[DO NOT MERGE] v3.28.20

[koesie10]

This is a PR to review changes for the v3.28.20 backport release. It is based on v3.28.18 since that is the version that's currently scheduled to be released in GHES 3.18. v3.28.19 will not be included in GHES 3.18.

This includes changes from these PRs:

• Remove support for combining SARIF runs with non-unique categories #2959
• Unconditionally disable combining SARIF files for GHES 3.18 #2961
• Fix parsing of GHES pre-release versions #2969
• Ignore pre-release parts when comparing GHES versions #2972

[Copilot]

Pull Request Overview

This PR implements version 3.28.20 of the CodeQL Action, which adds functionality to disable combining SARIF files from a single upload for GHES 3.18 and later versions. The changes introduce a new feature flag system for controlling this behavior and update version-checking logic to handle pre-release versions correctly.

Key changes:

• Adds a new utility function satisfiesGHESVersion for improved GHES version comparison that handles pre-release versions
• Introduces the DisableCombineSarifFiles feature flag and corresponding logic to block SARIF file combining when appropriate
• Updates deprecation timeline from "June 4, 2025" to "July 2025" for removing SARIF combining support

Reviewed Changes

Copilot reviewed 10 out of 16 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
src/util.ts	Adds satisfiesGHESVersion utility function for enhanced GHES version comparison
src/upload-lib.ts	Implements SARIF combining restrictions with new feature flag and error handling
src/upload-lib.test.ts	Adds comprehensive tests for the new SARIF combining restrictions
src/feature-flags.ts	Defines the new DisableCombineSarifFiles feature flag configuration
package.json	Updates version from 3.28.18 to 3.28.20
CHANGELOG.md	Documents the removal of SARIF combining support for GHES 3.18

Comments suppressed due to low confidence (1)

src/util.ts:1143

• The parameter name ghesVersion in the function signature doesn't match the JSDoc description which refers to githubVersion. Consider renaming the parameter to githubVersion for consistency.

export function satisfiesGHESVersion(

[mbg]

This seems fine to me. You should be good to tag this and create a release based on that tag as planned.

[koesie10]

This release has been published: https://github.com/github/codeql-action/releases/tag/v3.28.20