Merge main into releases/v4 by github-actions[bot] · Pull Request #4299 · github/codeql-action

github-actions · 2026-11-04T15:22:13Z

Merging 064910b into releases/v4.

Conductor for this PR is @sam-robson.

Contains the following pull requests:

Please do the following:

Ensure the CHANGELOG displays the correct version and date.
Ensure the CHANGELOG includes all relevant, user-facing changes since the last release.
Check that there are not any unexpected commits being merged into the releases/v4 branch.
Ensure the docs team is aware of any documentation changes that need to be released.
Approve running the full set of PR checks if you have not pushed any changes.
Approve and merge this PR. Make sure Create a merge commit is selected rather than Squash and merge or Rebase and merge.
Merge the mergeback PR that will automatically be created once this PR is merged.
Merge all backport PRs to older release branches, that will automatically be created once this PR is merged.

…y initial line

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Migrate bundle update workflow to new changenote tooling

Bumps [glob](https://github.com/isaacs/node-glob) from 13.0.6 to 14.0.3. - [Changelog](https://github.com/isaacs/node-glob/blob/main/changelog.md) - [Commits](isaacs/node-glob@v13.0.6...v14.0.3) --- updated-dependencies: - dependency-name: glob dependency-version: 14.0.3 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [node-forge](https://github.com/digitalbazaar/forge) from 1.4.0 to 1.4.1. - [Changelog](https://github.com/digitalbazaar/forge/blob/main/CHANGELOG.md) - [Commits](digitalbazaar/forge@v1.4.0...v1.4.1) --- updated-dependencies: - dependency-name: node-forge dependency-version: 1.4.1 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>

Mergeback v4.39.2 refs/heads/releases/v4 into main

This avoids failures on PRs where `sync-back.ts` is run as part of the "Rebuild" job if there are already version inconsistencies on the base branch.

…for consistency

Maintain action versions by workflow in `sync-back.ts`

…s/glob-14.0.3 Bump glob from 13.0.6 to 14.0.3 in /pr-checks

…ge-1.4.1 Bump node-forge from 1.4.0 to 1.4.1

…sarif-uris fix: decode SARIF location URIs in diff-informed alert filtering

Consistently format YAML and add CI check

Update `glob` to `14.0.3`

Copilot

🔵 Needs a closer look

Maintainer confirmation is needed because the snapshot lacks branch refs, commit history, and workflow results to verify the intended releases/v4 commit set and successful release checks.

No open issues 🎉

What changed in this PR

Prepares CodeQL Action 4.39.3, dated 04 Nov 2026, by merging main into releases/v4. The changelog records the fix for diff-informed filtering of alerts in files with encoded paths.

Changes:

Fixes SARIF path matching and adds regression tests.
Standardizes YAML formatting and updates CI, workflow synchronization, and bundle changenote tooling.
Updates dependencies and release version metadata.

File	Description
`upload-sarif/action.yml`	Standardizes YAML quoting.
`tests/multi-language-repo/codeql-qlpacks/python-qlpack/qlpack.yml`	Normalizes file formatting.
`tests/multi-language-repo/codeql-qlpacks/javascript-qlpack/qlpack.yml`	Normalizes file formatting.
`tests/multi-language-repo/codeql-qlpacks/java-qlpack/qlpack.yml`	Normalizes file formatting.
`tests/multi-language-repo/codeql-qlpacks/go-qlpack/qlpack.yml`	Normalizes file formatting.
`tests/multi-language-repo/codeql-qlpacks/csharp-qlpack/qlpack.yml`	Normalizes file formatting.
`tests/multi-language-repo/codeql-qlpacks/cpp-qlpack/qlpack.yml`	Normalizes file formatting.
`tests/multi-language-repo/codeql-qlpacks/complex-python-qlpack/qlpack.yml`	Normalizes file formatting.
`tests/multi-language-repo/codeql-qlpacks/complex-javascript-qlpack/qlpack.yml`	Normalizes file formatting.
`tests/multi-language-repo/.github/codeql/custom-queries.yml`	Aligns YAML comments.
`tests/multi-language-repo/.github/codeql/codeql-config-query-filters3.yml`	Standardizes YAML indentation.
`tests/multi-language-repo/.github/codeql/codeql-config-query-filters2.yml`	Standardizes YAML indentation.
`tests/multi-language-repo/.github/codeql/codeql-config-query-filters1.yml`	Standardizes YAML indentation.
`src/upload-sarif-action.ts`	Applies TypeScript formatting.
`src/upload-lib.ts`	Matches decoded SARIF paths with raw-path fallback.
`src/upload-lib.test.ts`	Covers encoded paths and malformed URI handling.
`src/testing-utils.ts`	Applies TypeScript formatting.
`src/testdata/pr-diff-range.yml`	Updates expected YAML formatting.
`src/start-proxy/types.ts`	Applies TypeScript formatting.
`src/setup-codeql.test.ts`	Applies TypeScript formatting.
`src/init-action-post.ts`	Applies TypeScript formatting.
`src/environment.ts`	Applies TypeScript formatting.
`src/debug-artifacts.ts`	Applies TypeScript formatting.
`src/analyze.ts`	Aligns generated YAML and TypeScript formatting.
`src/analyze-action.ts`	Applies TypeScript formatting.
`setup-codeql/action.yml`	Standardizes YAML quoting.
`resolve-environment/action.yml`	Standardizes YAML quoting.
`pr-checks/update-release-branch.ts`	Uses extracted command helpers.
`pr-checks/sync.ts`	Generates consistently formatted YAML.
`pr-checks/sync-back.ts`	Tracks action versions separately for each workflow.
`pr-checks/sync-back.test.ts`	Adapts tests to workflow-specific version mappings.
`pr-checks/package.json`	Updates `glob`.
`pr-checks/config.ts`	Exports shared source and build paths.
`pr-checks/command.ts`	Extracts reusable command and Git helpers.
`pr-checks/checks/upload-sarif.yml`	Standardizes template quoting.
`pr-checks/checks/upload-ref-sha-input.yml`	Standardizes template quoting.
`pr-checks/checks/unsupported-macos.yml`	Updates `download-artifact` to v8.0.2.
`pr-checks/checks/overlay-init-fallback.yml`	Normalizes inline comment spacing.
`pr-checks/checks/init-with-registries.yml`	Standardizes block indentation.
`pr-checks/checks/analyze-ref-input.yml`	Standardizes template quoting.
`pr-checks/check-unchanged.ts`	Adds shared JavaScript and YAML consistency checks.
`pr-checks/bundle-changelog.ts`	Writes bundle updates to changenote files.
`pr-checks/bundle-changelog.test.ts`	Tests generated bundle changenotes.
`package.json`	Sets 4.39.3, adds YAML formatting, and updates dependencies.
`package-lock.json`	Synchronizes release and dependency metadata.
`init/action.yml`	Standardizes YAML quoting.
`CHANGELOG.md`	Adds the dated 4.39.3 release entry.
`autobuild/action.yml`	Standardizes YAML quoting.
`action.yml`	Standardizes YAML quoting.
`.vscode/settings.json`	Configures the repository’s YAML formatter.
`.github/workflows/update-supported-enterprise-server-versions.yml`	Standardizes YAML quoting.
`.github/workflows/update-release-branch.yml`	Standardizes workflow indentation and quoting.
`.github/workflows/update-bundle.yml`	Stages and commits generated changenotes.
`.github/workflows/test-codeql-bundle-all.yml`	Standardizes workflow formatting.
`.github/workflows/script/check-js.sh`	Removes the replaced JavaScript verification script.
`.github/workflows/query-filters.yml`	Standardizes workflow formatting.
`.github/workflows/python312-windows.yml`	Standardizes workflow formatting.
`.github/workflows/publish-immutable-action.yml`	Standardizes YAML quoting.
`.github/workflows/pr-checks.yml`	Runs the shared JavaScript and YAML checks.
`.github/workflows/codescanning-config-cli.yml`	Standardizes workflow formatting.
`.github/workflows/codeql.yml`	Standardizes workflow formatting.
`.github/workflows/__with-checkout-path.yml`	Refreshes generated YAML formatting.
`.github/workflows/__upload-sarif.yml`	Refreshes generated YAML formatting.
`.github/workflows/__upload-ref-sha-input.yml`	Refreshes generated YAML formatting.
`.github/workflows/__unsupported-macos.yml`	Reflects formatting and artifact-action updates.
`.github/workflows/__unset-environment.yml`	Refreshes generated YAML formatting.
`.github/workflows/__swift-custom-build.yml`	Refreshes generated YAML formatting.
`.github/workflows/__swift-autobuild.yml`	Refreshes generated YAML formatting.
`.github/workflows/__submit-sarif-failure.yml`	Refreshes generated YAML formatting.
`.github/workflows/__start-proxy.yml`	Refreshes generated YAML formatting.
`.github/workflows/__split-workflow.yml`	Refreshes generated YAML formatting.
`.github/workflows/__rust.yml`	Refreshes generated YAML formatting.
`.github/workflows/__ruby.yml`	Refreshes generated YAML formatting.
`.github/workflows/__resolve-environment-action.yml`	Refreshes generated YAML formatting.
`.github/workflows/__remote-config.yml`	Refreshes generated YAML formatting.
`.github/workflows/__per-language-bundle-validation.yml`	Refreshes generated YAML formatting.
`.github/workflows/__packaging-inputs-js.yml`	Refreshes generated YAML formatting.
`.github/workflows/__packaging-config-js.yml`	Refreshes generated YAML formatting.
`.github/workflows/__packaging-config-inputs-js.yml`	Refreshes generated YAML formatting.
`.github/workflows/__packaging-codescanning-config-inputs-js.yml`	Refreshes generated YAML formatting.
`.github/workflows/__overlay-init-fallback.yml`	Refreshes generated YAML formatting.
`.github/workflows/__multi-language-autodetect.yml`	Refreshes generated YAML formatting.
`.github/workflows/__local-bundle.yml`	Refreshes generated YAML formatting.
`.github/workflows/__linux-arm64.yml`	Refreshes generated YAML formatting.
`.github/workflows/__language-aliases.yml`	Refreshes generated YAML formatting.
`.github/workflows/__job-run-uuid-sarif.yml`	Refreshes generated YAML formatting.
`.github/workflows/__javascript-source-root.yml`	Refreshes generated YAML formatting.
`.github/workflows/__init-with-registries.yml`	Refreshes generated YAML formatting.
`.github/workflows/__go.yml`	Refreshes generated YAML formatting.
`.github/workflows/__go-tracing-legacy-workflow.yml`	Refreshes generated YAML formatting.
`.github/workflows/__go-tracing-custom-build-steps.yml`	Refreshes generated YAML formatting.
`.github/workflows/__go-tracing-autobuilder.yml`	Refreshes generated YAML formatting.
`.github/workflows/__go-indirect-tracing-workaround.yml`	Refreshes generated YAML formatting.
`.github/workflows/__go-indirect-tracing-workaround-no-file-program.yml`	Refreshes generated YAML formatting.
`.github/workflows/__go-indirect-tracing-workaround-diagnostic.yml`	Refreshes generated YAML formatting.
`.github/workflows/__go-custom-queries.yml`	Refreshes generated YAML formatting.
`.github/workflows/__global-proxy.yml`	Refreshes generated YAML formatting.
`.github/workflows/__extractor-ram-threads.yml`	Refreshes generated YAML formatting.
`.github/workflows/__export-file-baseline-information.yml`	Refreshes generated YAML formatting.
`.github/workflows/__diagnostics-without-db.yml`	Refreshes generated YAML formatting.
`.github/workflows/__diagnostics-export.yml`	Refreshes generated YAML formatting.
`.github/workflows/__cpp-deptrace-enabled.yml`	Refreshes generated YAML formatting.
`.github/workflows/__cpp-deptrace-enabled-on-macos.yml`	Refreshes generated YAML formatting.
`.github/workflows/__cpp-deptrace-disabled.yml`	Refreshes generated YAML formatting.
`.github/workflows/__config-input.yml`	Refreshes generated YAML formatting.
`.github/workflows/__config-export.yml`	Refreshes generated YAML formatting.
`.github/workflows/__cleanup-db-cluster-dir.yml`	Refreshes generated YAML formatting.
`.github/workflows/__bundle-toolcache.yml`	Refreshes generated YAML formatting.
`.github/workflows/__bundle-from-toolcache.yml`	Refreshes generated YAML formatting.
`.github/workflows/__bundle-from-nightly.yml`	Refreshes generated YAML formatting.
`.github/workflows/__build-mode-rollback.yml`	Refreshes generated YAML formatting.
`.github/workflows/__build-mode-none.yml`	Refreshes generated YAML formatting.
`.github/workflows/__build-mode-manual.yml`	Refreshes generated YAML formatting.
`.github/workflows/__build-mode-autobuild.yml`	Refreshes generated YAML formatting.
`.github/workflows/__autobuild-working-dir.yml`	Refreshes generated YAML formatting.
`.github/workflows/__autobuild-direct-tracing-with-working-dir.yml`	Refreshes generated YAML formatting.
`.github/workflows/__autobuild-action.yml`	Refreshes generated YAML formatting.
`.github/workflows/__analyze-ref-input.yml`	Refreshes generated YAML formatting.
`.github/workflows/__analysis-kinds.yml`	Refreshes generated YAML formatting.
`.github/workflows/__all-platform-bundle.yml`	Refreshes generated YAML formatting.
`.github/ISSUE_TEMPLATE/config.yml`	Removes trailing whitespace.
`.github/actions/release-initialise/action.yml`	Standardizes YAML formatting.
`.github/actions/release-branches/action.yml`	Standardizes YAML quoting.
`.github/actions/query-filter-test/action.yml`	Normalizes YAML spacing.
`.github/actions/check-codescanning-config/action.yml`	Standardizes YAML indentation and quoting.
`.editorconfig`	Sets two-space YAML indentation.

_{Review effort: Balanced (auto)}

mbg and others added 30 commits October 30, 2026 15:13

Update .editorconfig with explicit indent_size for YAML

d805a56

Update VSCode settings with YAML formatter

3f9319d

Add prettier as dev dependency

fef5200

Apply consistent YAML formatting

2c6d525

Move subprocess helpers from update-release-branch.ts to command.ts

6c2d540

Convert check-js.sh to TypeScript

c8db21e

Refactor check-js.ts into separate functions

549d739

Rename to check-unchanged and add YAML check

b2e3b75

Fix checkUnchanged returning -1

ff6ba28

Fix missing core.summary.write call

c434c1b

Fix inconsistent quoting in diffRangeExtensionPackContents and empt…

878c513

…y initial line

Configure VSCode to use local version of prettier

69543ab

Run lint-fix with newer version of prettier

fab591c

Avoid ESM-specific entry check for now

9fe80b6

Merge branch 'main' into mbg/ci/validate-yaml

9151e90

fix: decode SARIF location URIs in diff-informed alert filtering

b05fe69

Create a changenote for bundle updates instead of editing the changelog

9bc74b1

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Remove unused updateChangelog from bundle-changelog.ts

3952845

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Merge remote-tracking branch 'origin/main' into mbg/ci/validate-yaml

70417cd

Merge pull request #4285 from github/henrymercer/automated-change-notes

0d5ac7a

Migrate bundle update workflow to new changenote tooling

Update changelog and version after v4.39.2

eb1e5bd

Rebuild

3062620

Merge pull request #4290 from github/mergeback/v4.39.2-to-main-1fc58d04

093c0af

Mergeback v4.39.2 refs/heads/releases/v4 into main

Maintain action versions by workflow in sync-back.ts

7b8e4ce

This avoids failures on PRs where `sync-back.ts` is run as part of the "Rebuild" job if there are already version inconsistencies on the base branch.

Update version of actions/download-artifact in unsupported-macos …

cc88e02

…for consistency

Merge branch 'main' into mbg/ci/fix-sync-back

de3ece6

Merge branch 'main' into mbg/ci/validate-yaml

7bcfa1e

Update JSDoc for scanGeneratedWorkflows

8a05ce6

mbg and others added 15 commits November 3, 2026 14:27

Merge pull request #4292 from github/mbg/ci/fix-sync-back

1f8cacc

Maintain action versions by workflow in `sync-back.ts`

Merge branch 'main' into dependabot/npm_and_yarn/node-forge-1.4.1

7c5ee8e

Merge branch 'main' into dependabot/npm_and_yarn/pr-checks/glob-14.0.3

6a39e2e

Rebuild

d0468de

Merge pull request #4287 from github/dependabot/npm_and_yarn/pr-check…

875ac0c

…s/glob-14.0.3 Bump glob from 13.0.6 to 14.0.3 in /pr-checks

Merge pull request #4288 from github/dependabot/npm_and_yarn/node-for…

c5320e3

…ge-1.4.1 Bump node-forge from 1.4.0 to 1.4.1

Merge pull request #4283 from github/sam-robson/decode-diff-informed-…

913e1bb

…sarif-uris fix: decode SARIF location URIs in diff-informed alert filtering

Merge remote-tracking branch 'origin/main' into mbg/ci/validate-yaml

160e547

Use normal .editorconfig pattern

8eb7cdf

Remove exclude entry that's no longer needed

7287bb3

Return different exit code when a language is not recognised

cea289b

Merge pull request #4280 from github/mbg/ci/validate-yaml

8cd4dfa

Consistently format YAML and add CI check

Update glob to 14.0.3

f532ac5

Merge pull request #4297 from github/mbg/update-glob

064910b

Update `glob` to `14.0.3`

Update changelog for v4.39.3

24393f8

github-actions Bot requested a review from a team as a code owner November 4, 2026 15:22

Copilot AI auto review requested due to automatic review settings November 4, 2026 15:22

github-actions Bot assigned sam-robson Nov 4, 2026

Copilot started reviewing November 4, 2026 15:22

View session

Copilot AI reviewed Nov 4, 2026

View reviewed changes

github-actions Bot added the size/XXL May be extremely hard to review label Nov 4, 2026

sam-robson enabled auto-merge November 4, 2026 16:45

sam-robson approved these changes Nov 4, 2026

View reviewed changes

sam-robson merged commit 33d7b85 into releases/v4 Nov 4, 2026
234 checks passed

sam-robson deleted the update-v4.39.3-064910ba2 branch November 4, 2026 16:47

github-actions Bot mentioned this pull request Nov 4, 2026

Merge releases/v4 into releases/v3 #4304

Merged

9 of 10 tasks

Navigation Menu

Repository navigation

Merge main into releases/v4 - #4299

Merge main into releases/v4#4299
sam-robson merged 45 commits into
releases/v4from
update-v4.39.3-064910ba2

github-actions Bot commented Nov 4, 2026 •

edited by sam-robson

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

github-actions Bot commented Nov 4, 2026 • edited by sam-robson Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🔵 Needs a closer look

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

github-actions Bot commented Nov 4, 2026 •

edited by sam-robson

Loading