Merge releases/v4 into releases/v3 by github-actions[bot] · Pull Request #3826 · github/codeql-action · GitHub

Merging 95e58e9 into releases/v3.

Conductor for this PR is @henrymercer.

Contains the following pull requests:

Please do the following:

Ensure the CHANGELOG displays the correct version and date.
Ensure the CHANGELOG includes all relevant, user-facing changes since the last release.
Check that there are not any unexpected commits being merged into the releases/v3 branch.
Ensure the docs team is aware of any documentation changes that need to be released.
Remove and re-add the "Rebuild" label to the PR to trigger just this workflow.
Wait for the "Rebuild" workflow to push a commit updating the distribution files.
Mark the PR as ready for review to trigger the full set of PR checks.
Approve and merge this PR. Make sure Create a merge commit is selected rather than Squash and merge or Rebase and merge.

Bumps [brace-expansion](https://github.com/juliangruber/brace-expansion) from 1.1.12 to 1.1.13. - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v1.1.12...v1.1.13) --- updated-dependencies: - dependency-name: brace-expansion dependency-version: 1.1.13 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>

We originally moved these to `ubuntu-slim`, but there is a significant performance difference. Since we often find ourselves waiting on these jobs, let's use the faster runners.

…pansion-1.1.13 Bump brace-expansion from 1.1.12 to 1.1.13

…ency Remove unused `@schemastore/package` dependency

Mergeback v4.35.1 refs/heads/releases/v4 into main

Move time-sensitive Actions workflows to `ubuntu-latest`

For the sake of consistency with the other pre-existing validation code.

…-no-submodules Overlay: Only require Git 2.36.0 for repos that contain submodules

The registry/language mapping table does not map the one with hyphens.

Generate and analyse esbuild bundle metadata

…r-345b938e93 Bump the npm-minor group across 1 directory with 6 updates

…thub/workflows/actions-minor-cc17fecf2b Bump the actions-minor group across 1 directory with 2 updates

Update default bundle to 2.25.2

Merge main into releases/v4

This reverts commit c983cb8.

This reverts commit 646729a.

….2-95e58e9a2

Pushed a commit to rebuild the Action. Please mark the PR as ready for review to trigger PR checks.

Pull request overview

Mergeback from releases/v4 into releases/v3, bringing in release tooling updates, dependency bumps, and multiple behavior changes (proxy, overlay caching refactor, Swift handling, etc.).

Changes:

Upgrade TypeScript/tooling and adjust build pipeline to emit and report esbuild bundle metadata.
Refactor overlay database caching into dedicated modules and update imports/tests accordingly.
Update start-proxy language alias handling and OIDC credential property names; add/adjust PR checks and workflows.

Show a summary per file

File	Description
tsconfig.json	TS compiler config updates for TS6 (moduleResolution/types/skipLibCheck/paths).
src/trap-caching.ts	Emit deprecation warning for TRAP cache cleanup.
src/tools-features.ts	Remove Python stdlib extraction tools feature flag reference.
src/testing-utils.ts	Update overlay mode import path.
src/status-report.ts	Update overlay caching stats import path.
src/start-proxy/types.ts	Switch OIDC config JSON property names to kebab-case; update validators/formatting.
src/start-proxy/types.test.ts	Update tests for new OIDC property names.
src/start-proxy.ts	Use checked-in language aliases JSON; update language parsing and OIDC config shaping.
src/start-proxy.test.ts	Add multi-registry tests; update OIDC property name fixtures.
src/overlay/overlay-database-mode.ts	New enum module for overlay database mode.
src/overlay/index.ts	Remove caching logic; retain overlay OID/changes-file logic.
src/overlay/index.test.ts	Remove caching tests from overlay index suite.
src/overlay/caching.ts	New module containing overlay-base DB cache upload/download/key logic.
src/overlay/caching.test.ts	New test suite for overlay cache behavior and key stability.
src/known-language-aliases.json	Add checked-in snapshot of language aliases.
src/init-action.ts	Update overlay imports; treat Swift on non-macOS as configuration error; remove Python stdlib override logic.
src/init-action-post-helper.ts	Update overlay mode import path.
src/init-action-post-helper.test.ts	Update overlay mode import path in tests.
src/git-utils.ts	Add submodule detection; only use --recurse-submodules when needed; rename min Git version constant.
src/git-utils.test.ts	Add coverage for submodule/no-submodule argument selection and updated stubbing.
src/feature-flags.ts	Remove Python stdlib extraction feature flag wiring.
src/defaults.json	Bump default CLI/bundle version to 2.25.2 (and prior versions accordingly).
src/database-upload.ts	Update overlay mode import path.
src/config-utils.ts	Only enforce Git ≥ 2.36.0 when repo has submodules; update overlay mode import.
src/config-utils.test.ts	Update overlay enablement tests for submodule-aware Git version checks.
src/codeql.ts	Update overlay mode import path.
src/cli-errors.ts	Add Swift incompatible-OS classification.
src/cli-errors.test.ts	Add test for Swift incompatible-OS classification.
src/analyze.ts	Update overlay mode import path.
src/analyze-action.ts	Import overlay cache upload from new module.
pr-checks/tsconfig.json	TS6-related config tweak (module: preserve).
pr-checks/sync-checks.ts	Extract API client construction into reusable module.
pr-checks/config.ts	Add path constant for esbuild metadata file.
pr-checks/checks/start-proxy.yml	Extend start-proxy PR check to validate multiple registries.
pr-checks/checks/rubocop-multi-language.yml	Update ruby/setup-ruby pin.
pr-checks/checks/language-aliases.yml	Remove Swift from language-aliases PR check expectations.
pr-checks/bundle-metadata.ts	New script to print esbuild bundle sizes from metafile.
pr-checks/api-client.ts	New shared Octokit client helper for PR checks scripts.
package.json	Bump action version; run bundle-metadata script as part of build; dependency/devDependency bumps.
package-lock.json	Lockfile updates for bumped dependencies/tooling and version fields.
build.mjs	Enable esbuild metafile output and write meta.json.
CHANGELOG.md	Add 3.35.2 release notes and date.
.gitignore	Ignore generated meta.json.
.github/workflows/update-release-branch.yml	Switch runner to ubuntu-latest; bump create-github-app-token.
.github/workflows/update-bundle.yml	Switch runner to ubuntu-latest; add step to update checked-in language aliases.
.github/workflows/rollback-release.yml	Bump create-github-app-token.
.github/workflows/prepare-release.yml	Switch runner to ubuntu-latest.
.github/workflows/post-release-mergeback.yml	Switch runner to ubuntu-latest; bump create-github-app-token.
.github/workflows/debug-artifacts-failure-safe.yml	Explicitly set languages list for init step.
.github/workflows/__start-proxy.yml	Generated workflow update mirroring start-proxy check changes.
.github/workflows/__rubocop-multi-language.yml	Generated workflow update mirroring rubocop check changes.
.github/workflows/__language-aliases.yml	Generated workflow update mirroring language-aliases check changes.
.github/dependabot.yml	Expand Dependabot config to cover additional directories.
lib/upload-sarif-action-post.js	Generated bundle output update (do not review source-of-truth).
lib/start-proxy-action-post.js	Generated bundle output update (do not review source-of-truth).
lib/defaults.json	Generated output update for defaults.json.

Copilot's findings

Files reviewed: 47/66 changed files
Comments generated: 1

npm run build now executes npx tsx ..., but tsx is not listed in devDependencies. This makes builds depend on network availability and may pull different tsx versions over time. Add tsx as a pinned dev dependency (or vendor the script into an existing toolchain) to make builds reproducible.

henrymercer and others added 30 commits March 27, 2026 13:57

Remove unused @schemastore/package dependency

7dcea06

Rebuild

999119b

Update changelog and version after v4.35.1

6010f9d

Rebuild

cc7db4a

Move time-sensitive Actions workflows to ubuntu-latest

353802f

We originally moved these to `ubuntu-slim`, but there is a significant performance difference. Since we often find ourselves waiting on these jobs, let's use the faster runners.

Merge pull request #3780 from github/dependabot/npm_and_yarn/brace-ex…

fe775da

…pansion-1.1.13 Bump brace-expansion from 1.1.12 to 1.1.13

Merge pull request #3779 from github/henrymercer/remove-unused-depend…

aa69c48

…ency Remove unused `@schemastore/package` dependency

Merge pull request #3783 from github/mergeback/v4.35.1-to-main-c10b8064

191d7c6

Mergeback v4.35.1 refs/heads/releases/v4 into main

Generate esbuild metadata file

4ed3c0e

Merge pull request #3786 from github/henrymercer/faster-interactive-jobs

a899987

Move time-sensitive Actions workflows to `ubuntu-latest`

Move getApiClient out of sync-checks.ts

b1981a5

Add basic metadata analysis script

47f1709

Only require Git 2.36.0 when repo contains submodules

6643a7d

Don't disable if we don't need the git version

88a7e51

Add changelog note

0592832

Output largest inputs

4e0952a

Fix outputs type

3db32b5

Output relative to __dirname

f98bf5e

Save a computation of the git root

be0a156

Test fallback when repo has no submodules

a507a54

Extend start-proxy.yml to test multiple registry support

0c7c298

Replace jq with Actions expression for proxy_urls validation

9fd9b64

For the sake of consistency with the other pre-existing validation code.

Merge pull request #3789 from github/henrymercer/lower-minimum-git-if…

c618c9b

…-no-submodules Overlay: Only require Git 2.36.0 for repos that contain submodules

Run pr-checks/sync.sh to generate __start-proxy.yml.

99b8dd4

Use maven_repository, not maven-repository

8b5e604

The registry/language mapping table does not map the one with hyphens.

Use different maven URL for start-proxy.yml test

faf45e0

Keep validation steps named consistently

7b0c5b1

Delete fromJSON() calls in test validation step

e2203c6

Merge pull request #3787 from github/mbg/bundle/metadata

2e3aaae

Generate and analyse esbuild bundle metadata

github-actions Bot and others added 13 commits April 13, 2026 17:30

Rebuild

1024fc4

Rebuild

f1c3393

Merge pull request #3821 from github/dependabot/npm_and_yarn/npm-mino…

3c45af2

…r-345b938e93 Bump the npm-minor group across 1 directory with 6 updates

Merge pull request #3820 from github/dependabot/github_actions/dot-gi…

6521697

…thub/workflows/actions-minor-cc17fecf2b Bump the actions-minor group across 1 directory with 2 updates

Update default bundle to codeql-bundle-v2.25.2

5a0a562

Add changelog note

60abb65

Merge pull request #3823 from github/update-bundle/codeql-bundle-v2.25.2

d2e135a

Update default bundle to 2.25.2

Update changelog for v4.35.2

6f31bfe

Merge pull request #3824 from github/update-v4.35.2-d2e135a73

95e58e9

Merge main into releases/v4

Revert "Update version and changelog for v3.35.1"

7ca2158

This reverts commit c983cb8.

Revert "Rebuild"

047c547

This reverts commit 646729a.

Merge remote-tracking branch 'origin/releases/v4' into backport-v3.35…

834786a

….2-95e58e9a2

Update version and changelog for v3.35.2

8bcc8f2

github-actions Bot added the Rebuild Re-transpile JS & re-generate workflows label Apr 15, 2026

github-actions Bot assigned henrymercer Apr 15, 2026

henrymercer added Rebuild Re-transpile JS & re-generate workflows and removed Rebuild Re-transpile JS & re-generate workflows labels Apr 15, 2026

github-actions Bot removed the Rebuild Re-transpile JS & re-generate workflows label Apr 15, 2026

Rebuild

c186c7b

henrymercer marked this pull request as ready for review April 15, 2026 11:31

henrymercer requested a review from a team as a code owner April 15, 2026 11:31

Copilot AI review requested due to automatic review settings April 15, 2026 11:31

henrymercer approved these changes Apr 15, 2026

View reviewed changes

github-actions Bot added the size/XXL May be extremely hard to review label Apr 15, 2026

henrymercer enabled auto-merge April 15, 2026 11:31

Copilot started reviewing on behalf of henrymercer April 15, 2026 11:31 View session

Copilot AI reviewed Apr 15, 2026

View reviewed changes

henrymercer merged commit ce64ddc into releases/v3 Apr 15, 2026
222 checks passed

henrymercer deleted the backport-v3.35.2-95e58e9a2 branch April 15, 2026 11:51

                   "_build_comment": "echo 'Run the full build so we typecheck the project and can reuse the transpiled files in npm test'",
-                  "build": "./scripts/check-node-modules.sh && npm run transpile && node build.mjs",
+                  "build": "./scripts/check-node-modules.sh && npm run transpile && node build.mjs && npx tsx ./pr-checks/bundle-metadata.ts",
                   "lint": "eslint --report-unused-disable-directives --max-warnings=0 .",

Merge releases/v4 into releases/v3 by github-actions[bot] · Pull Request #3826 · github/codeql-action · GitHub

Uh oh!

Merge releases/v4 into releases/v3 - #3826

Merge releases/v4 into releases/v3#3826
henrymercer merged 82 commits into
releases/v3from
backport-v3.35.2-95e58e9a2

github-actions Bot commented Apr 15, 2026

Uh oh!

github-actions Bot commented Apr 15, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Apr 15, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Merge releases/v4 into releases/v3 by github-actions[bot] · Pull Request #3826 · github/codeql-action · GitHub

Uh oh!

Merge releases/v4 into releases/v3 - #3826

Merge releases/v4 into releases/v3#3826henrymercer merged 82 commits intoreleases/v3github/codeql-action:releases/v3from backport-v3.35.2-95e58e9a2github/codeql-action:backport-v3.35.2-95e58e9a2Copy head branch name to clipboard

Conversation

github-actions Bot commented Apr 15, 2026

Uh oh!

github-actions Bot commented Apr 15, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Copilot's findings

Uh oh!

Copilot AI Apr 15, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Merge releases/v4 into releases/v3#3826
henrymercer merged 82 commits into
releases/v3from
backport-v3.35.2-95e58e9a2