GeezerVison

The World Wide Web, restored to 800 pixels of glory.

GeezerVison is showing github.com — Merge releases/v4 into releases/v3 by github-actions[bot] · Pull Request #4304 · github/codeql-action

Conversation

github-actions Bot commented Nov 4, 2026 •

edited by sam-robson

Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link

Copy Markdown

Contributor

Merging 33d7b85 into releases/v3.

Conductor for this PR is @sam-robson.

Contains the following pull requests:

Please do the following:

Ensure package.json file contains the correct version.
Add a commit to this branch to resolve the merge conflicts in the following files:
- autobuild/action.yml
- init/action.yml
- resolve-environment/action.yml
- setup-codeql/action.yml
- upload-sarif/action.yml
Rebuild the Action locally (npm run build) and push any changes to the built output in lib as a separate commit named exactly Rebuild.
Ensure another maintainer has reviewed the additional commits you added to this branch to resolve the merge conflicts.
Ensure the CHANGELOG displays the correct version and date.
Ensure the CHANGELOG includes all relevant, user-facing changes since the last release.
Check that there are not any unexpected commits being merged into the releases/v3 branch.
Ensure the docs team is aware of any documentation changes that need to be released.
Approve running the full set of PR checks if you have not pushed any changes.
Approve and merge this PR. Make sure Create a merge commit is selected rather than Squash and merge or Rebase and merge.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

mbg and others added 30 commits

October 30, 2026 15:13


          Update .editorconfig with explicit indent_size for YAML

d805a56


          Update VSCode settings with YAML formatter

3f9319d


          Add prettier as dev dependency

fef5200


          Apply consistent YAML formatting

2c6d525


          Move subprocess helpers from update-release-branch.ts to command.ts

6c2d540


          Convert check-js.sh to TypeScript

c8db21e


          Refactor check-js.ts into separate functions

549d739


          Rename to check-unchanged and add YAML check

b2e3b75


          Fix checkUnchanged returning -1

ff6ba28


          Fix missing core.summary.write call

c434c1b


          Fix inconsistent quoting in diffRangeExtensionPackContents and empt…

878c513

…y initial line


          Configure VSCode to use local version of prettier

69543ab


          Run lint-fix with newer version of prettier

fab591c


          Avoid ESM-specific entry check for now

9fe80b6


          Merge branch 'main' into mbg/ci/validate-yaml

9151e90


          fix: decode SARIF location URIs in diff-informed alert filtering

b05fe69


          Create a changenote for bundle updates instead of editing the changelog

9bc74b1

Co-authored-by: Copilot App <[email protected]>


          Remove unused updateChangelog from bundle-changelog.ts

Co-authored-by: Copilot App <[email protected]>


          Merge remote-tracking branch 'origin/main' into mbg/ci/validate-yaml

70417cd


          Merge pull request #4285 from github/henrymercer/automated-change-notes

0d5ac7a

Migrate bundle update workflow to new changenote tooling


          Bump glob from 13.0.6 to 14.0.3 in /pr-checks

3b22011

Bumps [glob](https://github.com/isaacs/node-glob) from 13.0.6 to 14.0.3.
- [Changelog](https://github.com/isaacs/node-glob/blob/main/changelog.md)
- [Commits](isaacs/node-glob@v13.0.6...v14.0.3)

---
updated-dependencies:
- dependency-name: glob
  dependency-version: 14.0.3
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <[email protected]>


          Bump node-forge from 1.4.0 to 1.4.1

dc4b73f

Bumps [node-forge](https://github.com/digitalbazaar/forge) from 1.4.0 to 1.4.1.
- [Changelog](https://github.com/digitalbazaar/forge/blob/main/CHANGELOG.md)
- [Commits](digitalbazaar/forge@v1.4.0...v1.4.1)

---
updated-dependencies:
- dependency-name: node-forge
  dependency-version: 1.4.1
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <[email protected]>


          Update changelog and version after v4.39.2

eb1e5bd


          Rebuild


          Merge pull request #4290 from github/mergeback/v4.39.2-to-main-1fc58d04

093c0af

Mergeback v4.39.2 refs/heads/releases/v4 into main


          Maintain action versions by workflow in sync-back.ts

7b8e4ce

This avoids failures on PRs where `sync-back.ts` is run as part of the "Rebuild" job if there are already version inconsistencies on the base branch.


          Update version of actions/download-artifact in unsupported-macos …

cc88e02

…for consistency


          Merge branch 'main' into mbg/ci/fix-sync-back

de3ece6


          Merge branch 'main' into mbg/ci/validate-yaml

7bcfa1e


          Update JSDoc for scanGeneratedWorkflows

8a05ce6

mbg and others added 19 commits

November 3, 2026 15:33


          Merge branch 'main' into dependabot/npm_and_yarn/node-forge-1.4.1

7c5ee8e


          Merge branch 'main' into dependabot/npm_and_yarn/pr-checks/glob-14.0.3

6a39e2e


          Rebuild

d0468de


          Merge pull request #4287 from github/dependabot/npm_and_yarn/pr-check…

875ac0c

…s/glob-14.0.3

Bump glob from 13.0.6 to 14.0.3 in /pr-checks


          Merge pull request #4288 from github/dependabot/npm_and_yarn/node-for…

c5320e3

…ge-1.4.1

Bump node-forge from 1.4.0 to 1.4.1


          Merge pull request #4283 from github/sam-robson/decode-diff-informed-…

913e1bb

…sarif-uris

fix: decode SARIF location URIs in diff-informed alert filtering


          Merge remote-tracking branch 'origin/main' into mbg/ci/validate-yaml

160e547


          Use normal .editorconfig pattern

8eb7cdf


          Remove exclude entry that's no longer needed

7287bb3


          Return different exit code when a language is not recognised

cea289b


          Merge pull request #4280 from github/mbg/ci/validate-yaml

8cd4dfa

Consistently format YAML and add CI check


          Update glob to 14.0.3

f532ac5


          Merge pull request #4297 from github/mbg/update-glob

064910b

Update `glob` to `14.0.3`


          Update changelog for v4.39.3

24393f8


          Merge pull request #4299 from github/update-v4.39.3-064910ba2

33d7b85

Merge main into releases/v4


          Revert "Update version and changelog for v3.39.2"

11db0b7

This reverts commit 4c53ff5.


          Revert "Rebuild"

268f88d

This reverts commit d94ff1d.


          Merge remote-tracking branch 'origin/releases/v4' into backport-v3.39…

3a2a01e

….3-33d7b85da

# Conflicts:
#	autobuild/action.yml
#	init/action.yml
#	resolve-environment/action.yml
#	setup-codeql/action.yml
#	upload-sarif/action.yml


          Update version and changelog for v3.39.3

205ef9f

github-actions Bot requested a review from a team as a code owner

November 4, 2026 16:50

Copilot AI auto review requested due to automatic review settings

November 4, 2026 16:50

github-actions Bot assigned sam-robson

Nov 4, 2026

Copilot started reviewing

November 4, 2026 16:51

View session

Copilot AI reviewed

Nov 4, 2026

View reviewed changes

Copilot AI left a comment

Copy link

Copy Markdown

Contributor

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Changes recommended

Unresolved conflict markers invalidate five action manifests and prevent workflows from loading the affected actions.

6 open issues

What changed in this PR

Backports fixes and maintenance from releases/v4 into releases/v3 for CodeQL Action 3.39.3, including the diff-informed alert-filtering fix.

Changes:

Decodes percent-encoded SARIF paths before diff-range matching, with regression tests.
Standardizes YAML formatting and adds CI validation.
Updates dependencies, bundle changenote generation, and per-workflow action-version synchronization.

This pull request requires changes.

Critical: Five action manifests contain unresolved merge conflicts, making them invalid YAML and preventing workflows from loading them. Resolve each to a single Node 20 runtime mapping; preserve the formatted entry-point paths in upload-sarif.
Moderate: pr-checks/check-unchanged.ts:139 leaves formatting edits behind after failure, causing the subsequent workflow-validation check to reject the dirty tree before validation. Restore the edits after capturing the diff or use a non-mutating check.
Nit: Add a regression test for two workflows using different versions of the same action, asserting workflow-scoped version data and verifying each template receives its corresponding version.

File	Description
`upload-sarif/action.yml`	Reformats manifest; critical unresolved runtime conflict at line 44.
`tests/multi-language-repo/codeql-qlpacks/python-qlpack/qlpack.yml`	Adds final newline.
`tests/multi-language-repo/codeql-qlpacks/javascript-qlpack/qlpack.yml`	Adds final newline.
`tests/multi-language-repo/codeql-qlpacks/java-qlpack/qlpack.yml`	Adds final newline.
`tests/multi-language-repo/codeql-qlpacks/go-qlpack/qlpack.yml`	Adds final newline.
`tests/multi-language-repo/codeql-qlpacks/csharp-qlpack/qlpack.yml`	Adds final newline.
`tests/multi-language-repo/codeql-qlpacks/cpp-qlpack/qlpack.yml`	Adds final newline.
`tests/multi-language-repo/codeql-qlpacks/complex-python-qlpack/qlpack.yml`	Adds final newline.
`tests/multi-language-repo/codeql-qlpacks/complex-javascript-qlpack/qlpack.yml`	Adds final newline.
`tests/multi-language-repo/.github/codeql/custom-queries.yml`	Normalizes comment indentation.
`tests/multi-language-repo/.github/codeql/codeql-config-query-filters3.yml`	Normalizes filter and comment indentation.
`tests/multi-language-repo/.github/codeql/codeql-config-query-filters2.yml`	Normalizes filter-list indentation.
`tests/multi-language-repo/.github/codeql/codeql-config-query-filters1.yml`	Normalizes filter-list indentation.
`src/upload-sarif-action.ts`	Reformats interface inheritance.
`src/upload-lib.ts`	Decodes SARIF paths before diff matching, with raw-path fallback.
`src/upload-lib.test.ts`	Tests encoded paths, malformed URIs, and related locations.
`src/testing-utils.ts`	Reformats generic parameters.
`src/testdata/pr-diff-range.yml`	Updates expected generated YAML formatting.
`src/start-proxy/types.ts`	Reformats the OIDC union type.
`src/setup-codeql.test.ts`	Reformats a type assertion.
`src/init-action-post.ts`	Applies TypeScript formatting changes.
`src/environment.ts`	Reformats a union type.
`src/debug-artifacts.ts`	Reformats a union type.
`src/analyze.ts`	Aligns generated diff-range YAML formatting.
`src/analyze-action.ts`	Applies TypeScript formatting changes.
`setup-codeql/action.yml`	Reformats manifest; critical unresolved runtime conflict at line 54.
`resolve-environment/action.yml`	Reformats manifest; critical unresolved runtime conflict at line 24.
`pr-checks/update-release-branch.ts`	Uses extracted command-execution helpers.
`pr-checks/sync.ts`	Emits consistently double-quoted workflow YAML.
`pr-checks/sync-back.ts`	Tracks action versions per workflow; regression-test nit at line 88.
`pr-checks/sync-back.test.ts`	Adapts tests to workflow-scoped version mappings.
`pr-checks/package.json`	Updates `glob`.
`pr-checks/config.ts`	Exports shared repository paths.
`pr-checks/command.ts`	Extracts command and Git execution helpers.
`pr-checks/checks/upload-sarif.yml`	Normalizes input quoting.
`pr-checks/checks/upload-ref-sha-input.yml`	Normalizes input quoting.
`pr-checks/checks/unsupported-macos.yml`	Updates the artifact-download action.
`pr-checks/checks/overlay-init-fallback.yml`	Normalizes inline-comment spacing.
`pr-checks/checks/init-with-registries.yml`	Normalizes registry-block indentation.
`pr-checks/checks/analyze-ref-input.yml`	Normalizes input quoting.
`pr-checks/check-unchanged.ts`	Adds JavaScript/YAML checks; moderate failure-cleanup issue at line 139.
`pr-checks/bundle-changelog.ts`	Writes bundle updates as unreleased changenotes.
`pr-checks/bundle-changelog.test.ts`	Tests generated changenote content.
`package.json`	Updates release version, dependencies, and formatting tooling.
`package-lock.json`	Updates locked dependencies and release metadata.
`init/action.yml`	Reformats manifest; critical unresolved runtime conflict at line 183.
`CHANGELOG.md`	Documents the v3.39.3 alert-filtering fix.
`autobuild/action.yml`	Reformats manifest; critical unresolved runtime conflict at line 18.
`action.yml`	Normalizes manifest quoting.
`.vscode/settings.json`	Configures Prettier for YAML.
`.github/workflows/update-supported-enterprise-server-versions.yml`	Normalizes cache-input quoting.
`.github/workflows/update-release-branch.yml`	Normalizes workflow indentation.
`.github/workflows/update-bundle.yml`	Creates and stages generated bundle changenotes.
`.github/workflows/test-codeql-bundle-all.yml`	Normalizes workflow formatting.
`.github/workflows/script/check-js.sh`	Removes the superseded JavaScript checker.
`.github/workflows/query-filters.yml`	Normalizes workflow formatting.
`.github/workflows/python312-windows.yml`	Normalizes workflow formatting.
`.github/workflows/publish-immutable-action.yml`	Normalizes workflow quoting.
`.github/workflows/pr-checks.yml`	Integrates the TypeScript checker and YAML validation.
`.github/workflows/codescanning-config-cli.yml`	Normalizes workflow formatting.
`.github/workflows/codeql.yml`	Normalizes workflow formatting.
`.github/workflows/__with-checkout-path.yml`	Regenerates YAML formatting.
`.github/workflows/__upload-sarif.yml`	Regenerates YAML formatting.
`.github/workflows/__upload-ref-sha-input.yml`	Regenerates YAML formatting.
`.github/workflows/__unsupported-macos.yml`	Regenerates formatting and artifact-action update.
`.github/workflows/__unset-environment.yml`	Regenerates YAML formatting.
`.github/workflows/__swift-custom-build.yml`	Regenerates YAML formatting.
`.github/workflows/__swift-autobuild.yml`	Regenerates YAML formatting.
`.github/workflows/__submit-sarif-failure.yml`	Regenerates YAML formatting.
`.github/workflows/__start-proxy.yml`	Regenerates YAML formatting.
`.github/workflows/__split-workflow.yml`	Regenerates YAML formatting.
`.github/workflows/__rust.yml`	Regenerates YAML formatting.
`.github/workflows/__ruby.yml`	Regenerates YAML formatting.
`.github/workflows/__resolve-environment-action.yml`	Regenerates YAML formatting.
`.github/workflows/__remote-config.yml`	Regenerates YAML formatting.
`.github/workflows/__per-language-bundle-validation.yml`	Regenerates YAML formatting.
`.github/workflows/__packaging-inputs-js.yml`	Regenerates YAML formatting.
`.github/workflows/__packaging-config-js.yml`	Regenerates YAML formatting.
`.github/workflows/__packaging-config-inputs-js.yml`	Regenerates YAML formatting.
`.github/workflows/__packaging-codescanning-config-inputs-js.yml`	Regenerates YAML formatting.
`.github/workflows/__overlay-init-fallback.yml`	Regenerates YAML formatting.
`.github/workflows/__multi-language-autodetect.yml`	Regenerates YAML formatting.
`.github/workflows/__local-bundle.yml`	Regenerates YAML formatting.
`.github/workflows/__linux-arm64.yml`	Regenerates YAML formatting.
`.github/workflows/__language-aliases.yml`	Regenerates YAML formatting.
`.github/workflows/__job-run-uuid-sarif.yml`	Regenerates YAML formatting.
`.github/workflows/__javascript-source-root.yml`	Regenerates YAML formatting.
`.github/workflows/__init-with-registries.yml`	Regenerates YAML formatting.
`.github/workflows/__go.yml`	Regenerates YAML formatting.
`.github/workflows/__go-tracing-legacy-workflow.yml`	Regenerates YAML formatting.
`.github/workflows/__go-tracing-custom-build-steps.yml`	Regenerates YAML formatting.
`.github/workflows/__go-tracing-autobuilder.yml`	Regenerates YAML formatting.
`.github/workflows/__go-indirect-tracing-workaround.yml`	Regenerates YAML formatting.
`.github/workflows/__go-indirect-tracing-workaround-no-file-program.yml`	Regenerates YAML formatting.
`.github/workflows/__go-indirect-tracing-workaround-diagnostic.yml`	Regenerates YAML formatting.
`.github/workflows/__go-custom-queries.yml`	Regenerates YAML formatting.
`.github/workflows/__global-proxy.yml`	Regenerates YAML formatting.
`.github/workflows/__extractor-ram-threads.yml`	Regenerates YAML formatting.
`.github/workflows/__export-file-baseline-information.yml`	Regenerates YAML formatting.
`.github/workflows/__diagnostics-without-db.yml`	Regenerates YAML formatting.
`.github/workflows/__diagnostics-export.yml`	Regenerates YAML formatting.
`.github/workflows/__cpp-deptrace-enabled.yml`	Regenerates YAML formatting.
`.github/workflows/__cpp-deptrace-enabled-on-macos.yml`	Regenerates YAML formatting.
`.github/workflows/__cpp-deptrace-disabled.yml`	Regenerates YAML formatting.
`.github/workflows/__config-input.yml`	Regenerates YAML formatting.
`.github/workflows/__config-export.yml`	Regenerates YAML formatting.
`.github/workflows/__cleanup-db-cluster-dir.yml`	Regenerates YAML formatting.
`.github/workflows/__bundle-toolcache.yml`	Regenerates YAML formatting.
`.github/workflows/__bundle-from-toolcache.yml`	Regenerates YAML formatting.
`.github/workflows/__bundle-from-nightly.yml`	Regenerates YAML formatting.
`.github/workflows/__build-mode-rollback.yml`	Regenerates YAML formatting.
`.github/workflows/__build-mode-none.yml`	Regenerates YAML formatting.
`.github/workflows/__build-mode-manual.yml`	Regenerates YAML formatting.
`.github/workflows/__build-mode-autobuild.yml`	Regenerates YAML formatting.
`.github/workflows/__autobuild-working-dir.yml`	Regenerates YAML formatting.
`.github/workflows/__autobuild-direct-tracing-with-working-dir.yml`	Regenerates YAML formatting.
`.github/workflows/__autobuild-action.yml`	Regenerates YAML formatting.
`.github/workflows/__analyze-ref-input.yml`	Regenerates YAML formatting.
`.github/workflows/__analysis-kinds.yml`	Regenerates YAML formatting.
`.github/workflows/__all-platform-bundle.yml`	Regenerates YAML formatting.
`.github/ISSUE_TEMPLATE/config.yml`	Removes trailing whitespace.
`.github/actions/release-initialise/action.yml`	Normalizes formatting and quoting.
`.github/actions/release-branches/action.yml`	Normalizes manifest quoting.
`.github/actions/query-filter-test/action.yml`	Normalizes input spacing.
`.github/actions/check-codescanning-config/action.yml`	Normalizes indentation and quoting.
`.editorconfig`	Sets YAML indentation width.

_{Review effort: Balanced (auto)}

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

Comment thread

autobuild/action.yml Resolved

Uh oh!

There was an error while loading. Please reload this page.

Comment thread

init/action.yml Resolved

Uh oh!

There was an error while loading. Please reload this page.

Comment thread

resolve-environment/action.yml Resolved

Uh oh!

There was an error while loading. Please reload this page.

Comment thread

setup-codeql/action.yml Resolved

Uh oh!

There was an error while loading. Please reload this page.

Comment thread

upload-sarif/action.yml Resolved

Uh oh!

There was an error while loading. Please reload this page.

Comment thread

pr-checks/sync-back.ts

		// Assume that version numbers are consistent (this should be the case on a Dependabot update PR)
		actionVersions[actionName] = versionWithComment;
		// Record the version of the action for this workflow.
		actionVersionsByWorkflow[workflowName][actionName] = versionWithComment;

sam-robson added 2 commits

November 4, 2026 17:02


          chore: resolve merge conflicts in action.yml files

8f01efb


          Rebuild

5695bd7

github-actions Bot added the size/XXL May be extremely hard to review label

Nov 4, 2026

henrymercer approved these changes

Nov 4, 2026

View reviewed changes

sam-robson merged commit 9418214 into releases/v3

Nov 4, 2026

237 checks passed

Uh oh!

There was an error while loading. Please reload this page.

sam-robson deleted the backport-v3.39.3-33d7b85da branch

November 4, 2026 17:52

Reviewers

Copilot code review Copilot

Copilot review effort

Applies to this pull request for everyone.Learn more about Copilot code review.

Copilot left review comments

henrymercer

henrymercer approved these changes

Uh oh!

There was an error while loading. Please reload this page.

Assignees

sam-robson

Labels

size/XXL

May be extremely hard to review

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

4 participants

Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.

You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.

GeezerVison

Conversation

github-actions Bot commented Nov 4, 2026 • edited by sam-robson Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

github-actions Bot commented Nov 4, 2026 •

edited by sam-robson

Loading

Uh oh!

There was an error while loading. Please reload this page.