Skip to content

Sak code ql - #4127

Closed
beer-sakthai wants to merge 614 commits into
github:update-v4.36.3-628fc3f12from
beer-sakthai:Sak-CodeQL
Closed

Sak code ql#4127
beer-sakthai wants to merge 614 commits into
github:update-v4.36.3-628fc3f12from
beer-sakthai:Sak-CodeQL

Conversation

@beer-sakthai

@beer-sakthai beer-sakthai commented Sep 7, 2026

Copy link
Copy Markdown

Risk assessment

For internal use only. Please select the risk level of this change:

  • Low risk: Changes are fully under feature flags, or have been fully tested and validated in pre-production environments and are highly observable, or are documentation or test only.
  • High risk: Changes are not fully under feature flags, have limited visibility and/or cannot be tested outside of production.

Which use cases does this change impact?

Workflow types:

  • Advanced setup - Impacts users who have custom CodeQL workflows.
  • Managed - Impacts users with dynamic workflows (Default Setup, Code Quality, ...).

Products:

  • Code Scanning - The changes impact analyses when analysis-kinds: code-scanning.
  • Code Quality - The changes impact analyses when analysis-kinds: code-quality.
  • Other first-party - The changes impact other first-party analyses.
  • Third-party analyses - The changes affect the upload-sarif action.

Environments:

  • Dotcom - Impacts CodeQL workflows on github.com and/or GitHub Enterprise Cloud with Data Residency.
  • GHES - Impacts CodeQL workflows on GitHub Enterprise Server.
  • Testing/None - This change does not impact any CodeQL workflows in production.

How did/will you validate this change?

  • Test repository - This change will be tested on a test repository before merging.
  • Unit tests - I am depending on unit test coverage (i.e. tests in .test.ts files).
  • End-to-end tests - I am depending on PR checks (i.e. tests in pr-checks).
  • Other - Please provide details.
  • None - I am not validating these changes.

If something goes wrong after this change is released, what are the mitigation and rollback strategies?

  • Feature flags - All new or changed code paths can be fully disabled with corresponding feature flags.
  • Rollback - Change can only be disabled by rolling back the release or releasing a new version with a fix.
  • Development/testing only - This change cannot cause any failures in production.
  • Other - Please provide details.

How will you know if something goes wrong after this change is released?

  • Telemetry - I rely on existing telemetry or have made changes to the telemetry.
    • Dashboards - I will watch relevant dashboards for issues after the release. Consider whether this requires this change to be released at a particular time rather than as part of a regular release.
    • Alerts - New or existing monitors will trip if something goes wrong with this change.
  • Other - Please provide details.

Are there any special considerations for merging or releasing this change?

  • No special considerations - This change can be merged at any time.
  • Special considerations - This change should only be merged once certain preconditions are met. Please provide details of those or link to this PR from an internal issue.

Merge / deployment checklist

  • Confirm this change is backwards compatible with existing workflows.
  • Consider adding a changelog entry for this change.
  • Confirm the readme and docs have been updated if necessary.

mbg and others added 30 commits July 24, 2026 16:05
@mbg
Update extractChangelogSnippet to use parseChangelog
c5d6212
@mbg
Add bundle-changelog.ts with tests
66a6f42
@mbg
Use bundle-changelog.ts and remove Python version
027ac05
@mbg
Add rollback-changelog.ts with tests
d714617
@mbg
Use rollback-changelog.ts and remove Python version
961b583
@mbg
Remove python from CodeQL workflow
ab44eb9 
There is no more (non-test) Python code left to analyse, so CodeQL analysis would fail now
@mbg
Remove Python-specific steps from workflows that no longer need them
cbad145
@mbg
Add getErrorMessage to pr-checks-local util.ts to avoid pulling…
0953dc0 
… in `src/util.ts` dependencies
@mbg
Merge pull request github#4037 from github/mbg/repo-props/tools
4c0a1f0 
Add repository property for `tools` input
@mbg
Fix checking keys rather than values
f00f809
@mbg
Install JS deps if needed in post-release-mergeback workflow
74b15aa
@mbg
Promote AllowToolcacheInput feature
3013ac0
@mbg
Merge pull request github#4044 from github/mbg/ff/promote-toolcache
3434fbb 
Promote `AllowToolcacheInput` feature
@mbg
Move config-file computation after determining the analysisKinds
2a8731c
@mbg
Ignore repository property for unsupported analysis kinds
8289a49
@mbg @navntoft
Fix argument validation in rollback-changelog.ts
98c05a1 
Co-authored-by: Mads Navntoft <navntoft@github.com>
@mbg
Log !analysisKindSupported case
2d4c474
@mbg
Merge pull request github#4046 from github/mbg/repo-prop/code-quality
7e8d897 
Ignore configuration file repo property for unsupported analysis kinds
@mbg
Merge pull request github#4043 from github/mbg/ts/changelog
18420e3 
Convert last remaining Python CI scripts to TypeScript
@mbg
Refactor jobRunUuid init into a function
1f9caf0 
Use in `init` and `setup-codeql` actions
@mbg
Make ActionState available and add test
c7ae51b
@mbg
Allow getJobUUID to retrieve the UUID from the environment
049af32
@mbg
Call getJobUUID in start-proxy
766928d 
The `start-proxy` step precedes `init` in Default Setup
@mbg
Add getRequiredInput to ActionsEnv
e9831f7
@mbg
Add exportVariable to ActionsEnv
60834a0
@mbg
Test that getJobUUID calls exportVariable
e28cbac
@mbg
Add a test for invalid values
94a12eb
@mbg
Use getEnv()
2e25107
@mbg
Move registry_types to StatusReportBase
de57c4a
@mbg
Include registry_types whenever CODEQL_PROXY_URLS is set
aac07d2
dependabot Bot and others added 25 commits September 2, 2026 17:54
@dependabot
Bump the npm-minor group across 1 directory with 2 updates
da21771 
Bumps the npm-minor group with 2 updates in the / directory: [js-yaml](https://github.com/nodeca/js-yaml) and [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint).


Updates `js-yaml` from 5.3.0 to 5.4.0
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](nodeca/js-yaml@5.3.0...5.4.0)

Updates `typescript-eslint` from 8.67.0 to 8.68.0
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.68.0/packages/typescript-eslint)

---
updated-dependencies:
- dependency-name: js-yaml
  dependency-version: 5.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor
- dependency-name: typescript-eslint
  dependency-version: 8.68.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
Bump eslint-plugin-jsdoc from 62.9.0 to 64.2.1
2a03009 
Bumps [eslint-plugin-jsdoc](https://github.com/gajus/eslint-plugin-jsdoc) from 62.9.0 to 64.2.1.
- [Release notes](https://github.com/gajus/eslint-plugin-jsdoc/releases)
- [Commits](gajus/eslint-plugin-jsdoc@v62.9.0...v64.2.1)

---
updated-dependencies:
- dependency-name: eslint-plugin-jsdoc
  dependency-version: 64.2.1
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@github-actions
Rebuild
b724a86
@redsun82
Merge pull request github#4072 from github/redsun82-linux-arm64-support
4cccb3a 
Add support for Linux Arm64 runners
@mbg
Merge branch 'main' into dependabot/npm_and_yarn/eslint-plugin-jsdoc-…
20ec60c 
…64.2.1
@mbg
Merge pull request github#4120 from github/dependabot/npm_and_yarn/es…
9509fd0 
…lint-plugin-jsdoc-64.2.1

Bump eslint-plugin-jsdoc from 62.9.0 to 64.2.1
@mbg
Merge branch 'main' into dependabot/npm_and_yarn/npm-minor-21ac56865f
25da1b1
@mbg
Merge branch 'main' into dependabot/npm_and_yarn/browserslist-4.28.8
3ee8a93
@mbg
Merge pull request github#4118 from github/dependabot/npm_and_yarn/br…
9401a33 
…owserslist-4.28.8

Bump browserslist from 4.24.2 to 4.28.8
@mbg
Merge pull request github#4119 from github/dependabot/npm_and_yarn/np…
1024994 
…m-minor-21ac56865f

Bump the npm-minor group across 1 directory with 2 updates
@mbg
Merge pull request github#4111 from github/dependabot/github_actions/…
5914b03 
…dot-github/workflows/actions/setup-java-6.0.0

Bump actions/setup-java from 5.7.0 to 6.0.0 in /.github/workflows
@henrymercer
Add an internal job-status input to the init Action
2f3c1c9 
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
@henrymercer
Don't record an overlay status when the job was cancelled
38dd4a0 
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
@redsun82
Address review comments
36cbf13 
- Analyze all languages CodeQL supports on Linux Arm64 (except Swift,
  which is macOS only) in the Linux Arm64 check, building the compiled
  ones via the shared multi-language-repo build.sh
- De-duplicate the check's language list via a shared LANGUAGES env var
  used by both the init input and the assert loop
- Fix CHANGELOG tense: "download" -> "downloads"

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
@henrymercer
Merge pull request github#4088 from github/dependabot/npm_and_yarn/oc…
9fddc16 
…tokit/plugin-rest-endpoint-methods-18.0.0

Bump @octokit/plugin-rest-endpoint-methods from 17.0.0 to 18.0.0
@redsun82
Log found databases in Linux Arm64 check
16da747 
Log a success line for each language database found in the Linux Arm64 PR check.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
@henrymercer
Don't upload the ESLint SARIF from merge queue refs
d2fe508 
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
@henrymercer
Read the job status from a ReadOnlyEnv in recordOverlayStatus
657964c 
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
@henrymercer
Record an overlay status only for conclusive job statuses
a48f2d3 
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
@henrymercer
Merge pull request github#4125 from github/henrymercer/merge-queue-sa…
e06b60f 
…rif-upload-flake

Don't upload the ESLint SARIF from merge queue refs
@henrymercer
Merge pull request github#4123 from github/redsun82-address-pr-4072-c…
46dfb14 
…omments

Analyze all supported languages in the Linux Arm64 check
@henrymercer
Merge pull request github#4122 from github/henrymercer/friendly-potato
313a0b9 
Don't record an overlay status when the job was cancelled
beer-sakthai
chore: add repository maintainer skill
2bcac7e
@beer-sakthai
Merge pull request #4 from beer-sakthai/manus/add-codeql-maintainer-s…
40ea573 
…kill

chore: add codeql-action maintainer skill
@beer-sakthai
Merge branch 'main' into Sak-CodeQL
9d0eaf1
@beer-sakthai
beer-sakthai requested a review from a team as a code owner September 7, 2026 22:34
@mbg

mbg commented Sep 8, 2026

Copy link
Copy Markdown
Member

Hi @beer-sakthai,

Thanks for your interest in this project. If you'd like to contribute, please make sure that you read the CONTRIBUTION guidelines and, in particular, make sure that your pull requests have a clear title, description, and scope.

I will close this PR since it doesn't meet those criteria.

@mbg mbg closed this Sep 8, 2026
@beer-sakthai
beer-sakthai deleted the Sak-CodeQL branch September 8, 2026 14:52
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

9 participants

@beer-sakthai @mbg @oscarsj @sam-robson @henrymercer @redsun82 @mario-campos @navntoft @claude