Merge main into releases/v3 #3012

github-actions · 2025-08-07T14:45:56Z

Merging 67a6ea7 into releases/v3.

Conductor for this PR is @cklin.

Contains the following pull requests:

Please do the following:

Ensure the CHANGELOG displays the correct version and date.
Ensure the CHANGELOG includes all relevant, user-facing changes since the last release.
Check that there are not any unexpected commits being merged into the releases/v3 branch.
Ensure the docs team is aware of any documentation changes that need to be released.
Mark the PR as ready for review to trigger the full set of PR checks.
Approve and merge this PR. Make sure Create a merge commit is selected rather than Squash and merge or Rebase and merge.
Merge the mergeback PR that will automatically be created once this PR is merged.
Merge all backport PRs to older release branches, that will automatically be created once this PR is merged.

Bumps the actions group with 1 update: [ruby/setup-ruby](https://github.com/ruby/setup-ruby). Updates `ruby/setup-ruby` from 1.247.0 to 1.253.0 - [Release notes](https://github.com/ruby/setup-ruby/releases) - [Changelog](https://github.com/ruby/setup-ruby/blob/master/release.rb) - [Commits](ruby/setup-ruby@4727905...bb6434c) --- updated-dependencies: - dependency-name: ruby/setup-ruby dependency-version: 1.253.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions ... Signed-off-by: dependabot[bot] <support@github.com>

Mergeback v3.29.5 refs/heads/releases/v3 into main

…s-010b5c0fb1 Bump ruby/setup-ruby from 1.247.0 to 1.253.0 in the actions group

* Bump form-data from 2.5.1 to 2.5.5 in the npm_and_yarn group Bumps the npm_and_yarn group with 1 update: [form-data](https://github.com/form-data/form-data). Updates `form-data` from 2.5.1 to 2.5.5 - [Release notes](https://github.com/form-data/form-data/releases) - [Changelog](https://github.com/form-data/form-data/blob/v2.5.5/CHANGELOG.md) - [Commits](form-data/form-data@v2.5.1...v2.5.5) --- updated-dependencies: - dependency-name: form-data dependency-version: 2.5.5 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com> * Update checked-in dependencies --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Michael B. Gale <mbg@github.com>

…sarif-files-ff Remove `disable_combine_sarif_files` feature flag

Bumps the npm group with 5 updates: | Package | From | To | | --- | --- | --- | | [follow-redirects](https://github.com/follow-redirects/follow-redirects) | `1.15.9` | `1.15.11` | | [@typescript-eslint/eslint-plugin](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin) | `8.38.0` | `8.39.0` | | [@typescript-eslint/parser](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser) | `8.38.0` | `8.39.0` | | [nock](https://github.com/nock/nock) | `14.0.7` | `14.0.8` | | [typescript](https://github.com/microsoft/TypeScript) | `5.8.3` | `5.9.2` | Updates `follow-redirects` from 1.15.9 to 1.15.11 - [Release notes](https://github.com/follow-redirects/follow-redirects/releases) - [Commits](follow-redirects/follow-redirects@v1.15.9...v1.15.11) Updates `@typescript-eslint/eslint-plugin` from 8.38.0 to 8.39.0 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/eslint-plugin/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.39.0/packages/eslint-plugin) Updates `@typescript-eslint/parser` from 8.38.0 to 8.39.0 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/parser/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.39.0/packages/parser) Updates `nock` from 14.0.7 to 14.0.8 - [Release notes](https://github.com/nock/nock/releases) - [Changelog](https://github.com/nock/nock/blob/main/CHANGELOG.md) - [Commits](nock/nock@v14.0.7...v14.0.8) Updates `typescript` from 5.8.3 to 5.9.2 - [Release notes](https://github.com/microsoft/TypeScript/releases) - [Changelog](https://github.com/microsoft/TypeScript/blob/main/azure-pipelines.release-publish.yml) - [Commits](microsoft/TypeScript@v5.8.3...v5.9.2) --- updated-dependencies: - dependency-name: follow-redirects dependency-version: 1.15.11 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm - dependency-name: "@typescript-eslint/eslint-plugin" dependency-version: 8.39.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm - dependency-name: "@typescript-eslint/parser" dependency-version: 8.39.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm - dependency-name: nock dependency-version: 14.0.8 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm - dependency-name: typescript dependency-version: 5.9.2 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps the actions group with 1 update: [ruby/setup-ruby](https://github.com/ruby/setup-ruby). Updates `ruby/setup-ruby` from 1.253.0 to 1.254.0 - [Release notes](https://github.com/ruby/setup-ruby/releases) - [Changelog](https://github.com/ruby/setup-ruby/blob/master/release.rb) - [Commits](ruby/setup-ruby@bb6434c...2a7b300) --- updated-dependencies: - dependency-name: ruby/setup-ruby dependency-version: 1.254.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions ... Signed-off-by: dependabot[bot] <support@github.com>

…s-f69d1f6078 Bump ruby/setup-ruby from 1.253.0 to 1.254.0 in the actions group

…c8ab2f Bump the npm group with 5 updates

Update default bundle to 2.22.3

Tests were added with copilot, and uncovered a bug where one of the regexps looking for `[autobuild]` was not escaping the square brackets.

…yarn-5a0513363d Bump tmp from 0.2.3 to 0.2.4 in the npm_and_yarn group

Rewrite legacy SARIF categories for CQ

Support auto-detecting Actions workflows

Make all errors on an unsupported platform `ConfigurationError`s

Clean up the database if it will be uploaded

Copilot

Pull Request Overview

This is a release preparation PR merging main into releases/v3. The primary purpose is to merge accumulated changes from multiple pull requests into the v3 release branch, including deprecating the cleanup-level input, updating the default CodeQL bundle version, and various code quality improvements.

Key Changes:

Deprecated the cleanup-level input to the analyze action and automated database cleanup management
Updated default CodeQL bundle version from 2.22.2 to 2.22.3
Refactored language handling to use dynamic language resolution from CodeQL CLI instead of hardcoded language lists

Reviewed Changes

Copilot reviewed 39 out of 464 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
lib/util.js	Added async utility functions and removed String() wrappers from environment variable exports
lib/upload-sarif-action.js	Added category fixing for code quality uploads
lib/upload-lib.test.js	Removed feature flag parameter from test function calls
lib/upload-lib.js	Removed feature flag dependency for SARIF file combining logic
lib/tracer-config.js	Updated to use async language checking instead of hardcoded language lists
lib/languages.js	Simplified to only export KnownLanguage enum, removing parsing and type checking functions
lib/analyze-action.js	Removed cleanup-level input handling and automated database cleanup
lib/codeql.js	Added language type checking methods and updated database cleanup to work on clusters
lib/actions-util.js	Added code quality category mapping functionality
lib/defaults.json	Updated CodeQL bundle version to 2.22.3
analyze/action.yml	Deprecated cleanup-level input with updated description
CHANGELOG.md	Added entry for version 3.29.6 with deprecation notice and version update

Copilot · 2025-08-07T14:52:46Z

lib/util.js

+async function asyncSome(array, predicate) {
+    const results = await Promise.all(array.map(predicate));
+    return results.some((result) => result);
+}


The new asyncFilter and asyncSome utility functions lack JSDoc documentation. These functions should have documentation explaining their purpose, parameters, return values, and usage examples since they are exported from the util module.

Copilot · 2025-08-07T14:52:47Z

lib/setup-codeql.js

@@ -160,7 +160,7 @@ function tryGetBundleVersionFromTagName(tagName, logger) {
 }
 function tryGetTagNameFromUrl(url, logger) {
    const matches = [...url.matchAll(/\/(codeql-bundle-[^/]*)\//g)];
-    if (!matches.length) {
+    if (matches.length === 0) {


[nitpick] Using matches.length === 0 is more explicit and clearer than the original !matches.length. This change improves code readability by making the intent more obvious.

Copilot · 2025-08-07T14:52:47Z

lib/codeql.js

-                ...getExtraOptionsFromEnv(["database", "cleanup"]),
-            ];
-            await runCli(cmd, codeqlArgs);
+            for (const language of config.languages) {


The databaseCleanupCluster method now processes languages sequentially with for...of. If cleanup operations are independent, consider using Promise.all() to process them in parallel for better performance.

Suggested change

for (const language of config.languages) {

await Promise.all(config.languages.map(async (language) => {

Copilot · 2025-08-07T14:52:47Z

lib/init.js

@@ -98,7 +98,7 @@ function cleanupDatabaseClusterDirectory(config, logger,
 rmSync = fs.rmSync) {
    if (fs.existsSync(config.dbLocation) &&
        (fs.statSync(config.dbLocation).isFile() ||
-            fs.readdirSync(config.dbLocation).length)) {
+            fs.readdirSync(config.dbLocation).length > 0)) {


[nitpick] Using .length > 0 instead of .length makes the boolean intent more explicit and consistent with the style change seen elsewhere in the codebase.

Copilot · 2025-08-07T14:52:48Z

lib/upload-lib.js

@@ -394,7 +387,7 @@ function validateSarifFileSchema(sarif, sarifFilePath, logger) {
    for (const warning of warnings) {
        logger.info(`Warning: '${warning.instance}' is not a valid URI in '${warning.property}'.`);
    }
-    if (errors.length) {
+    if (errors.length > 0) {


[nitpick] Using errors.length > 0 instead of errors.length makes the boolean intent more explicit and consistent with the style improvements throughout the codebase.

Suggested change

if (errors.length > 0) {

if (errors.length) {

henrymercer and others added 30 commits May 30, 2025 17:58

Remove per-language hardcoded traced/scanned info

3b57965

Clarify meaning of Language enum

fa0b6ff

Use CodeQL CLI to parse languages

e303175

Rename Language enum and use generic Language where possible

932be8f

Rust: Set experimental features variable before language parsing

1d22e83

Fix early return for no autobuild languages

a28197c

Remove disable_combine_sarif_files feature flag

a005f73

Merge branch 'main' into dependabot/github_actions/actions-010b5c0fb1

45f48a3

Update workflow template

84720e2

Merge branch 'main' into koesie10/remove-disable-combine-sarif-files-ff

0521b5f

Update changelog and version after v3.29.5

297691d

Update checked-in dependencies

1a4f45d

Merge pull request #2998 from github/mergeback/v3.29.5-to-main-51f77329

acdac9e

Mergeback v3.29.5 refs/heads/releases/v3 into main

Merge pull request #2995 from github/dependabot/github_actions/action…

20c7f06

…s-010b5c0fb1 Bump ruby/setup-ruby from 1.247.0 to 1.253.0 in the actions group

Merge pull request #2991 from github/koesie10/remove-disable-combine-…

7273f08

…sarif-files-ff Remove `disable_combine_sarif_files` feature flag

Deprecate the 'cleanup-level' option

e95a3a9

Add changelog note

f9d6919

Update default bundle to codeql-bundle-v2.22.3

cfa0a4e

Add changelog note

fff9bbe

Update checked-in dependencies

a3810fa

Bump version in generated source

5547ed3

Merge pull request #3002 from github/dependabot/github_actions/action…

a5cdb29

…s-f69d1f6078 Bump ruby/setup-ruby from 1.253.0 to 1.254.0 in the actions group

Bump @types/node

443f94c

Update checked-in dependencies

563cbbb

Merge pull request #3001 from github/dependabot/npm_and_yarn/npm-5c47…

e37c036

…c8ab2f Bump the npm group with 5 updates

Merge branch 'main' into henrymercer/language-extensibility

c481481

github-actions bot and others added 22 commits August 6, 2025 17:24

Update checked-in dependencies

6db9524

Merge branch 'main' into update-bundle/codeql-bundle-v2.22.3

ec8d9c6

Merge pull request #3000 from github/update-bundle/codeql-bundle-v2.22.3

e2b6f0f

Update default bundle to 2.22.3

Make all errors on an unsupported platform ConfigurationErrors

7b33b61

Add tests for cli-errors and fix one bug

1cfc0c2

Tests were added with copilot, and uncovered a bug where one of the regexps looking for `[autobuild]` was not escaping the square brackets.

Support auto-detecting Actions workflows

43638b1

Check that stats isn't undefined before trying to call isDirectory

0d72a5b

Merge pull request #3007 from github/dependabot/npm_and_yarn/npm_and_…

5e22b5f

…yarn-5a0513363d Bump tmp from 0.2.3 to 0.2.4 in the npm_and_yarn group

Merge pull request #3003 from github/mbg/rewrite-quality-category

a625e16

Rewrite legacy SARIF categories for CQ

Clean up the database if it will be uploaded

c7884c6

Update log message in getRawLanguagesInRepo

f28436b

Merge pull request #3009 from github/mbg/auto-detect-actions

bc90418

Support auto-detecting Actions workflows

Address review

bb56324

Merge branch 'main' into redsun82/unsupported-plat

739fb03

Update changelog note

eddeaf4

Simplify: Remove databaseCleanup

6422cf7

Merge branch 'main' into henrymercer/cleanup-for-mrva

b7beff9

Update log message for cleanup

8c8bdce

Fix bad merge

239ed87

Merge pull request #3005 from github/redsun82/unsupported-plat

588ff73

Make all errors on an unsupported platform `ConfigurationError`s

Merge pull request #3010 from github/henrymercer/cleanup-for-mrva

67a6ea7

Clean up the database if it will be uploaded

Update changelog for v3.29.6

c587f0a

github-actions bot assigned cklin Aug 7, 2025

cklin marked this pull request as ready for review August 7, 2025 14:51

cklin requested a review from a team as a code owner August 7, 2025 14:51

Copilot AI review requested due to automatic review settings August 7, 2025 14:51

Copilot AI reviewed Aug 7, 2025

View reviewed changes

cklin approved these changes Aug 7, 2025

View reviewed changes

cklin merged commit a4e1a01 into releases/v3 Aug 7, 2025
277 checks passed

cklin deleted the update-v3.29.6-67a6ea72b branch August 7, 2025 15:06

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Merge main into releases/v3 #3012

Merge main into releases/v3 #3012

Uh oh!

github-actions bot commented Aug 7, 2025 •

edited by cklin

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Aug 7, 2025

Uh oh!

Copilot AI Aug 7, 2025

Uh oh!

Copilot AI Aug 7, 2025

Uh oh!

Copilot AI Aug 7, 2025

Uh oh!

Copilot AI Aug 7, 2025

Uh oh!

Uh oh!

Uh oh!

	for (const language of config.languages) {
	await Promise.all(config.languages.map(async (language) => {

Merge main into releases/v3 #3012

Merge main into releases/v3 #3012

Uh oh!

Conversation

github-actions bot commented Aug 7, 2025 • edited by cklin Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Key Changes:

Reviewed Changes

Uh oh!

Copilot AI Aug 7, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Aug 7, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Aug 7, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Aug 7, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Aug 7, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

github-actions bot commented Aug 7, 2025 •

edited by cklin

Loading