Merge main into releases/v4 - #4131
Merged
Merged
Conversation
Recognize the linux/arm64 platform so the CodeQL CLI is accepted on Arm64 Linux runners and the native per-platform bundle codeql-bundle-linux-arm64.tar.zst is resolved, rather than falling through to the combined all-platforms gzip fallback (which deliberately omits arm64). Add ["linux", "arm64"] to the supported platforms and make the linux bundle name arch-aware. Keep the download mock faithful and cover the new arch branch with tests. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
- Add darwin/x64 case to linked bundle tests and disambiguate the parametrized test title by platform/arch - Reword CHANGELOG entry to clarify the CLI supports Linux Arm64 - Add a dedicated Linux Arm64 end-to-end PR check on ubuntu-24.04-arm Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 308c78bb-53a3-4877-a373-70fab87543f1
Bumps [@octokit/types](https://github.com/octokit/types.ts) from 16.0.0 to 17.0.0. - [Release notes](https://github.com/octokit/types.ts/releases) - [Commits](octokit/types.ts@v16.0.0...v17.0.0) --- updated-dependencies: - dependency-name: "@octokit/types" dependency-version: 17.0.0 dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
As well as fixup a few other problems.
This makes it easier to test. Credit to @mbg.
The streaming path reported no timings at all, so we have no data for the path that most runs take. It now reports a total duration, which is also populated on the download-then-extract path. That path additionally reports the extraction duration, which was previously computed but only logged. `downloadDurationMs` keeps its existing meaning of time spent downloading alone, so existing telemetry stays comparable. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 628ce334-991a-4578-9c1b-93d2e96bbddb
Surface `tools_extraction_duration_ms` and `tools_total_duration_ms` from both the `init` and `setup-codeql` actions. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 628ce334-991a-4578-9c1b-93d2e96bbddb
…to redsun82-linux-arm64-support
Release, mergeback, and backport PRs must be merged with a merge commit so the branch linkage the release automation depends on is preserved (the mergeback tags the release using the merge commit of the "Merge main into releases/vN" PR, so squashing or rebasing breaks tagging). Add a path-scoped Copilot instructions file scoped to the files that reliably change in these PRs (CHANGELOG.md, src/defaults.json, lib/defaults.json, src/api-compatibility.json), and add an explicit note to the Releasing runbook in CONTRIBUTING.md so the rule is enforced regardless of who merges. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 0dae6e42-7fc6-4fb1-b1ea-15dc17e402a2
…etry Improve CodeQL tools download time telemetry
Mergeback v4.37.9 refs/heads/releases/v4 into main
Bumps [actions/setup-java](https://github.com/actions/setup-java) from 5.7.0 to 6.0.0. - [Release notes](https://github.com/actions/setup-java/releases) - [Commits](actions/setup-java@b6effb0...dd06d9c) --- updated-dependencies: - dependency-name: actions/setup-java dependency-version: 6.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps the npm-minor group with 2 updates in the / directory: [js-yaml](https://github.com/nodeca/js-yaml) and [uuid](https://github.com/uuidjs/uuid). Updates `js-yaml` from 5.2.3 to 5.3.0 - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](nodeca/js-yaml@5.2.3...5.3.0) Updates `uuid` from 14.0.1 to 14.0.2 - [Release notes](https://github.com/uuidjs/uuid/releases) - [Changelog](https://github.com/uuidjs/uuid/blob/main/CHANGELOG.md) - [Commits](uuidjs/uuid@v14.0.1...v14.0.2) --- updated-dependencies: - dependency-name: js-yaml dependency-version: 5.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-minor - dependency-name: uuid dependency-version: 14.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-minor ... Signed-off-by: dependabot[bot] <support@github.com>
Run the cleanup even when the download will not be cached in the toolcache, since the toolcache shares a filesystem with the directory we extract to, so freeing it helps either way, and report an error other than the toolcache being absent as a failure rather than as an empty toolcache. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Some runner images keep the toolcache on a different volume to the workspace, so deleting the tools there frees up disk space that the analysis cannot use, and costs a later step that wanted them in the toolcache a download. Windows runners are laid out this way, with the toolcache on `C:` and the workspace on `D:`. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Log a success line for each language database found in the Linux Arm64 PR check. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
…load-flake Don't upload the ESLint SARIF from merge queue refs
Analyze all supported languages in the Linux Arm64 check
Delete each version directory individually so that a symlinked one is skipped rather than removed, take an `ActionState` so the environment is read through `ReadOnlyEnv` rather than the deprecated `getOptionalEnvVar`, let `deleteToolcacheBundles` report its own failure to locate the toolcache instead of having the caller catch it, quote paths in log messages, and rename `HAS_OBTAINED_CODEQL_TOOLS` to `HAS_SET_UP_CODEQL`, which is also set when we find the tools in the toolcache rather than downloading them. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Don't record an overlay status when the job was cancelled
…-bundle-cleanup Co-authored-by: henrymercer <14129055+henrymercer@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
…anup Delete unused CodeQL bundles from the toolcache before downloading
Update default bundle to 2.27.0
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Run slow macOS checks on larger runners
henrymercer
approved these changes
Sep 9, 2026
henrymercer
enabled auto-merge
September 9, 2026 13:51
vladimirrott
added a commit
to vladimirrott/maintainer-agent
that referenced
this pull request
Sep 9, 2026
github/codeql-action shipped v4.38.0 at 14:02 UTC today and moved the `v4` tag
with it, so all three pins carried a comment that had stopped being true:
FAIL github/codeql-action/analyze pinned cdf488f5 but v4 is b96794f0
FAIL github/codeql-action/init pinned cdf488f5 but v4 is b96794f0
FAIL github/codeql-action/upload-sarif pinned cdf488f5 but v4 is b96794f0
That is the pin verifier doing the job it exists for: a SHA is immutable and a
tag is not, so a pin is only auditable while its comment is true.
Dereferenced rather than copied: `v4` is annotated, so the ref points at tag
object 311b4ee1 and the commit underneath it is b96794f0, which is the merge of
github/codeql-action#4131, "update-v4.38.0". `scripts/verify-action-pins.sh`
now reports every pin as the tag it claims.
vladimirrott
added a commit
to vladimirrott/maintainer-agent
that referenced
this pull request
Sep 9, 2026
* An empty label answer means absent, not unreadable Yesterday's #29 fix hardened the claim-label read to refuse when it came back empty. That was wrong, and it blocked merging sysknife#398 an hour later. `gh --jq` prints NOTHING for a JSON null. Measured against the live tracker: $ gh issue view 396 --json labels --jq '[.labels[].name]|index("claimed")' (empty, rc=0) # not labelled $ gh issue view 336 --json labels --jq '[.labels[].name]|index("claimed")' 3 # labelled So "this issue does not carry the claim label" arrives as an empty string with rc=0, which is the ordinary case for most issues. Refusing on it turned the claim guard into a refusal of every merge whose closed issue is unlabelled. The exit status is the only signal for "could not ask", which is what the original fix should have said. Empty and the literal `null` both mean absent. The suite did not catch it because every stub echoed the literal string `null`, a shape `gh` never produces. The stubs now print nothing for the unlabelled case, and a pair of cases asserts that an unlabelled issue is neither reported as unreadable nor run through the claim branch. Suite 692 -> 694. * Repin codeql-action to the v4 its tag now names github/codeql-action shipped v4.38.0 at 14:02 UTC today and moved the `v4` tag with it, so all three pins carried a comment that had stopped being true: FAIL github/codeql-action/analyze pinned cdf488f5 but v4 is b96794f0 FAIL github/codeql-action/init pinned cdf488f5 but v4 is b96794f0 FAIL github/codeql-action/upload-sarif pinned cdf488f5 but v4 is b96794f0 That is the pin verifier doing the job it exists for: a SHA is immutable and a tag is not, so a pin is only auditable while its comment is true. Dereferenced rather than copied: `v4` is annotated, so the ref points at tag object 311b4ee1 and the commit underneath it is b96794f0, which is the merge of github/codeql-action#4131, "update-v4.38.0". `scripts/verify-action-pins.sh` now reports every pin as the tag it claims.
6 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Merging 7e08580 into
releases/v4.Conductor for this PR is @henrymercer.
Contains the following pull requests:
jsonmodule for JSON validation inoutput-cache#4096 (@mario-campos)changetoolscript for validating change-notes #4113 (@mario-campos)Please do the following:
releases/v4branch.Create a merge commitis selected rather thanSquash and mergeorRebase and merge.