Merge releases/v4 into releases/v3 - #4133
Merged
Merged
Conversation
Recognize the linux/arm64 platform so the CodeQL CLI is accepted on Arm64 Linux runners and the native per-platform bundle codeql-bundle-linux-arm64.tar.zst is resolved, rather than falling through to the combined all-platforms gzip fallback (which deliberately omits arm64). Add ["linux", "arm64"] to the supported platforms and make the linux bundle name arch-aware. Keep the download mock faithful and cover the new arch branch with tests. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
- Add darwin/x64 case to linked bundle tests and disambiguate the parametrized test title by platform/arch - Reword CHANGELOG entry to clarify the CLI supports Linux Arm64 - Add a dedicated Linux Arm64 end-to-end PR check on ubuntu-24.04-arm Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 308c78bb-53a3-4877-a373-70fab87543f1
Bumps [@octokit/types](https://github.com/octokit/types.ts) from 16.0.0 to 17.0.0. - [Release notes](https://github.com/octokit/types.ts/releases) - [Commits](octokit/types.ts@v16.0.0...v17.0.0) --- updated-dependencies: - dependency-name: "@octokit/types" dependency-version: 17.0.0 dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
As well as fixup a few other problems.
This makes it easier to test. Credit to @mbg.
The streaming path reported no timings at all, so we have no data for the path that most runs take. It now reports a total duration, which is also populated on the download-then-extract path. That path additionally reports the extraction duration, which was previously computed but only logged. `downloadDurationMs` keeps its existing meaning of time spent downloading alone, so existing telemetry stays comparable. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 628ce334-991a-4578-9c1b-93d2e96bbddb
Surface `tools_extraction_duration_ms` and `tools_total_duration_ms` from both the `init` and `setup-codeql` actions. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 628ce334-991a-4578-9c1b-93d2e96bbddb
…to redsun82-linux-arm64-support
Release, mergeback, and backport PRs must be merged with a merge commit so the branch linkage the release automation depends on is preserved (the mergeback tags the release using the merge commit of the "Merge main into releases/vN" PR, so squashing or rebasing breaks tagging). Add a path-scoped Copilot instructions file scoped to the files that reliably change in these PRs (CHANGELOG.md, src/defaults.json, lib/defaults.json, src/api-compatibility.json), and add an explicit note to the Releasing runbook in CONTRIBUTING.md so the rule is enforced regardless of who merges. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 0dae6e42-7fc6-4fb1-b1ea-15dc17e402a2
…etry Improve CodeQL tools download time telemetry
Mergeback v4.37.9 refs/heads/releases/v4 into main
Bumps [actions/setup-java](https://github.com/actions/setup-java) from 5.7.0 to 6.0.0. - [Release notes](https://github.com/actions/setup-java/releases) - [Commits](actions/setup-java@b6effb0...dd06d9c) --- updated-dependencies: - dependency-name: actions/setup-java dependency-version: 6.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps the npm-minor group with 2 updates in the / directory: [js-yaml](https://github.com/nodeca/js-yaml) and [uuid](https://github.com/uuidjs/uuid). Updates `js-yaml` from 5.2.3 to 5.3.0 - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](nodeca/js-yaml@5.2.3...5.3.0) Updates `uuid` from 14.0.1 to 14.0.2 - [Release notes](https://github.com/uuidjs/uuid/releases) - [Changelog](https://github.com/uuidjs/uuid/blob/main/CHANGELOG.md) - [Commits](uuidjs/uuid@v14.0.1...v14.0.2) --- updated-dependencies: - dependency-name: js-yaml dependency-version: 5.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-minor - dependency-name: uuid dependency-version: 14.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-minor ... Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
…load-flake Don't upload the ESLint SARIF from merge queue refs
Analyze all supported languages in the Linux Arm64 check
Delete each version directory individually so that a symlinked one is skipped rather than removed, take an `ActionState` so the environment is read through `ReadOnlyEnv` rather than the deprecated `getOptionalEnvVar`, let `deleteToolcacheBundles` report its own failure to locate the toolcache instead of having the caller catch it, quote paths in log messages, and rename `HAS_OBTAINED_CODEQL_TOOLS` to `HAS_SET_UP_CODEQL`, which is also set when we find the tools in the toolcache rather than downloading them. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Don't record an overlay status when the job was cancelled
…-bundle-cleanup Co-authored-by: henrymercer <14129055+henrymercer@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
…anup Delete unused CodeQL bundles from the toolcache before downloading
Update default bundle to 2.27.0
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Run slow macOS checks on larger runners
Merge main into releases/v4
This reverts commit a4f1d2d.
This reverts commit 2907452.
henrymercer
approved these changes
Sep 9, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Merging b96794f into
releases/v3.Conductor for this PR is @henrymercer.
Contains the following pull requests:
jsonmodule for JSON validation inoutput-cache#4096 (@mario-campos)changetoolscript for validating change-notes #4113 (@mario-campos)Please do the following:
releases/v3branch.Create a merge commitis selected rather thanSquash and mergeorRebase and merge.