38697555

05b1a5d

Mergeback v4.34.1 refs/heads/releases/v4 into main

Merge pull request #3587 from github/dependabot/npm_and_yarn/fast-xml…

72c0b0e

…-parser-5.5.7 Bump fast-xml-parser from 5.5.6 to 5.5.7

Use --stage instead of --format in git ls-files

d48d054

Update minimum Git version required for overlay

28f56f2

Add changelog note

8c023a6

Merge pull request #3767 from github/henrymercer/overlay-reduce-minim…

eedab83

…um-git-version Reduce the minimum Git version required for overlay

Fix test names

d128e5d

Merge remote-tracking branch 'origin/main' into mbg/start-proxy/token…

137e0de

…-check-fixes

Merge pull request #3579 from github/mbg/start-proxy/token-check-fixes

3d564d9

Fix warning for PAT-like token with username

Convert release-branches.py to TypeScript

054745b

Install node in release-initialise action

aa27731

Replace release-branches.py with TS version in release-branches a…

3db9a05

…ction

Refactor backport computation into computeReleaseBranches

0d87a75

Validate inputs

b72f4fe

Add tests for release-branches.ts

49af37b

Add config file for excluded checks from update-required-checks.sh

4867f59

Add initial TS implementation of update-required-checks.sh

9813849

mbg and others added 12 commits March 26, 2026 17:46

Merge pull request #3768 from github/dependabot/npm_and_yarn/npm-mino…

5cc552f

…r-3536e7c6f0 Bump the npm-minor group with 5 updates

Merge pull request #3772 from github/dependabot/npm_and_yarn/yaml-2.8.3

f94817b

Bump yaml from 2.8.2 to 2.8.3

Update default bundle to codeql-bundle-v2.25.1

8c29faa

Add changelog note

fa7a15b

Merge pull request #3773 from github/update-bundle/codeql-bundle-v2.25.1

0078ad6

Update default bundle to 2.25.1

Update changelog for v4.35.0

e9cf68b

Merge pull request #3776 from github/update-v4.35.0-0078ad667

b8bb9f2

Merge main into releases/v4

Revert "Update version and changelog for v3.34.1"

dba1849

This reverts commit 95a5620.

Revert "Rebuild"

57d591c

This reverts commit 97fd992.

Merge remote-tracking branch 'origin/releases/v4' into backport-v3.35…

a88fb3c

….0-b8bb9f28b

Update version and changelog for v3.35.0

124f6ee

github-actions Bot added the Rebuild Re-transpile JS & re-generate workflows label Mar 27, 2026

github-actions Bot assigned oscarsj Mar 27, 2026

oscarsj added Rebuild Re-transpile JS & re-generate workflows and removed Rebuild Re-transpile JS & re-generate workflows labels Mar 27, 2026

oscarsj previously approved these changes Mar 27, 2026

View reviewed changes

github-actions Bot added size/XXL May be extremely hard to review and removed Rebuild Re-transpile JS & re-generate workflows labels Mar 27, 2026

Rebuild

b1a5f00

github-actions Bot dismissed oscarsj’s stale review via b1a5f00 March 27, 2026 12:23

oscarsj marked this pull request as ready for review March 27, 2026 12:25

oscarsj requested a review from a team as a code owner March 27, 2026 12:25

Copilot AI review requested due to automatic review settings March 27, 2026 12:25

Copilot started reviewing on behalf of oscarsj March 27, 2026 12:26 View session

Copilot AI reviewed Mar 27, 2026

View reviewed changes

henrymercer approved these changes Mar 27, 2026

View reviewed changes

oscarsj merged commit 13efb23 into releases/v3 Mar 27, 2026
222 checks passed

oscarsj deleted the backport-v3.35.0-b8bb9f28b branch March 27, 2026 16:00

+                let diffRanges: Array<{ path: string }>;
+                try {
+                  diffRanges = JSON.parse(contents) as Array<{ path: string }>;
+                } catch (e) {
+                  logger.warning(
+                    `Failed to parse diff ranges JSON file at ${jsonFilePath}: ${e}`,
+                  );

+                const check = (val: string) =>
+                  typeof messageOrRegExp === "string"
+                    ? val.includes(messageOrRegExp)
+                    : messageOrRegExp.test(val);

Merge releases/v4 into releases/v3 by github-actions[bot] · Pull Request #3778 · github/codeql-action · GitHub

Uh oh!

Merge releases/v4 into releases/v3 - #3778

Merge releases/v4 into releases/v3#3778
oscarsj merged 75 commits into
releases/v3from
backport-v3.35.0-b8bb9f28b

github-actions Bot commented Mar 27, 2026 •
edited by oscarsj
Loading

Uh oh!

Uh oh!

github-actions Bot commented Mar 27, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Mar 27, 2026

Uh oh!

Copilot AI Mar 27, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Merge releases/v4 into releases/v3 by github-actions[bot] · Pull Request #3778 · github/codeql-action · GitHub

Uh oh!

Merge releases/v4 into releases/v3 - #3778

Merge releases/v4 into releases/v3#3778oscarsj merged 75 commits intoreleases/v3github/codeql-action:releases/v3from backport-v3.35.0-b8bb9f28bgithub/codeql-action:backport-v3.35.0-b8bb9f28bCopy head branch name to clipboard

Conversation

github-actions Bot commented Mar 27, 2026 • edited by oscarsj Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Mar 27, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Mar 27, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 27, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Merge releases/v4 into releases/v3#3778
oscarsj merged 75 commits into
releases/v3from
backport-v3.35.0-b8bb9f28b

github-actions Bot commented Mar 27, 2026 •
edited by oscarsj
Loading