GeezerVison

The World Wide Web, restored to 800 pixels of glory.

GeezerVison is showing github.com — Merge main into releases/v4 by github-actions[bot] · Pull Request #4299 · github/codeql-action

Conversation

github-actions Bot commented Nov 4, 2026 •

edited by sam-robson

Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link

Copy Markdown

Contributor

Merging 064910b into releases/v4.

Conductor for this PR is @sam-robson.

Contains the following pull requests:

Please do the following:

Ensure the CHANGELOG displays the correct version and date.
Ensure the CHANGELOG includes all relevant, user-facing changes since the last release.
Check that there are not any unexpected commits being merged into the releases/v4 branch.
Ensure the docs team is aware of any documentation changes that need to be released.
Approve running the full set of PR checks if you have not pushed any changes.
Approve and merge this PR. Make sure Create a merge commit is selected rather than Squash and merge or Rebase and merge.
Merge the mergeback PR that will automatically be created once this PR is merged.
Merge all backport PRs to older release branches, that will automatically be created once this PR is merged.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

mbg and others added 30 commits

October 30, 2026 15:13


          Update .editorconfig with explicit indent_size for YAML

d805a56


          Update VSCode settings with YAML formatter

3f9319d


          Add prettier as dev dependency

fef5200


          Apply consistent YAML formatting

2c6d525


          Move subprocess helpers from update-release-branch.ts to command.ts

6c2d540


          Convert check-js.sh to TypeScript

c8db21e


          Refactor check-js.ts into separate functions

549d739


          Rename to check-unchanged and add YAML check

b2e3b75


          Fix checkUnchanged returning -1

ff6ba28


          Fix missing core.summary.write call

c434c1b


          Fix inconsistent quoting in diffRangeExtensionPackContents and empt…

878c513

…y initial line


          Configure VSCode to use local version of prettier

69543ab


          Run lint-fix with newer version of prettier

fab591c


          Avoid ESM-specific entry check for now

9fe80b6


          Merge branch 'main' into mbg/ci/validate-yaml

9151e90


          fix: decode SARIF location URIs in diff-informed alert filtering

b05fe69


          Create a changenote for bundle updates instead of editing the changelog

9bc74b1

Co-authored-by: Copilot App <[email protected]>


          Remove unused updateChangelog from bundle-changelog.ts

Co-authored-by: Copilot App <[email protected]>


          Merge remote-tracking branch 'origin/main' into mbg/ci/validate-yaml

70417cd


          Merge pull request #4285 from github/henrymercer/automated-change-notes

0d5ac7a

Migrate bundle update workflow to new changenote tooling


          Bump glob from 13.0.6 to 14.0.3 in /pr-checks

3b22011

Bumps [glob](https://github.com/isaacs/node-glob) from 13.0.6 to 14.0.3.
- [Changelog](https://github.com/isaacs/node-glob/blob/main/changelog.md)
- [Commits](isaacs/node-glob@v13.0.6...v14.0.3)

---
updated-dependencies:
- dependency-name: glob
  dependency-version: 14.0.3
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <[email protected]>


          Bump node-forge from 1.4.0 to 1.4.1

dc4b73f

Bumps [node-forge](https://github.com/digitalbazaar/forge) from 1.4.0 to 1.4.1.
- [Changelog](https://github.com/digitalbazaar/forge/blob/main/CHANGELOG.md)
- [Commits](digitalbazaar/forge@v1.4.0...v1.4.1)

---
updated-dependencies:
- dependency-name: node-forge
  dependency-version: 1.4.1
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <[email protected]>


          Update changelog and version after v4.39.2

eb1e5bd


          Rebuild


          Merge pull request #4290 from github/mergeback/v4.39.2-to-main-1fc58d04

093c0af

Mergeback v4.39.2 refs/heads/releases/v4 into main


          Maintain action versions by workflow in sync-back.ts

7b8e4ce

This avoids failures on PRs where `sync-back.ts` is run as part of the "Rebuild" job if there are already version inconsistencies on the base branch.


          Update version of actions/download-artifact in unsupported-macos …

cc88e02

…for consistency


          Merge branch 'main' into mbg/ci/fix-sync-back

de3ece6


          Merge branch 'main' into mbg/ci/validate-yaml

7bcfa1e


          Update JSDoc for scanGeneratedWorkflows

8a05ce6

mbg and others added 15 commits

November 3, 2026 14:27


          Merge pull request #4292 from github/mbg/ci/fix-sync-back

1f8cacc

Maintain action versions by workflow in `sync-back.ts`


          Merge branch 'main' into dependabot/npm_and_yarn/node-forge-1.4.1

7c5ee8e


          Merge branch 'main' into dependabot/npm_and_yarn/pr-checks/glob-14.0.3

6a39e2e


          Rebuild

d0468de


          Merge pull request #4287 from github/dependabot/npm_and_yarn/pr-check…

875ac0c

…s/glob-14.0.3

Bump glob from 13.0.6 to 14.0.3 in /pr-checks


          Merge pull request #4288 from github/dependabot/npm_and_yarn/node-for…

c5320e3

…ge-1.4.1

Bump node-forge from 1.4.0 to 1.4.1


          Merge pull request #4283 from github/sam-robson/decode-diff-informed-…

913e1bb

…sarif-uris

fix: decode SARIF location URIs in diff-informed alert filtering


          Merge remote-tracking branch 'origin/main' into mbg/ci/validate-yaml

160e547


          Use normal .editorconfig pattern

8eb7cdf


          Remove exclude entry that's no longer needed

7287bb3


          Return different exit code when a language is not recognised

cea289b


          Merge pull request #4280 from github/mbg/ci/validate-yaml

8cd4dfa

Consistently format YAML and add CI check


          Update glob to 14.0.3

f532ac5


          Merge pull request #4297 from github/mbg/update-glob

064910b

Update `glob` to `14.0.3`


          Update changelog for v4.39.3

24393f8

github-actions Bot requested a review from a team as a code owner

November 4, 2026 15:22

Copilot AI auto review requested due to automatic review settings

November 4, 2026 15:22

github-actions Bot assigned sam-robson

Nov 4, 2026

Copilot started reviewing

November 4, 2026 15:22

View session

Copilot AI reviewed

Nov 4, 2026

View reviewed changes

Copilot AI left a comment

Copy link

Copy Markdown

Contributor

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔵 Needs a closer look

Maintainer confirmation is needed because the snapshot lacks branch refs, commit history, and workflow results to verify the intended releases/v4 commit set and successful release checks.

No open issues 🎉

What changed in this PR

Prepares CodeQL Action 4.39.3, dated 04 Nov 2026, by merging main into releases/v4. The changelog records the fix for diff-informed filtering of alerts in files with encoded paths.

Changes:

Fixes SARIF path matching and adds regression tests.
Standardizes YAML formatting and updates CI, workflow synchronization, and bundle changenote tooling.
Updates dependencies and release version metadata.

File	Description
`upload-sarif/action.yml`	Standardizes YAML quoting.
`tests/multi-language-repo/codeql-qlpacks/python-qlpack/qlpack.yml`	Normalizes file formatting.
`tests/multi-language-repo/codeql-qlpacks/javascript-qlpack/qlpack.yml`	Normalizes file formatting.
`tests/multi-language-repo/codeql-qlpacks/java-qlpack/qlpack.yml`	Normalizes file formatting.
`tests/multi-language-repo/codeql-qlpacks/go-qlpack/qlpack.yml`	Normalizes file formatting.
`tests/multi-language-repo/codeql-qlpacks/csharp-qlpack/qlpack.yml`	Normalizes file formatting.
`tests/multi-language-repo/codeql-qlpacks/cpp-qlpack/qlpack.yml`	Normalizes file formatting.
`tests/multi-language-repo/codeql-qlpacks/complex-python-qlpack/qlpack.yml`	Normalizes file formatting.
`tests/multi-language-repo/codeql-qlpacks/complex-javascript-qlpack/qlpack.yml`	Normalizes file formatting.
`tests/multi-language-repo/.github/codeql/custom-queries.yml`	Aligns YAML comments.
`tests/multi-language-repo/.github/codeql/codeql-config-query-filters3.yml`	Standardizes YAML indentation.
`tests/multi-language-repo/.github/codeql/codeql-config-query-filters2.yml`	Standardizes YAML indentation.
`tests/multi-language-repo/.github/codeql/codeql-config-query-filters1.yml`	Standardizes YAML indentation.
`src/upload-sarif-action.ts`	Applies TypeScript formatting.
`src/upload-lib.ts`	Matches decoded SARIF paths with raw-path fallback.
`src/upload-lib.test.ts`	Covers encoded paths and malformed URI handling.
`src/testing-utils.ts`	Applies TypeScript formatting.
`src/testdata/pr-diff-range.yml`	Updates expected YAML formatting.
`src/start-proxy/types.ts`	Applies TypeScript formatting.
`src/setup-codeql.test.ts`	Applies TypeScript formatting.
`src/init-action-post.ts`	Applies TypeScript formatting.
`src/environment.ts`	Applies TypeScript formatting.
`src/debug-artifacts.ts`	Applies TypeScript formatting.
`src/analyze.ts`	Aligns generated YAML and TypeScript formatting.
`src/analyze-action.ts`	Applies TypeScript formatting.
`setup-codeql/action.yml`	Standardizes YAML quoting.
`resolve-environment/action.yml`	Standardizes YAML quoting.
`pr-checks/update-release-branch.ts`	Uses extracted command helpers.
`pr-checks/sync.ts`	Generates consistently formatted YAML.
`pr-checks/sync-back.ts`	Tracks action versions separately for each workflow.
`pr-checks/sync-back.test.ts`	Adapts tests to workflow-specific version mappings.
`pr-checks/package.json`	Updates `glob`.
`pr-checks/config.ts`	Exports shared source and build paths.
`pr-checks/command.ts`	Extracts reusable command and Git helpers.
`pr-checks/checks/upload-sarif.yml`	Standardizes template quoting.
`pr-checks/checks/upload-ref-sha-input.yml`	Standardizes template quoting.
`pr-checks/checks/unsupported-macos.yml`	Updates `download-artifact` to v8.0.2.
`pr-checks/checks/overlay-init-fallback.yml`	Normalizes inline comment spacing.
`pr-checks/checks/init-with-registries.yml`	Standardizes block indentation.
`pr-checks/checks/analyze-ref-input.yml`	Standardizes template quoting.
`pr-checks/check-unchanged.ts`	Adds shared JavaScript and YAML consistency checks.
`pr-checks/bundle-changelog.ts`	Writes bundle updates to changenote files.
`pr-checks/bundle-changelog.test.ts`	Tests generated bundle changenotes.
`package.json`	Sets 4.39.3, adds YAML formatting, and updates dependencies.
`package-lock.json`	Synchronizes release and dependency metadata.
`init/action.yml`	Standardizes YAML quoting.
`CHANGELOG.md`	Adds the dated 4.39.3 release entry.
`autobuild/action.yml`	Standardizes YAML quoting.
`action.yml`	Standardizes YAML quoting.
`.vscode/settings.json`	Configures the repository’s YAML formatter.
`.github/workflows/update-supported-enterprise-server-versions.yml`	Standardizes YAML quoting.
`.github/workflows/update-release-branch.yml`	Standardizes workflow indentation and quoting.
`.github/workflows/update-bundle.yml`	Stages and commits generated changenotes.
`.github/workflows/test-codeql-bundle-all.yml`	Standardizes workflow formatting.
`.github/workflows/script/check-js.sh`	Removes the replaced JavaScript verification script.
`.github/workflows/query-filters.yml`	Standardizes workflow formatting.
`.github/workflows/python312-windows.yml`	Standardizes workflow formatting.
`.github/workflows/publish-immutable-action.yml`	Standardizes YAML quoting.
`.github/workflows/pr-checks.yml`	Runs the shared JavaScript and YAML checks.
`.github/workflows/codescanning-config-cli.yml`	Standardizes workflow formatting.
`.github/workflows/codeql.yml`	Standardizes workflow formatting.
`.github/workflows/__with-checkout-path.yml`	Refreshes generated YAML formatting.
`.github/workflows/__upload-sarif.yml`	Refreshes generated YAML formatting.
`.github/workflows/__upload-ref-sha-input.yml`	Refreshes generated YAML formatting.
`.github/workflows/__unsupported-macos.yml`	Reflects formatting and artifact-action updates.
`.github/workflows/__unset-environment.yml`	Refreshes generated YAML formatting.
`.github/workflows/__swift-custom-build.yml`	Refreshes generated YAML formatting.
`.github/workflows/__swift-autobuild.yml`	Refreshes generated YAML formatting.
`.github/workflows/__submit-sarif-failure.yml`	Refreshes generated YAML formatting.
`.github/workflows/__start-proxy.yml`	Refreshes generated YAML formatting.
`.github/workflows/__split-workflow.yml`	Refreshes generated YAML formatting.
`.github/workflows/__rust.yml`	Refreshes generated YAML formatting.
`.github/workflows/__ruby.yml`	Refreshes generated YAML formatting.
`.github/workflows/__resolve-environment-action.yml`	Refreshes generated YAML formatting.
`.github/workflows/__remote-config.yml`	Refreshes generated YAML formatting.
`.github/workflows/__per-language-bundle-validation.yml`	Refreshes generated YAML formatting.
`.github/workflows/__packaging-inputs-js.yml`	Refreshes generated YAML formatting.
`.github/workflows/__packaging-config-js.yml`	Refreshes generated YAML formatting.
`.github/workflows/__packaging-config-inputs-js.yml`	Refreshes generated YAML formatting.
`.github/workflows/__packaging-codescanning-config-inputs-js.yml`	Refreshes generated YAML formatting.
`.github/workflows/__overlay-init-fallback.yml`	Refreshes generated YAML formatting.
`.github/workflows/__multi-language-autodetect.yml`	Refreshes generated YAML formatting.
`.github/workflows/__local-bundle.yml`	Refreshes generated YAML formatting.
`.github/workflows/__linux-arm64.yml`	Refreshes generated YAML formatting.
`.github/workflows/__language-aliases.yml`	Refreshes generated YAML formatting.
`.github/workflows/__job-run-uuid-sarif.yml`	Refreshes generated YAML formatting.
`.github/workflows/__javascript-source-root.yml`	Refreshes generated YAML formatting.
`.github/workflows/__init-with-registries.yml`	Refreshes generated YAML formatting.
`.github/workflows/__go.yml`	Refreshes generated YAML formatting.
`.github/workflows/__go-tracing-legacy-workflow.yml`	Refreshes generated YAML formatting.
`.github/workflows/__go-tracing-custom-build-steps.yml`	Refreshes generated YAML formatting.
`.github/workflows/__go-tracing-autobuilder.yml`	Refreshes generated YAML formatting.
`.github/workflows/__go-indirect-tracing-workaround.yml`	Refreshes generated YAML formatting.
`.github/workflows/__go-indirect-tracing-workaround-no-file-program.yml`	Refreshes generated YAML formatting.
`.github/workflows/__go-indirect-tracing-workaround-diagnostic.yml`	Refreshes generated YAML formatting.
`.github/workflows/__go-custom-queries.yml`	Refreshes generated YAML formatting.
`.github/workflows/__global-proxy.yml`	Refreshes generated YAML formatting.
`.github/workflows/__extractor-ram-threads.yml`	Refreshes generated YAML formatting.
`.github/workflows/__export-file-baseline-information.yml`	Refreshes generated YAML formatting.
`.github/workflows/__diagnostics-without-db.yml`	Refreshes generated YAML formatting.
`.github/workflows/__diagnostics-export.yml`	Refreshes generated YAML formatting.
`.github/workflows/__cpp-deptrace-enabled.yml`	Refreshes generated YAML formatting.
`.github/workflows/__cpp-deptrace-enabled-on-macos.yml`	Refreshes generated YAML formatting.
`.github/workflows/__cpp-deptrace-disabled.yml`	Refreshes generated YAML formatting.
`.github/workflows/__config-input.yml`	Refreshes generated YAML formatting.
`.github/workflows/__config-export.yml`	Refreshes generated YAML formatting.
`.github/workflows/__cleanup-db-cluster-dir.yml`	Refreshes generated YAML formatting.
`.github/workflows/__bundle-toolcache.yml`	Refreshes generated YAML formatting.
`.github/workflows/__bundle-from-toolcache.yml`	Refreshes generated YAML formatting.
`.github/workflows/__bundle-from-nightly.yml`	Refreshes generated YAML formatting.
`.github/workflows/__build-mode-rollback.yml`	Refreshes generated YAML formatting.
`.github/workflows/__build-mode-none.yml`	Refreshes generated YAML formatting.
`.github/workflows/__build-mode-manual.yml`	Refreshes generated YAML formatting.
`.github/workflows/__build-mode-autobuild.yml`	Refreshes generated YAML formatting.
`.github/workflows/__autobuild-working-dir.yml`	Refreshes generated YAML formatting.
`.github/workflows/__autobuild-direct-tracing-with-working-dir.yml`	Refreshes generated YAML formatting.
`.github/workflows/__autobuild-action.yml`	Refreshes generated YAML formatting.
`.github/workflows/__analyze-ref-input.yml`	Refreshes generated YAML formatting.
`.github/workflows/__analysis-kinds.yml`	Refreshes generated YAML formatting.
`.github/workflows/__all-platform-bundle.yml`	Refreshes generated YAML formatting.
`.github/ISSUE_TEMPLATE/config.yml`	Removes trailing whitespace.
`.github/actions/release-initialise/action.yml`	Standardizes YAML formatting.
`.github/actions/release-branches/action.yml`	Standardizes YAML quoting.
`.github/actions/query-filter-test/action.yml`	Normalizes YAML spacing.
`.github/actions/check-codescanning-config/action.yml`	Standardizes YAML indentation and quoting.
`.editorconfig`	Sets two-space YAML indentation.

_{Review effort: Balanced (auto)}

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

github-actions Bot added the size/XXL May be extremely hard to review label

Nov 4, 2026

sam-robson enabled auto-merge

November 4, 2026 16:45

sam-robson approved these changes

Nov 4, 2026

View reviewed changes

sam-robson merged commit 33d7b85 into releases/v4

Nov 4, 2026

234 checks passed

Uh oh!

There was an error while loading. Please reload this page.

sam-robson deleted the update-v4.39.3-064910ba2 branch

November 4, 2026 16:47

github-actions Bot mentioned this pull request

Nov 4, 2026

Merge releases/v4 into releases/v3 #4304

Merged

9 of 10 tasks

clawgenti mentioned this pull request

Nov 9, 2026

Build(deps): Bump the codeql-action group with 4 updates rossoctl/cortex#1742

Merged

Reviewers

Copilot code review Copilot

Copilot review effort

Applies to this pull request for everyone.Learn more about Copilot code review.

Copilot left review comments

sam-robson

sam-robson approved these changes

Uh oh!

There was an error while loading. Please reload this page.

Assignees

sam-robson

Labels

size/XXL

May be extremely hard to review

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

4 participants

Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.

You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.

GeezerVison

Conversation

github-actions Bot commented Nov 4, 2026 • edited by sam-robson Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🔵 Needs a closer look

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

github-actions Bot commented Nov 4, 2026 •

edited by sam-robson

Loading

Uh oh!

There was an error while loading. Please reload this page.