Merge main into releases/v4 by github-actions[bot] · Pull Request #3235 · github/codeql-action

github-actions · 2025-10-24T16:35:22Z

Merging 1d36546 into releases/v4.

Conductor for this PR is @mbg.

Contains the following pull requests:

Please do the following:

Ensure the CHANGELOG displays the correct version and date.
Ensure the CHANGELOG includes all relevant, user-facing changes since the last release.
Check that there are not any unexpected commits being merged into the releases/v4 branch.
Ensure the docs team is aware of any documentation changes that need to be released.
Mark the PR as ready for review to trigger the full set of PR checks.
Approve and merge this PR. Make sure Create a merge commit is selected rather than Squash and merge or Rebase and merge.
Merge the mergeback PR that will automatically be created once this PR is merged.
Merge all backport PRs to older release branches, that will automatically be created once this PR is merged.

- Throws a `ConfigurationError` if parsing the YAML fails - Add a couple of tests for it

Mergeback v4.30.9 refs/heads/releases/v4 into main

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Co-authored-by: Michael B. Gale <mbg@github.com>

Add experimental functionality for labelling PRs by their size

Bumps the npm-minor group with 5 updates: | Package | From | To | | --- | --- | --- | | [octokit](https://github.com/octokit/octokit.js) | `5.0.3` | `5.0.4` | | [@eslint/js](https://github.com/eslint/eslint/tree/HEAD/packages/js) | `9.37.0` | `9.38.0` | | [@typescript-eslint/eslint-plugin](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin) | `8.46.0` | `8.46.1` | | [@typescript-eslint/parser](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser) | `8.46.0` | `8.46.1` | | [esbuild](https://github.com/evanw/esbuild) | `0.25.10` | `0.25.11` | Updates `octokit` from 5.0.3 to 5.0.4 - [Release notes](https://github.com/octokit/octokit.js/releases) - [Commits](octokit/octokit.js@v5.0.3...v5.0.4) Updates `@eslint/js` from 9.37.0 to 9.38.0 - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](https://github.com/eslint/eslint/commits/v9.38.0/packages/js) Updates `@typescript-eslint/eslint-plugin` from 8.46.0 to 8.46.1 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/eslint-plugin/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.46.1/packages/eslint-plugin) Updates `@typescript-eslint/parser` from 8.46.0 to 8.46.1 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/parser/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.46.1/packages/parser) Updates `esbuild` from 0.25.10 to 0.25.11 - [Release notes](https://github.com/evanw/esbuild/releases) - [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG.md) - [Commits](evanw/esbuild@v0.25.10...v0.25.11) --- updated-dependencies: - dependency-name: octokit dependency-version: 5.0.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-minor - dependency-name: "@eslint/js" dependency-version: 9.38.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-minor - dependency-name: "@typescript-eslint/eslint-plugin" dependency-version: 8.46.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-minor - dependency-name: "@typescript-eslint/parser" dependency-version: 8.46.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-minor - dependency-name: esbuild dependency-version: 0.25.11 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-minor ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [actions/setup-node](https://github.com/actions/setup-node) from 5 to 6. - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](actions/setup-node@v5...v6) --- updated-dependencies: - dependency-name: actions/setup-node dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>

…thub/workflows/actions/setup-node-6 Bump actions/setup-node from 5 to 6 in /.github/workflows

…r-5ed6ededba Bump the npm-minor group with 5 updates

Handle user errors for invalid `UserConfig`s and missing query files

Bump timeout for `analyze-action-env` test

Update wording in some log messages

…rocess

…-limit Overlay: Lower size limit for overlay base databases

Perform SARIF post-processing independently of upload

Also add tests for it and `getRequiredEnvParam`

Bump minimum CodeQL Bundle version to 2.17.6

Add `getOptionalEnvVar` helper

Add changelog entry for post-processing change

Copilot

Pull Request Overview

This is a release PR merging changes from main into releases/v4 for version 4.31.0. The PR includes multiple merged pull requests that implement improvements to SARIF file processing, error handling, dependency updates, and various code quality enhancements.

Key changes:

Bumped minimum CodeQL bundle version from 2.16.6 to 2.17.6
Refactored SARIF upload logic to always perform post-processing, even when uploads are disabled
Added new post-processed-sarif-path input to the analyze action for saving post-processed SARIF files

Reviewed Changes

Copilot reviewed 63 out of 66 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
package.json	Version bump to 4.31.0 and dependency updates
CHANGELOG.md	Release notes for version 4.31.0
src/upload-sarif.ts	Renamed function and added post-processing support with upload kind parameter
src/upload-lib.ts	Refactored to separate post-processing from upload logic
src/analyze-action.ts	Updated to use new upload architecture with conditional upload
src/util.ts	Added `asHTTPError` helper and `getOptionalEnvVar` function
src/codeql.ts	Bumped minimum CodeQL version constant
src/workflow.ts, src/tar.ts, etc.	Applied optional chaining improvements
analyze/action.yml	Added new `post-processed-sarif-path` input
.github/workflows/*.yml	Updated setup-node action from v5 to v6
lib/*.js	Generated JavaScript from TypeScript sources

mbg and others added 30 commits October 14, 2025 19:49

Use uploadSarif rather than uploadFiles in analyze action

2ade8a0

Add and use parseUserConfig

66df0bc

- Throws a `ConfigurationError` if parsing the YAML fails - Add a couple of tests for it

Add and validate UserConfig schema

ac922ab

Add additional regex to CliConfigErrorCategory.PackCannotBeFound

4f14649

Add checkExpectedLogMessages function to testing-utils

913cd47

Log validation errors

0822fb1

Include first 10 errors in exception message

d7a8ae5

Add FF for config validation

2c8f489

Make schema for QueryFilter less strict

9ce56a2

Update changelog and version after v4.30.9

b03dcd5

Rebuild

aa0f6ea

Merge pull request #3215 from github/mergeback/v4.30.9-to-main-16140ae1

d88a554

Mergeback v4.30.9 refs/heads/releases/v4 into main

Handle HTTP errors with httpStatusCode property

c64c407

Wrap API configuration errors when setting up CodeQL

a6b9514

Add experimental functionality for labelling PRs by their size

8c324fe

Update workflow name

519594f

Update .github/sizeup.yml

08e53be

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Add score for XL

f2f52d0

Bump sizes a bit

c13672e

Comment version that is pinned

e9daf5b

Co-authored-by: Michael B. Gale <mbg@github.com>

Merge pull request #3218 from github/henrymercer/pr-sizes

6562050

Add experimental functionality for labelling PRs by their size

Rebuild

2357c43

Rebuild

06f31ec

Merge pull request #3220 from github/dependabot/github_actions/dot-gi…

bee06ec

…thub/workflows/actions/setup-node-6 Bump actions/setup-node from 5 to 6 in /.github/workflows

Merge pull request #3219 from github/dependabot/npm_and_yarn/npm-mino…

ffed63a

…r-5ed6ededba Bump the npm-minor group with 5 updates

Merge pull request #3203 from github/mbg/errors/more-user-errors

9b0ac1c

Handle user errors for invalid `UserConfig`s and missing query files

Require message field too

40e2646

Simplify API error checks

e6e649a

mbg and others added 19 commits October 23, 2025 13:34

Fix fallback not being guarded by uploadKind check

f48b54a

Bump timeout for analyze-action-env test

8376af2

Bump timeout for analyze-action-input test

da64a41

Merge pull request #3228 from github/mbg/test/timeout

1c3c806

Bump timeout for `analyze-action-env` test

Merge branch 'main' into mbg/permission-warning

690d276

Merge pull request #3227 from github/mbg/permission-warning

9625890

Update wording in some log messages

Overlay: Lower size limit for overlay base databases

22d29ca

Merge remote-tracking branch 'origin/main' into mbg/upload-lib/post-p…

b9cd368

…rocess

Merge pull request #3231 from github/kaspersv/lower-overlay-base-size…

956c567

…-limit Overlay: Lower size limit for overlay base databases

Consistently use "post-processing"

f0452d5

Check that outputPath is non-empty

710606c

Merge pull request #3222 from github/mbg/upload-lib/post-process

d75645b

Perform SARIF post-processing independently of upload

Add getOptionalEnvVar function

ad35676

Also add tests for it and `getRequiredEnvParam`

Merge pull request #3223 from github/henrymercer/bump-minimum

e576807

Bump minimum CodeQL Bundle version to 2.17.6

Use getOptionalEnvVar in writePostProcessedFiles

1ecd563

Merge pull request #3233 from github/mbg/getOptionalEnvVar

b843cbe

Add `getOptionalEnvVar` helper

Add changelog entry for post-processing change

08ada26

Merge pull request #3234 from github/mbg/changelog/post-processing

1d36546

Add changelog entry for post-processing change

Update changelog for v4.31.0

8f11182

github-actions bot assigned mbg Oct 24, 2025

github-actions bot added the size/XXL May be extremely hard to review label Oct 24, 2025

mbg marked this pull request as ready for review October 24, 2025 16:51

mbg requested a review from a team as a code owner October 24, 2025 16:51

Copilot AI review requested due to automatic review settings October 24, 2025 16:51

Copilot AI reviewed Oct 24, 2025

View reviewed changes

mbg approved these changes Oct 24, 2025

View reviewed changes

mbg enabled auto-merge October 24, 2025 17:05

mbg merged commit 4e94bd1 into releases/v4 Oct 24, 2025
242 checks passed

mbg deleted the update-v4.31.0-1d36546c1 branch October 24, 2025 17:08

github-actions bot mentioned this pull request Oct 24, 2025

Merge releases/v4 into releases/v3 #3237

Merged

8 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Merge main into releases/v4#3235

Merge main into releases/v4#3235
mbg merged 84 commits intoreleases/v4from
update-v4.31.0-1d36546c1

github-actions bot commented Oct 24, 2025 •

edited by mbg

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

github-actions bot commented Oct 24, 2025 • edited by mbg Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

github-actions bot commented Oct 24, 2025 •

edited by mbg

Loading