Merge main into releases/v4 by github-actions[bot] · Pull Request #4053 · github/codeql-action

github-actions · 2026-07-29T14:38:02Z

Merging 9130ce0 into releases/v4.

Conductor for this PR is @oscarsj.

Contains the following pull requests:

Please do the following:

Ensure the CHANGELOG displays the correct version and date.
Ensure the CHANGELOG includes all relevant, user-facing changes since the last release.
Check that there are not any unexpected commits being merged into the releases/v4 branch.
Ensure the docs team is aware of any documentation changes that need to be released.
Approve running the full set of PR checks if you have not pushed any changes.
Approve and merge this PR. Make sure Create a merge commit is selected rather than Squash and merge or Rebase and merge.
Merge the mergeback PR that will automatically be created once this PR is merged.
Merge all backport PRs to older release branches, that will automatically be created once this PR is merged.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Mergeback v4.37.3 refs/heads/releases/v4 into main

…eProxyRequestOptions`

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

…stics Remove obsolete CodeQL setup diagnostics

Bumps the npm-minor group with 5 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@actions/cache](https://github.com/actions/toolkit/tree/HEAD/packages/cache) | `5.1.0` | `5.2.0` | | [eslint](https://github.com/eslint/eslint) | `9.39.4` | `9.39.5` | | [eslint-plugin-github](https://github.com/github/eslint-plugin-github) | `6.1.0` | `6.1.1` | | [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) | `8.63.0` | `8.64.0` | | [tsx](https://github.com/privatenumber/tsx) | `4.23.0` | `4.23.1` | Updates `@actions/cache` from 5.1.0 to 5.2.0 - [Changelog](https://github.com/actions/toolkit/blob/main/packages/cache/RELEASES.md) - [Commits](https://github.com/actions/toolkit/commits/HEAD/packages/cache) Updates `eslint` from 9.39.4 to 9.39.5 - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](eslint/eslint@v9.39.4...v9.39.5) Updates `eslint-plugin-github` from 6.1.0 to 6.1.1 - [Release notes](https://github.com/github/eslint-plugin-github/releases) - [Commits](github/eslint-plugin-github@v6.1.0...v6.1.1) Updates `typescript-eslint` from 8.63.0 to 8.64.0 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.64.0/packages/typescript-eslint) Updates `tsx` from 4.23.0 to 4.23.1 - [Release notes](https://github.com/privatenumber/tsx/releases) - [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs) - [Commits](privatenumber/tsx@v4.23.0...v4.23.1) --- updated-dependencies: - dependency-name: "@actions/cache" dependency-version: 5.2.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-minor - dependency-name: eslint dependency-version: 9.39.5 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-minor - dependency-name: eslint-plugin-github dependency-version: 6.1.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-minor - dependency-name: typescript-eslint dependency-version: 8.64.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-minor - dependency-name: tsx dependency-version: 4.23.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-minor ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps the actions-minor group with 3 updates in the /.github/workflows directory: [actions/checkout](https://github.com/actions/checkout), [actions/setup-java](https://github.com/actions/setup-java) and [ruby/setup-ruby](https://github.com/ruby/setup-ruby). Updates `actions/checkout` from 7.0.0 to 7.0.1 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@9c091bb...3d3c42e) Updates `actions/setup-java` from 5.5.0 to 5.6.0 - [Release notes](https://github.com/actions/setup-java/releases) - [Commits](actions/setup-java@0f481fc...03ad4de) Updates `ruby/setup-ruby` from 1.316.0 to 1.319.0 - [Release notes](https://github.com/ruby/setup-ruby/releases) - [Changelog](https://github.com/ruby/setup-ruby/blob/master/release.rb) - [Commits](ruby/setup-ruby@d45b1a4...003a5c4) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions-minor - dependency-name: actions/setup-java dependency-version: 5.6.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-minor - dependency-name: ruby/setup-ruby dependency-version: 1.319.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-minor ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [actions/setup-python](https://github.com/actions/setup-python) from 6.3.0 to 7.0.0. - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](actions/setup-python@ece7cb0...5fda3b9) --- updated-dependencies: - dependency-name: actions/setup-python dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [actions/setup-go](https://github.com/actions/setup-go) from 6.5.0 to 7.0.0. - [Release notes](https://github.com/actions/setup-go/releases) - [Commits](actions/setup-go@924ae3a...b7ad1da) --- updated-dependencies: - dependency-name: actions/setup-go dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [actions/setup-dotnet](https://github.com/actions/setup-dotnet) from 5.4.0 to 6.0.0. - [Release notes](https://github.com/actions/setup-dotnet/releases) - [Commits](actions/setup-dotnet@26b0ec1...a98b568) --- updated-dependencies: - dependency-name: actions/setup-dotnet dependency-version: 6.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>

There is no more (non-test) Python code left to analyse, so CodeQL analysis would fail now

… in `src/util.ts` dependencies

Add repository property for `tools` input

Promote `AllowToolcacheInput` feature

Co-authored-by: Mads Navntoft <navntoft@github.com>

Ignore configuration file repo property for unsupported analysis kinds

Convert last remaining Python CI scripts to TypeScript

Update default bundle to 2.26.2

henrymercerand others added 30 commits July 20, 2026 17:57

Remove Zstandard availability diagnostic
d57cc91
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Remove bundle download diagnostic
3f208c9
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Remove Git version diagnostic
14e8bf9
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Format CodeQL initialization
1040e2a
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Remove unused bundle download fields
3c20a74
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Update changelog and version after v4.37.3
7248c38

Rebuild
15e2f31

Bump js-yaml and brace-expansion
e8e914f

Merge pull request#4032from github/mergeback/v4.37.3-to-main-e4fba868
0c76f63
Mergeback v4.37.3 refs/heads/releases/v4 into main

Base custom request options on defaults, and add basic tests for `mak…
909828c
…eProxyRequestOptions`

Only allow traffic via the proxy in global-proxy test
84ae30d

Set other proxy env vars
a2bfb64

Preserve bundle compression coverage
f342ca9
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Strengthen download status report tests
90ea144
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Add github-codeql-tools property
009715d

Add FF for tools repository property
1f57eb0

Move loadRepositoryProperties to properties.ts
f58d696

Load repository properties in setup-codeql action
3479f3f

Add and use getToolsInput
49f2e37

Check log messages in tests
32ed58d

Exclude Copilot review from required checks
60339ed
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Rename to ComputedInput
be24c11

Include computed tools value in computed_inputs
f9442c4

Merge pull request#4036from github/henrymercer/remove-legacy-diagno…
1b0d271
…stics Remove obsolete CodeQL setup diagnostics

Rebuild
f6ed33c

mbgand others added 23 commits July 24, 2026 16:05

Update extractChangelogSnippet to use parseChangelog
c5d6212

Add bundle-changelog.ts with tests
66a6f42

Use bundle-changelog.ts and remove Python version
027ac05

Add rollback-changelog.ts with tests
d714617

Use rollback-changelog.ts and remove Python version
961b583

Remove python from CodeQL workflow
ab44eb9
There is no more (non-test) Python code left to analyse, so CodeQL analysis would fail now

Remove Python-specific steps from workflows that no longer need them
cbad145

Add getErrorMessage to pr-checks-local util.ts to avoid pulling…
0953dc0
… in `src/util.ts` dependencies

Merge pull request#4037from github/mbg/repo-props/tools
4c0a1f0
Add repository property for `tools` input

Fix checking keys rather than values
f00f809

Install JS deps if needed in post-release-mergeback workflow
74b15aa

Promote AllowToolcacheInput feature
3013ac0

Merge pull request#4044from github/mbg/ff/promote-toolcache
3434fbb
Promote `AllowToolcacheInput` feature

Move config-file computation after determining the analysisKinds
2a8731c

Ignore repository property for unsupported analysis kinds
8289a49

Fix argument validation in rollback-changelog.ts
98c05a1
Co-authored-by: Mads Navntoft <navntoft@github.com>

Log !analysisKindSupported case
2d4c474

Merge pull request#4046from github/mbg/repo-prop/code-quality
7e8d897
Ignore configuration file repo property for unsupported analysis kinds

Merge pull request#4043from github/mbg/ts/changelog
18420e3
Convert last remaining Python CI scripts to TypeScript

Update default bundle to codeql-bundle-v2.26.2
da0c190

Add changelog note
c62d824

Merge pull request#4051from github/update-bundle/codeql-bundle-v2.26.2
9130ce0
Update default bundle to 2.26.2

Update changelog for v4.37.4
e40d079

github-actionsBot requested a review from a team as a code owner July 29, 2026 14:38

github-actionsBot assigned oscarsj Jul 29, 2026

github-actionsBot added the size/XXL May be extremely hard to review label Jul 30, 2026

oscarsj approved these changes Jul 30, 2026
View reviewed changes

oscarsj merged commit f205ea1 into releases/v4Jul 30, 2026
219 checks passed

oscarsj deleted the update-v4.37.4-9130ce0f7 branch July 30, 2026 09:19

github-actionsBot mentioned this pull request Jul 30, 2026
Merge releases/v4 into releases/v3 #4058
Merged
10 tasks

Navigation Menu

Uh oh!

Merge main into releases/v4 - #4053

Merge main into releases/v4#4053
oscarsj merged 76 commits into
releases/v4from
update-v4.37.4-9130ce0f7

github-actionsBot commented Jul 29, 2026•
edited by oscarsj
Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

github-actionsBot commented Jul 29, 2026• edited by oscarsj Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

github-actionsBot commented Jul 29, 2026•
edited by oscarsj
Loading