Merge releases/v4 into releases/v3 - #3929
Merged
oscarsj merged 79 commits intoMay 22, 2026
Merged
Conversation
Copy link
Copy Markdown
Contributor
Sorry, something went wrong.
This feature has been supported since CodeQL CLI v2.18.0, which is below the new minimum version.
This feature has been supported since CodeQL CLI v2.19.0
Bumps [sinon](https://github.com/sinonjs/sinon) from 21.1.2 to 22.0.0. - [Release notes](https://github.com/sinonjs/sinon/releases) - [Changelog](https://github.com/sinonjs/sinon/blob/main/docs/changelog.md) - [Commits](sinonjs/sinon@v21.1.2...v22.0.0) --- updated-dependencies: - dependency-name: sinon dependency-version: 22.0.0 dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
These jobs are not rate-limiting so we don't need to run them on larger runners.
The tests still can't run in parallel so I had to change `test` to `test.serial`, which caused a bunch of formatting changes.
Mergeback v4.35.5 refs/heads/releases/v4 into main
Address review comments for #3899
PR checks: Run slowest macOS checks on larger runners
Bump `brace-expansion`
To avoid requiring additional dependencies
Specify concurrency groups for non-generated workflows so we can cancel in-progress runs when new commits are pushed to a PR.
CI: Automatically cancel non-generated workflows
Action size: Add a PR check that comments on significant repo size changes
Update default bundle to 2.25.5
Merge main into releases/v4
This reverts commit b2dd803.
This reverts commit 4b79f1b.
oscarsj
marked this pull request as ready for review
May 22, 2026 11:16
oscarsj
enabled auto-merge
May 22, 2026 11:17
Copy link
Copy Markdown
Contributor
Author
Repository checkout size
Sizes are measured by streaming git archive --format=tar.gz <ref>, which includes tracked files and excludes untracked files such as node_modules. The compressed checkout is downloaded by every consumer of this Action, so changes here directly affect Action download time. See the workflow run for details. |
Sorry, something went wrong.
oscarsj
approved these changes
May 22, 2026
Copy link
Copy Markdown
Contributor
There was a problem hiding this comment.
Pull request overview
This PR merges the releases/v4 line of development into releases/v3 to cut the v3.36.0 release, including the associated version bumps, changelog entries, CodeQL CLI/bundle updates, PR-checks automation updates, and related tests.
Changes:
- Bump the minimum supported CodeQL CLI to 2.19.4 and update the default bundle to 2.25.5, removing now-unneeded feature-gating around overwrite and SARIF run properties.
- Add support for SHA-256 Git object IDs in Git-related utilities (plus unit tests).
- Improve PR checks automation (runner sizing, concurrency, token handling), and add a new “repo size diff” check that can post/update a sticky PR comment.
| File | Description |
|---|---|
| src/util.test.ts | Simplifies stubbing of getGitHubVersion in tests (cleanup handled by setupTests). |
| src/upload-lib-stub.js.tpl | New stub template to re-export upload-lib via the shared entry-points bundle. |
| src/tools-features.ts | Removes tools feature flags that are now assumed always-on with the new minimum CLI. |
| src/tools-features.test.ts | Adjusts supported-tools-feature test to use an existing feature flag. |
| src/testing-utils.ts | Adds setupBaseActionsVars and a shared override type for Actions env var setup in tests. |
| src/overlay/index.test.ts | Refactors stubbing (relies on setupTests for restore). |
| src/overlay/caching.test.ts | Refactors stubbing (relies on setupTests for restore). |
| src/git-utils.ts | Supports SHA-256 OIDs in merge-parent parsing and git ls-files --stage parsing. |
| src/git-utils.test.ts | Adds SHA-256 coverage and simplifies stub teardown. |
| src/feature-flags.ts | Clarifies why an older version constant is retained. |
| src/diff-informed-analysis-utils.test.ts | Simplifies stub teardown (relies on setupTests). |
| src/defaults.json | Updates default bundle/CLI versions to 2.25.5. |
| src/codeql.ts | Bumps minimum CLI to 2.19.4 and simplifies overwrite/SARIF run-property handling. |
| src/codeql.test.ts | Updates overwrite-flag test to --force-overwrite. |
| src/analyze-action.test.ts | Consolidates analyze action RAM/threads precedence tests into one file. |
| src/analyze-action-input.test.ts | Removes superseded dedicated-process test file. |
| src/analyze-action-env.test.ts | Removes superseded dedicated-process test file. |
| src/analyses.ts | Logs an error when non-default analysis-kinds are used in custom workflows. |
| src/analyses.test.ts | Adds coverage for new analysis-kinds logging behavior and uses base Actions env setup. |
| README.md | Removes duplicate GHES table rows. |
| queries/default-setup-environment-variables.ql | Restricts env-var read findings to src/ (excluding tests). |
| pr-checks/sync.ts | Extends OS matrix config to support explicit runner image labels; updates tested CLI versions list. |
| pr-checks/sync-checks.ts | Switches token handling to env vars or stdin (--token-stdin) for safer usage. |
| pr-checks/sync-checks.test.ts | Adds unit tests for the new token resolution logic. |
| pr-checks/excluded.yml | Updates excluded required-check patterns/names (incl. repo-size comment jobs). |
| pr-checks/config.ts | Introduces REPO_ROOT constant and uses it for stable path construction. |
| pr-checks/checks/swift-autobuild.yml | Moves macOS Swift autobuild checks to xlarge runner. |
| pr-checks/checks/rust.yml | Updates tested Rust CLI version to stable-v2.19.4. |
| pr-checks/checks/multi-language-autodetect.yml | Moves macOS checks to xlarge runner. |
| pr-checks/check-repo-size.ts | Adds script to measure git-archive size deltas and emit candidate sticky-comment artifacts. |
| pr-checks/check-repo-size.test.ts | Adds tests for repo-size script formatting, arg parsing, and archive-size measurement. |
| package.json | Bumps action version to 3.36.0; updates test deps (ava downgrade, sinon bump); adds update-pr-checks script. |
| package-lock.json | Updates lockfile for dependency changes (but version metadata needs correction). |
| lib/entry-points.js | Generated output reflecting TS changes (not reviewed). |
| lib/defaults.json | Generated output reflecting TS changes (not reviewed). |
| CONTRIBUTING.md | Updates sync-checks usage instructions to stdin/env-token approach. |
| CHANGELOG.md | Adds 3.36.0 release notes and date. |
| build.mjs | Reworks bundling to expose upload-lib via entry-points and emit an upload-lib.js stub; updates entrypoint stub generation. |
| .github/workflows/update-release-branch.yml | Passes token via environment (aligning with updated script expectations). |
| .github/workflows/test-codeql-bundle-all.yml | Adds concurrency settings. |
| .github/workflows/query-filters.yml | Adds concurrency settings. |
| .github/workflows/python312-windows.yml | Adds concurrency settings. |
| .github/workflows/pr-checks.yml | Adds workflow/job concurrency, runner adjustments, repo-size measurement + comment posting, and refactors “other checks”. |
| .github/workflows/post-release-mergeback.yml | Ensures Node 24 setup w/ npm cache. |
| .github/workflows/debug-artifacts-safe.yml | Adds concurrency settings. |
| .github/workflows/debug-artifacts-failure-safe.yml | Adds concurrency settings. |
| .github/workflows/codescanning-config-cli.yml | Adds concurrency settings. |
| .github/workflows/codeql.yml | Switches macOS jobs to xlarge runners. |
| .github/workflows/check-expected-release-files.yml | Adds concurrency settings. |
| .github/workflows/__swift-autobuild.yml | Generated workflow updated for runner image change (not reviewed). |
| .github/workflows/__rust.yml | Generated workflow updated for version change (not reviewed). |
| .github/workflows/__multi-language-autodetect.yml | Generated workflow updated for runner sizing + version matrix changes (not reviewed). |
| .github/workflows/__go-tracing-legacy-workflow.yml | Generated workflow updated for version matrix changes (not reviewed). |
| .github/workflows/__go-tracing-custom-build-steps.yml | Generated workflow updated for version matrix changes (not reviewed). |
| .github/workflows/__go-tracing-autobuilder.yml | Generated workflow updated for version matrix changes (not reviewed). |
| .github/update-release-branch.py | Switches to env-based token, automates rebuild commits, and adjusts PR-body instructions. |
| .github/actions/release-initialise/action.yml | Bumps Node version to 24 for release initialisation. |
| .github/actions/prepare-mergeback-branch/action.yml | Automates rebuilding and committing lib/ changes during mergeback branch preparation. |
Copilot's findings
- Files reviewed: 49/59 changed files
- Comments generated: 0
Sorry, something went wrong.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Merging 7211b7c into releases/v3.
Conductor for this PR is @oscarsj.
Contains the following pull requests:
Please do the following: