GeezerVison

The World Wide Web, restored to 800 pixels of glory.

GeezerVison is showing github.com — Merge releases/v4 into releases/v3 by github-actions[bot] · Pull Request #3826 · github/codeql-action

Conversation

github-actions Bot commented Apr 15, 2026

Copy link

Copy Markdown

Contributor

Merging 95e58e9 into releases/v3.

Conductor for this PR is @henrymercer.

Contains the following pull requests:

Please do the following:

Ensure the CHANGELOG displays the correct version and date.
Ensure the CHANGELOG includes all relevant, user-facing changes since the last release.
Check that there are not any unexpected commits being merged into the releases/v3 branch.
Ensure the docs team is aware of any documentation changes that need to be released.
Remove and re-add the "Rebuild" label to the PR to trigger just this workflow.
Wait for the "Rebuild" workflow to push a commit updating the distribution files.
Mark the PR as ready for review to trigger the full set of PR checks.
Approve and merge this PR. Make sure Create a merge commit is selected rather than Squash and merge or Rebase and merge.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

henrymercer and others added 30 commits

March 27, 2026 13:57


          Remove unused @schemastore/package dependency

7dcea06


          Bump brace-expansion from 1.1.12 to 1.1.13

f13c600

Bumps [brace-expansion](https://github.com/juliangruber/brace-expansion) from 1.1.12 to 1.1.13.
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v1.1.12...v1.1.13)

---
updated-dependencies:
- dependency-name: brace-expansion
  dependency-version: 1.1.13
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <[email protected]>


          Rebuild

999119b


          Update changelog and version after v4.35.1

6010f9d


          Rebuild

cc7db4a


          Move time-sensitive Actions workflows to ubuntu-latest

353802f

We originally moved these to `ubuntu-slim`, but there is a significant performance difference.  Since we often find ourselves waiting on these jobs, let's use the faster runners.


          Merge pull request #3780 from github/dependabot/npm_and_yarn/brace-ex…

fe775da

…pansion-1.1.13

Bump brace-expansion from 1.1.12 to 1.1.13


          Merge pull request #3779 from github/henrymercer/remove-unused-depend…

aa69c48

…ency

Remove unused `@schemastore/package` dependency


          Merge pull request #3783 from github/mergeback/v4.35.1-to-main-c10b8064

191d7c6

Mergeback v4.35.1 refs/heads/releases/v4 into main


          Generate esbuild metadata file

4ed3c0e


          Merge pull request #3786 from github/henrymercer/faster-interactive-jobs

a899987

Move time-sensitive Actions workflows to `ubuntu-latest`


          Move getApiClient out of sync-checks.ts

b1981a5


          Add basic metadata analysis script

47f1709


          Only require Git 2.36.0 when repo contains submodules

6643a7d


          Don't disable if we don't need the git version

88a7e51


          Add changelog note


          Output largest inputs

4e0952a


          Fix outputs type

3db32b5


          Output relative to __dirname

f98bf5e


          Save a computation of the git root

be0a156


          Test fallback when repo has no submodules

a507a54


          Extend start-proxy.yml to test multiple registry support

0c7c298


          Replace jq with Actions expression for proxy_urls validation

9fd9b64

For the sake of consistency with the other pre-existing validation code.


          Merge pull request #3789 from github/henrymercer/lower-minimum-git-if…

c618c9b

…-no-submodules

Overlay: Only require Git 2.36.0 for repos that contain submodules


          Run pr-checks/sync.sh to generate __start-proxy.yml.

99b8dd4


          Use maven_repository, not maven-repository

8b5e604

The registry/language mapping table does not map the one with hyphens.


          Use different maven URL for start-proxy.yml test

faf45e0


          Keep validation steps named consistently

7b0c5b1


          Delete fromJSON() calls in test validation step

e2203c6


          Merge pull request #3787 from github/mbg/bundle/metadata

2e3aaae

Generate and analyse esbuild bundle metadata

github-actions Bot and others added 13 commits

April 13, 2026 17:30


          Rebuild

1024fc4


          Rebuild

f1c3393


          Merge pull request #3821 from github/dependabot/npm_and_yarn/npm-mino…

3c45af2

…r-345b938e93

Bump the npm-minor group across 1 directory with 6 updates


          Merge pull request #3820 from github/dependabot/github_actions/dot-gi…

…thub/workflows/actions-minor-cc17fecf2b

Bump the actions-minor group across 1 directory with 2 updates


          Update default bundle to codeql-bundle-v2.25.2

5a0a562


          Add changelog note

60abb65


          Merge pull request #3823 from github/update-bundle/codeql-bundle-v2.25.2

d2e135a

Update default bundle to 2.25.2


          Update changelog for v4.35.2

6f31bfe


          Merge pull request #3824 from github/update-v4.35.2-d2e135a73

95e58e9

Merge main into releases/v4


          Revert "Update version and changelog for v3.35.1"

7ca2158

This reverts commit c983cb8.


          Revert "Rebuild"

047c547

This reverts commit 646729a.


          Merge remote-tracking branch 'origin/releases/v4' into backport-v3.35…

834786a

….2-95e58e9a2


          Update version and changelog for v3.35.2

8bcc8f2

github-actions Bot added the Rebuild Re-transpile JS & re-generate workflows label

Apr 15, 2026

github-actions Bot assigned henrymercer

Apr 15, 2026

henrymercer added Rebuild Re-transpile JS & re-generate workflows and removed Rebuild Re-transpile JS & re-generate workflows labels

Apr 15, 2026

github-actions Bot removed the Rebuild Re-transpile JS & re-generate workflows label

Apr 15, 2026


          Rebuild

c186c7b

github-actions Bot commented Apr 15, 2026

Copy link

Copy Markdown

Contributor Author

Pushed a commit to rebuild the Action. Please mark the PR as ready for review to trigger PR checks.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

henrymercer marked this pull request as ready for review

April 15, 2026 11:31

henrymercer requested a review from a team as a code owner

April 15, 2026 11:31

Copilot AI review requested due to automatic review settings

April 15, 2026 11:31

henrymercer approved these changes

Apr 15, 2026

View reviewed changes

github-actions Bot added the size/XXL May be extremely hard to review label

Apr 15, 2026

henrymercer enabled auto-merge

April 15, 2026 11:31

Copilot started reviewing on behalf of henrymercer

April 15, 2026 11:31

View session

Copilot AI reviewed

Apr 15, 2026

View reviewed changes

Copilot AI left a comment

Copy link

Copy Markdown

Contributor

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Mergeback from releases/v4 into releases/v3, bringing in release tooling updates, dependency bumps, and multiple behavior changes (proxy, overlay caching refactor, Swift handling, etc.).

Changes:

Upgrade TypeScript/tooling and adjust build pipeline to emit and report esbuild bundle metadata.
Refactor overlay database caching into dedicated modules and update imports/tests accordingly.
Update start-proxy language alias handling and OIDC credential property names; add/adjust PR checks and workflows.

Show a summary per file

File	Description
tsconfig.json	TS compiler config updates for TS6 (moduleResolution/types/skipLibCheck/paths).
src/trap-caching.ts	Emit deprecation warning for TRAP cache cleanup.
src/tools-features.ts	Remove Python stdlib extraction tools feature flag reference.
src/testing-utils.ts	Update overlay mode import path.
src/status-report.ts	Update overlay caching stats import path.
src/start-proxy/types.ts	Switch OIDC config JSON property names to kebab-case; update validators/formatting.
src/start-proxy/types.test.ts	Update tests for new OIDC property names.
src/start-proxy.ts	Use checked-in language aliases JSON; update language parsing and OIDC config shaping.
src/start-proxy.test.ts	Add multi-registry tests; update OIDC property name fixtures.
src/overlay/overlay-database-mode.ts	New enum module for overlay database mode.
src/overlay/index.ts	Remove caching logic; retain overlay OID/changes-file logic.
src/overlay/index.test.ts	Remove caching tests from overlay index suite.
src/overlay/caching.ts	New module containing overlay-base DB cache upload/download/key logic.
src/overlay/caching.test.ts	New test suite for overlay cache behavior and key stability.
src/known-language-aliases.json	Add checked-in snapshot of language aliases.
src/init-action.ts	Update overlay imports; treat Swift on non-macOS as configuration error; remove Python stdlib override logic.
src/init-action-post-helper.ts	Update overlay mode import path.
src/init-action-post-helper.test.ts	Update overlay mode import path in tests.
src/git-utils.ts	Add submodule detection; only use `--recurse-submodules` when needed; rename min Git version constant.
src/git-utils.test.ts	Add coverage for submodule/no-submodule argument selection and updated stubbing.
src/feature-flags.ts	Remove Python stdlib extraction feature flag wiring.
src/defaults.json	Bump default CLI/bundle version to 2.25.2 (and prior versions accordingly).
src/database-upload.ts	Update overlay mode import path.
src/config-utils.ts	Only enforce Git ≥ 2.36.0 when repo has submodules; update overlay mode import.
src/config-utils.test.ts	Update overlay enablement tests for submodule-aware Git version checks.
src/codeql.ts	Update overlay mode import path.
src/cli-errors.ts	Add Swift incompatible-OS classification.
src/cli-errors.test.ts	Add test for Swift incompatible-OS classification.
src/analyze.ts	Update overlay mode import path.
src/analyze-action.ts	Import overlay cache upload from new module.
pr-checks/tsconfig.json	TS6-related config tweak (`module: preserve`).
pr-checks/sync-checks.ts	Extract API client construction into reusable module.
pr-checks/config.ts	Add path constant for esbuild metadata file.
pr-checks/checks/start-proxy.yml	Extend start-proxy PR check to validate multiple registries.
pr-checks/checks/rubocop-multi-language.yml	Update ruby/setup-ruby pin.
pr-checks/checks/language-aliases.yml	Remove Swift from language-aliases PR check expectations.
pr-checks/bundle-metadata.ts	New script to print esbuild bundle sizes from metafile.
pr-checks/api-client.ts	New shared Octokit client helper for PR checks scripts.
package.json	Bump action version; run bundle-metadata script as part of build; dependency/devDependency bumps.
package-lock.json	Lockfile updates for bumped dependencies/tooling and version fields.
build.mjs	Enable esbuild metafile output and write `meta.json`.
CHANGELOG.md	Add 3.35.2 release notes and date.
.gitignore	Ignore generated `meta.json`.
.github/workflows/update-release-branch.yml	Switch runner to ubuntu-latest; bump create-github-app-token.
.github/workflows/update-bundle.yml	Switch runner to ubuntu-latest; add step to update checked-in language aliases.
.github/workflows/rollback-release.yml	Bump create-github-app-token.
.github/workflows/prepare-release.yml	Switch runner to ubuntu-latest.
.github/workflows/post-release-mergeback.yml	Switch runner to ubuntu-latest; bump create-github-app-token.
.github/workflows/debug-artifacts-failure-safe.yml	Explicitly set languages list for init step.
.github/workflows/__start-proxy.yml	Generated workflow update mirroring start-proxy check changes.
.github/workflows/__rubocop-multi-language.yml	Generated workflow update mirroring rubocop check changes.
.github/workflows/__language-aliases.yml	Generated workflow update mirroring language-aliases check changes.
.github/dependabot.yml	Expand Dependabot config to cover additional directories.
lib/upload-sarif-action-post.js	Generated bundle output update (do not review source-of-truth).
lib/start-proxy-action-post.js	Generated bundle output update (do not review source-of-truth).
lib/defaults.json	Generated output update for defaults.json.

Copilot's findings

Files reviewed: 47/66 changed files
Comments generated: 1

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

Comment thread

package.json

Comment on lines 7 to 9

		"_build_comment": "echo 'Run the full build so we typecheck the project and can reuse the transpiled files in npm test'",
		"build": "./scripts/check-node-modules.sh && npm run transpile && node build.mjs",
		"build": "./scripts/check-node-modules.sh && npm run transpile && node build.mjs && npx tsx ./pr-checks/bundle-metadata.ts",
		"lint": "eslint --report-unused-disable-directives --max-warnings=0 .",

Copilot AI Apr 15, 2026

Copy link

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

npm run build now executes npx tsx ..., but tsx is not listed in devDependencies. This makes builds depend on network availability and may pull different tsx versions over time. Add tsx as a pinned dev dependency (or vendor the script into an existing toolchain) to make builds reproducible.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

Copilot uses AI. Check for mistakes.

henrymercer merged commit ce64ddc into releases/v3

Apr 15, 2026

222 checks passed

Uh oh!

There was an error while loading. Please reload this page.

henrymercer deleted the backport-v3.35.2-95e58e9a2 branch

April 15, 2026 11:51

Reviewers

Copilot code review Copilot

Copilot review effort

Applies to this pull request for everyone.Learn more about Copilot code review.

Copilot left review comments

henrymercer

henrymercer approved these changes

Uh oh!

There was an error while loading. Please reload this page.

Assignees

henrymercer

Labels

size/XXL

May be extremely hard to review

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

4 participants

Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.

You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.