mirror of
https://github.com/compiler-explorer/compiler-explorer.git
synced 2026-09-10 20:19:26 -04:00
npm-allow-git
8 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
dependabot[bot]
|
9e2544c183 |
Bump github/codeql-action from 4 to 4.37.0 in the github-actions group (#8938)
Bumps the github-actions group with 1 update: [github/codeql-action](https://github.com/github/codeql-action). Updates `github/codeql-action` from 4 to 4.37.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/releases">github/codeql-action's releases</a>.</em></p> <blockquote> <h2>v4.37.0</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0">2.26.0</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3995">#3995</a></li> <li>In addition to the existing input format, the <code>config-file</code> input for the <code>codeql-action/init</code> step will soon support a new <code>[owner/]repo[@ref][:path]</code> format. All components except the repository name are optional. If omitted, <code>owner</code> defaults to the same owner as the repository the analysis is running for, <code>ref</code> to <code>main</code>, and <code>path</code> to <code>.github/codeql-action.yaml</code>. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. <a href="https://redirect.github.com/github/codeql-action/pull/3973">#3973</a></li> </ul> <h2>v4.36.3</h2> <p>No user facing changes.</p> <h2>v4.36.2</h2> <ul> <li>Cache CodeQL CLI version information across Actions steps. <a href="https://redirect.github.com/github/codeql-action/pull/3943">#3943</a></li> <li>Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. <a href="https://redirect.github.com/github/codeql-action/pull/3937">#3937</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.6">2.25.6</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3948">#3948</a></li> </ul> <h2>v4.36.1</h2> <p>No user facing changes.</p> <h2>v4.36.0</h2> <ul> <li><em>Breaking change</em>: Bump the minimum required CodeQL bundle version to 2.19.4. <a href="https://redirect.github.com/github/codeql-action/pull/3894">#3894</a></li> <li>Add support for SHA-256 Git object IDs. <a href="https://redirect.github.com/github/codeql-action/pull/3893">#3893</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.5">2.25.5</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3926">#3926</a></li> </ul> <h2>v4.35.5</h2> <ul> <li>We have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. <a href="https://redirect.github.com/github/codeql-action/pull/3899">#3899</a></li> <li>For performance and accuracy reasons, <a href="https://redirect.github.com/github/roadmap/issues/1158">improved incremental analysis</a> will now only be enabled on a pull request when diff-informed analysis is also enabled for that run. If diff-informed analysis is unavailable (for example, because the PR diff ranges could not be computed), the action will fall back to a full analysis. <a href="https://redirect.github.com/github/codeql-action/pull/3791">#3791</a></li> <li>If multiple inputs are provided for the GitHub-internal <code>analysis-kinds</code> input, only <code>code-scanning</code> will be enabled. The <code>analysis-kinds</code> input is experimental, for GitHub-internal use only, and may change without notice at any time. <a href="https://redirect.github.com/github/codeql-action/pull/3892">#3892</a></li> <li>Added an experimental change which, when running a Code Scanning analysis for a PR with <a href="https://redirect.github.com/github/roadmap/issues/1158">improved incremental analysis</a> enabled, prefers CodeQL CLI versions that have a cached overlay-base database for the configured languages. This speeds up analysis for a repository when there is not yet a cached overlay-base database for the latest CLI version. We expect to roll this change out to everyone in May. <a href="https://redirect.github.com/github/codeql-action/pull/3880">#3880</a></li> </ul> <h2>v4.35.4</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.4">2.25.4</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3881">#3881</a></li> </ul> <h2>v4.35.3</h2> <ul> <li><em>Upcoming breaking change</em>: Add a deprecation warning for customers using CodeQL version 2.19.3 and earlier. These versions of CodeQL were discontinued on 9 April 2026 alongside GitHub Enterprise Server 3.15, and will be unsupported by the next minor release of the CodeQL Action. <a href="https://redirect.github.com/github/codeql-action/pull/3837">#3837</a></li> <li>Configurations for private registries that use Cloudsmith or GCP OIDC are now accepted. <a href="https://redirect.github.com/github/codeql-action/pull/3850">#3850</a></li> <li>Best-effort connection tests for private registries now use <code>GET</code> requests instead of <code>HEAD</code> for better compatibility with various registry implementations. For NuGet feeds, the test is now always performed against the service index. <a href="https://redirect.github.com/github/codeql-action/pull/3853">#3853</a></li> <li>Fixed a bug where two diagnostics produced within the same millisecond could overwrite each other on disk, causing one of them to be lost. <a href="https://redirect.github.com/github/codeql-action/pull/3852">#3852</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.3">2.25.3</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3865">#3865</a></li> </ul> <h2>v4.35.2</h2> <ul> <li>The undocumented TRAP cache cleanup feature that could be enabled using the <code>CODEQL_ACTION_CLEANUP_TRAP_CACHES</code> environment variable is deprecated and will be removed in May 2026. If you are affected by this, we recommend disabling TRAP caching by passing the <code>trap-caching: false</code> input to the <code>init</code> Action. <a href="https://redirect.github.com/github/codeql-action/pull/3795">#3795</a></li> <li>The Git version 2.36.0 requirement for improved incremental analysis now only applies to repositories that contain submodules. <a href="https://redirect.github.com/github/codeql-action/pull/3789">#3789</a></li> <li>Python analysis on GHES no longer extracts the standard library, relying instead on models of the standard library. This should result in significantly faster extraction and analysis times, while the effect on alerts should be minimal. <a href="https://redirect.github.com/github/codeql-action/pull/3794">#3794</a></li> <li>Fixed a bug in the validation of OIDC configurations for private registries that was added in CodeQL Action 4.33.0 / 3.33.0. <a href="https://redirect.github.com/github/codeql-action/pull/3807">#3807</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.2">2.25.2</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3823">#3823</a></li> </ul> <h2>v4.35.1</h2> <ul> <li>Fix incorrect minimum required Git version for <a href="https://redirect.github.com/github/roadmap/issues/1158">improved incremental analysis</a>: it should have been 2.36.0, not 2.11.0. <a href="https://redirect.github.com/github/codeql-action/pull/3781">#3781</a></li> </ul> <h2>v4.35.0</h2> <ul> <li>Reduced the minimum Git version required for <a href="https://redirect.github.com/github/roadmap/issues/1158">improved incremental analysis</a> from 2.38.0 to 2.11.0. <a href="https://redirect.github.com/github/codeql-action/pull/3767">#3767</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.1">2.25.1</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3773">#3773</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action's changelog</a>.</em></p> <blockquote> <h2>4.37.0 - 08 Jul 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0">2.26.0</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3995">#3995</a></li> <li>In addition to the existing input format, the <code>config-file</code> input for the <code>codeql-action/init</code> step will soon support a new <code>[owner/]repo[@ref][:path]</code> format. All components except the repository name are optional. If omitted, <code>owner</code> defaults to the same owner as the repository the analysis is running for, <code>ref</code> to <code>main</code>, and <code>path</code> to <code>.github/codeql-action.yaml</code>. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. <a href="https://redirect.github.com/github/codeql-action/pull/3973">#3973</a></li> </ul> <h2>4.36.3 - 01 Jul 2026</h2> <p>No user facing changes.</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href=" |
||
|
Matt Godbolt (bot acct)
|
abe65dc410 |
Bump workflow actions to Node 24 majors (#8936)
Every CI run currently emits "Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24" runner annotations (visible on every job of the main build and the Windows build). These come from the runner at execution time, so the actionlint gate added in #8912 can't catch them: actionlint checks workflow files statically and has no knowledge of which Node runtime an action's implementation targets. This bumps every runner-flagged action to its latest major, all of which target node24: | Action | From | To | |---|---|---| | actions/checkout | v4 | v7 | | actions/setup-node | v4 | v7 | | actions/upload-artifact | v4 | v7 | | actions/download-artifact | v4 | v8 | | actions/setup-python | v5 | v7 | | actions/labeler | v5 | v6 | | actions/github-script | v7 | v9 | | github/codeql-action | v3 | v4 | | peter-evans/create-pull-request | v6 | v8 | | cypress-io/github-action | v6 | v7 | | browser-actions/setup-chrome | v1 | v2 | | codecov/codecov-action | v5 | v7 | | astral-sh/setup-uv | v6 | v8.3.2 (exact pin; from v8 they publish immutable releases only, no floating major tags) | The last three rows came from iterating: this branch's own push builds run the full workflow (including the real deploy path), and scanning their annotations after each round caught what the first sweep missed — our github-script uses, codecov-action (whose v5 pins a node20 github-script by SHA internally; their v6 fixed that), and setup-uv. codeql-action v3 additionally carries its own deprecation warning (sunset December 2026). **Behaviour changes checked against our usage:** - create-pull-request v7 renamed `git-token` to `branch-token` and removed the `PULL_REQUEST_NUMBER` env output: browserslist.yml uses neither. - setup-python v7 removed the `pip-install` input: check-infra-settings.yml doesn't use it. - github-script v9: `require('@actions/github')` no longer works inside scripts; neither of ours does that (one calls `github.rest.git.createRef`, the other requires only the core `fs` module). - setup-uv v7/v8 removed the `server-url` input and changed the manifest-file format: we pass no inputs. - setup-chrome v2 installs Chrome for Testing by default: fine (arguably better) for the Cypress frontend tests. - download-artifact v8 now errors on hash mismatch by default: a fix we want. - checkout v7 blocks fork-PR checkout under `pull_request_target`/`workflow_run` unless opted in: our only such workflows (label.yml, check-infra-settings-comment.yml) don't use checkout at all. - codecov-action v6 is their node24 bump; v7 only rotates their signing account. Our `token`/`verbose` usage is unaffected. **Deliberately left alone:** - `browser-actions/setup-firefox@v1`: latest release is still v1 (1.7.x, node24). - `wow-actions/potential-duplicates@v1`: upstream is unmaintained (last release 2022); no node24 version exists. Its warning will remain on duplicate-detection runs until we replace or drop it. - `jakejarvis/s3-sync-action@master`: a Docker action, unaffected by the Node runtime deprecation. **Validation:** - actionlint 1.7.12 (the pinned CI version) passes clean. - All PR checks green across two full rounds, including Cypress on Chrome for Testing and CodeQL v4. - Because pushes to any branch run the real deploy job, the complete chain (dist build → download-artifact v8 → sentry → S3 sync → github-script v9 tagging → post_deploy_check on admin-node) ran green for real. - Runner compatibility: these majors require Actions Runner >= 2.327.1; the self-hosted admin-node and ce fleet runners are all on 2.335.1 (confirmed from job logs). 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: mattgodbolt-molty <mattgodbolt-molty@users.noreply.github.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com> |
||
|
renovate[bot]
|
e2adcabd65 |
chore(deps): update github/codeql-action action to v3 (#6166)
[](https://renovatebot.com) This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [github/codeql-action](https://togithub.com/github/codeql-action) | action | major | `v2` -> `v3` | --- ### Release Notes <details> <summary>github/codeql-action (github/codeql-action)</summary> ### [`v3`](https://togithub.com/github/codeql-action/compare/v2...v3) [Compare Source](https://togithub.com/github/codeql-action/compare/v2...v3) </details> --- ### Configuration 📅 **Schedule**: Branch creation - "before 8pm on monday" in timezone America/Chicago, Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://www.mend.io/free-developer-tools/renovate/). View repository job log [here](https://developer.mend.io/github/compiler-explorer/compiler-explorer). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy4yMDAuMCIsInVwZGF0ZWRJblZlciI6IjM3LjIwMC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiJ9--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
Marc Auberer
|
fb26b2d9a1 |
Update checkout action to v4 (#5479)
Upgrade checkout action to v4 to make use of Node 20. Node 16, which v3 is using, reaches end of life on 2023-09-11. |
||
|
Mohammed Keyvanzadeh
|
abf92f10f6 |
tools: update GitHub Actions workflows (#4943)
- Update the actions in the GitHub Actions workflows to their latest versions. - Run the workflows on the latest versions of the platforms where appropriate. - Set the `check-latest` field of the `actions/setup-node` action to `true` to use the latest release of the specified Node.js version instead of using the cached one when there's a new release available. - Explicitly specify the action versions instead of using the `latest` tag. |
||
|
Matt Godbolt
|
a4449cb012 |
Workflow bump v2 v3 checkout (#4140)
* Workflow bump v2 v3 checkout * Bump labeler |
||
|
Matt Godbolt
|
f2c1e0bd31 |
The Grand Reformat (#3643)
* The Grand Reformat - everything made prettier...literally - some tweaks to include a few more files, including documentation - minor changes to format style - some tiny `// prettier-ignore` changes to keep a few things the way we like them - a couple of super minor tweaks to embedded document types to ensure they format correctly |
||
|
Matt Godbolt
|
b4756bb022 | Create security scanner |
