GeezerVison

The World Wide Web, restored to 800 pixels of glory.

GeezerVison is showing github.com — Merge releases/v4 into releases/v3 by github-actions[bot] · Pull Request #3577 · github/codeql-action

Conversation

github-actions Bot commented Mar 16, 2026 •

edited by mbg

Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link

Copy Markdown

Contributor

Merging b1bff81 into releases/v3.

Conductor for this PR is @mbg.

Contains the following pull requests:

Please do the following:

Ensure the CHANGELOG displays the correct version and date.
Ensure the CHANGELOG includes all relevant, user-facing changes since the last release.
Check that there are not any unexpected commits being merged into the releases/v3 branch.
Ensure the docs team is aware of any documentation changes that need to be released.
Remove and re-add the "Rebuild" label to the PR to trigger just this workflow.
Wait for the "Rebuild" workflow to push a commit updating the distribution files.
Mark the PR as ready for review to trigger the full set of PR checks.
Approve and merge this PR. Make sure Create a merge commit is selected rather than Squash and merge or Rebase and merge.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

mbg and others added 30 commits

February 26, 2026 17:47


          Rename secondary run to uploadFailureInfo

0f3e632


          Change order of checks in tryUploadSarifIfRunFailed

e9ce32d


          Change skipped reason message

56d1ccc


          Refactor prepareFailedSarif out of maybeUploadFailedSarif

60ca40e


          Upload failed SARIF as artifact for risk assessments

44b66a8


          Separate generateFailedSarif out of prepareFailedSarif

f265dd9


          Simplify prepareFailedSarif for risk assessments

5b9d1f4


          Add test

003044e


          Sanitise artifact name

ce97dfe


          Ensure correct failed SARIF file names for CSRA

ca32b84


          Refactor some test setup code into mockRiskAssessmentEnv

383b86d


          Add tests where upload should get skipped

1e7e52a


          Add more tests/assertions

e995ba3


          Fix typos in comments

f3663cd


          Extract JobSpecification type from Specification

5db3a9e


          Organise language-specific setup information

97a3705


          Refactor matrix generation into its own function

369d73b


          Refactor job generation into generateJob

92ab799


          Move yq setup code into getSetupSteps

95fc2f1


          Add support for additional, validation jobs

2b60771


          Merge branch 'main' into mbg/pr-checks/validation-jobs

56ebdff


          Add tsconfig.json for pr-checks

3d47812


          Fix generateValidationJobs typing

79fdef7


          Make it more explicit that getSetupSteps just needs a `JobSpecifica…

103db93

…tion`


          Fix condition

2a00604


          Remove installPython from checks which should no longer need it

0da2e79


          Update changelog and version after v4.32.6

05a4820


          Rebuild

0ccdcb8


          Merge pull request #3552 from github/mergeback/v4.32.6-to-main-0d579ffd

d1a6527

Mergeback v4.32.6 refs/heads/releases/v4 into main


          Update GitHubRepositoryProperty to match schema

8e70ae2

mbg and others added 11 commits

March 13, 2026 11:13


          Merge pull request #3570 from github/mbg/repo-props/warn-on-unexpecte…

4c356c7

…d-props

Emit warning for unrecognised repo properties with our common prefix


          Merge pull request #3563 from github/mbg/private-registry/oidc

e3200e3

Accept OIDC configurations in `start-proxy`


          Merge pull request #3572 from github/mbg/pr-checks/eslint

7dd76e6

Add eslint for `pr-checks`


          Update changelog for v4.32.7

59bcb60


          Bump minor version

95be291


          Add changelog entry for #3570

e682234


          Merge pull request #3574 from github/update-v4.32.7-7dd76e6bf

b1bff81

Merge main into releases/v4


          Revert "Update version and changelog for v3.32.6"

ee6db5e

This reverts commit c0e7770.


          Revert "Rebuild"

e50ab6d

This reverts commit dabb34c.


          Merge remote-tracking branch 'origin/releases/v4' into backport-v3.33…

4ccf9a5

….0-b1bff8193


          Update version and changelog for v3.33.0

2da877a

github-actions Bot added the Rebuild Re-transpile JS & re-generate workflows label

Mar 16, 2026

github-actions Bot assigned mbg

Mar 16, 2026

oscarsj added Rebuild Re-transpile JS & re-generate workflows and removed Rebuild Re-transpile JS & re-generate workflows labels

Mar 16, 2026

github-actions Bot added size/XXL May be extremely hard to review and removed Rebuild Re-transpile JS & re-generate workflows labels

Mar 16, 2026


          Rebuild

9ed0d75

github-actions Bot commented Mar 16, 2026

Copy link

Copy Markdown

Contributor Author

Pushed a commit to rebuild the Action. Please mark the PR as ready for review to trigger PR checks.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

mbg marked this pull request as ready for review

March 16, 2026 11:26

mbg requested a review from a team as a code owner

March 16, 2026 11:26

Copilot AI review requested due to automatic review settings

March 16, 2026 11:26

Copilot started reviewing on behalf of mbg

March 16, 2026 11:27

View session

mbg approved these changes

Mar 16, 2026

View reviewed changes

oscarsj enabled auto-merge

March 16, 2026 11:29

Copilot AI reviewed

Mar 16, 2026

View reviewed changes

Copilot AI left a comment

Copy link

Copy Markdown

Contributor

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR prepares the CodeQL Action v3.33.0 release by adding new configuration/feature plumbing (repository properties, file-coverage PR deprecation messaging), improving robustness (DB upload retries, JSON validation helpers), and extending start-proxy credential support (OIDC-style configs), along with associated test/workflow/pr-checks updates.

Changes:

Add typed JSON parsing/validation helpers and apply them across multiple codepaths (credentials parsing, overlay status parsing, etc.).
Add repository-property support enhancements (including GHES) and introduce file-coverage-on-PRs deprecation messaging + opt-out mechanisms.
Fix database upload retry behavior for streaming bodies and refactor action version sourcing to be injected at build time.

Reviewed changes

Copilot reviewed 135 out of 140 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
src/json/index.ts	Introduces shared helpers for parsing/validating JSON-derived values.
src/util.ts	Uses new JSON helpers for safer HTTP error detection.
src/start-proxy/types.ts	Refactors credential typing, adds OIDC auth config types, and moves credential pretty-printing here.
src/start-proxy/types.test.ts	Adds unit tests for credential pretty-printing and secret masking.
src/start-proxy.ts	Strengthens credentials parsing/validation, adds auth-config extraction, and exports updated types/helpers.
src/start-proxy.test.ts	Updates/expands credential parsing tests including OIDC configurations.
src/start-proxy-action.ts	Uses exported credential pretty-printing for logging loaded registries.
src/upload-lib.ts	Simplifies combine-SARIF deprecation warning logic/signature and updates call sites.
src/upload-lib.test.ts	Updates tests for the updated combine-SARIF deprecation warning signature/behavior.
src/overlay/status.ts	Uses JSON helpers for validating overlay status file shape.
src/overlay/index.ts	Adds per-language minimum CLI version constants for overlay analysis gating.
src/feature-flags.ts	Updates overlay feature-flag set and adds tools-feature gating for skipping PR file coverage.
src/tools-features.ts	Adds a tools-feature flag related to suppressing missing baseline warnings.
src/config-utils.ts	Makes overlay per-language flag maps partial and adds `isRiskAssessmentEnabled`.
src/config-utils.test.ts	Adds test ensuring languages without per-language overlay flags can’t enable overlay.
src/feature-flags/properties.ts	Enhances repository property parsing/typing, supports non-string value types for unknown properties, and warns on unrecognized CodeQL-prefixed properties.
src/feature-flags/properties.test.ts	Updates/adds tests for new repository property parsing and warning behavior.
src/environment.ts	Adds env vars for file-coverage PR opt-out and “warning already logged” tracking.
src/init.ts	Implements file-coverage-on-PRs enablement logic with repository-property/env-var opt-outs and adds deprecation-warning logger.
src/init.test.ts	Updates tests for new file-coverage enablement return type and warning behavior.
src/init-action.ts	Wires file-coverage enablement results into config init, telemetry, and warning logging; simplifies repository-properties loading call chain.
src/init-action-post.ts	Renames post-init helper entrypoint to `uploadFailureInfo`.
src/init-action-post-helper.ts	Refactors failed-SARIF generation/upload; adds artifact upload path for risk assessment runs.
src/init-action-post-helper.test.ts	Adds/updates tests for risk-assessment artifact uploads and refactored post-init behavior.
src/fingerprints.ts	Uses JSON helper for robust object validation in SARIF artifact handling.
src/debug-artifacts.ts	Uses JSON helper for matrix parsing when constructing artifact suffixes.
src/api-client.ts	Extracts retry “do-not-retry” statuses into a shared exported constant.
src/api-client.test.ts	Updates tests to assert shared retry status constant is used.
src/database-upload.ts	Implements manual retry loop for database upload to avoid retrying consumed ReadStreams; factors out upload helper.
src/database-upload.test.ts	Expands tests to cover retryable vs non-retryable failure paths and verifies backoff behavior.
src/actions-util.ts	Replaces runtime package.json read with build-time injected `__CODEQL_ACTION_VERSION__`.
build.mjs	Injects `__CODEQL_ACTION_VERSION__` into the bundle via esbuild `define`.
ava.config.mjs	Moves AVA config out of package.json and ensures setup is required.
ava.setup.mjs	Sets `__CODEQL_ACTION_VERSION__` for tests before imports use it.
eslint.config.mjs	Adjusts ignored files and adds a dedicated TypeScript-eslint config for pr-checks scripts.
pr-checks/tsconfig.json	Adds a TS config for pr-checks to support project-aware linting.
pr-checks/sync-back.ts	Minor refactors/formatting and regex simplifications.
pr-checks/sync-back.test.ts	Updates test import path/name and restructures test definitions.
.github/workflows/pr-checks.yml	Moves pr-checks verification/tests into a separate Node 24 job; keeps unit tests on Node 20/24 matrix.
.github/workflows/rebuild.yml	Adds Node 24 setup/caching and tweaks merge/commit flow; updates sync-back script name.
pr-checks/checks/*.yml	Normalizes YAML formatting and adjusts some per-check setup behavior.
CHANGELOG.md	Adds v3.33.0 release notes (file coverage PR deprecation, repo properties fixes/behavior, OIDC registries, DB upload retry fix, etc.).
package.json	Bumps version to 3.33.0, adds workspaces, updates devDependencies, and moves AVA config to ava.config.mjs.
lib/* (generated)	Compiled output updates (not reviewed; expected to mirror src changes).
.github/workflows/__*.yml (generated)	Generated workflow updates (not reviewed; expected output of pr-checks sync).

Files not reviewed (1)

pr-checks/package-lock.json: Language not supported

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

Comment thread

src/start-proxy.ts

Comment on lines +455 to +457

		(isToken(authConfig) &&
		isDefined(authConfig.token) &&
		isPAT(authConfig.token))

mbg Mar 16, 2026

Copy link

Copy Markdown

Member

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot shouldn't be reviewing changes in a release PR, but this might be an actual oversight that didn't get caught in the relevant feature PR.

I don't think it should block us from wrapping up this release, especially since v4 is already out with this change.

We can fix it if needed afterwards and release a new version / include it in the release at the end of the current CLI release cycle.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

oscarsj reacted with thumbs up emoji

All reactions

👍 1 reaction

Comment thread

build.mjs Resolved

Uh oh!

There was an error while loading. Please reload this page.

Comment thread

ava.setup.mjs Resolved

Uh oh!

There was an error while loading. Please reload this page.

Comment thread

src/init.ts Resolved

Uh oh!

There was an error while loading. Please reload this page.

mbg disabled auto-merge

March 16, 2026 11:35

mbg merged commit 603b797 into releases/v3

Mar 16, 2026

225 checks passed

Uh oh!

There was an error while loading. Please reload this page.

mbg deleted the backport-v3.33.0-b1bff8193 branch

March 16, 2026 12:23

mbg mentioned this pull request

Mar 16, 2026

Fix warning for PAT-like token with username #3579

Merged

Reviewers

mbg

mbg approved these changes

Copilot code review Copilot

Copilot review effort

Applies to this pull request for everyone.Learn more about Copilot code review.

Copilot left review comments

Uh oh!

There was an error while loading. Please reload this page.

Assignees

mbg

Labels

size/XXL

May be extremely hard to review

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

5 participants

Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.

You are visitor 01402520 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.

GeezerVison

Conversation

github-actions Bot commented Mar 16, 2026 • edited by mbg Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Mar 16, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

mbg Mar 16, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

github-actions Bot commented Mar 16, 2026 •

edited by mbg

Loading

Uh oh!

There was an error while loading. Please reload this page.